jappel/leistungsbilanz-ts
1
0
Fork 1
Code Issues 6 Pull requests Projects Releases Packages Wiki Activity Actions
leistungsbilanz-ts/.claude/skills/codeguard/rules/codeguard-0-cloud-orchestration-kubernetes.md
Grovy311 67476ea59b Add agent security skills for Codex and Claude Code 
Same skills in .agents/skills (Codex) and .claude/skills (Claude Code):
codeguard, security-review, dependency-vetting, pre-release-gate,
authz-idor-audit, threat-model-light. Source: cj/claude-skills.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 09:40:33 +02:00

1.7 KiB
Raw Blame History

description languages alwaysApply tags
Kubernetes hardening (RBAC, admission policies, network policies, secrets, supply chain)
yaml
false
infrastructure

rule_id: codeguard-0-cloud-orchestration-kubernetes

Cloud & Orchestration (Kubernetes)

Kubernetes cluster and workload hardening: identity, policy, networking, secrets, and supply chain controls.

Controls

  • Identity & RBAC: least privilege for users and service accounts; separate namespaces; bind only needed roles.
  • Policy: admission controls (OPA/Gatekeeper/Kyverno) for image sources, capabilities, root, network policies, and required labels/annotations.
  • Networking: default‑deny with network policies; explicit egress allow‑lists; service identity/mTLS within mesh where applicable.
  • Secrets: use KMS providers; avoid plaintext in manifests; rotate regularly; restrict secret mount paths.
  • Nodes: hardened OS, auto‑updates, minimal attack surface; isolate sensitive workloads with taints/tolerations and dedicated nodes.
  • Supply chain: verify image signatures; enforce provenance (SLSA/Sigstore) in admission.

Checklist

  • Namespaces per team/app; RBAC roles scoped; audit logging enabled.
  • Admission policies enforce image provenance, non‑root, dropped capabilities, read‑only root FS, and network policy presence.
  • Network policies in place for ingress/egress; service accounts scoped per deployment.

Verification

  • Cluster conformance and CIS benchmark scans.
  • Policy tests in CI for manifests (OPA unit tests); periodic admission dry‑run.

Incident Readiness

  • Enable audit logs and centralize; restrict access to etcd; backup/restore tested.
  • Define break‑glass roles with MFA and time‑bound approvals.