搜索「Kubernetes」的结果

io.github.mukul975/Anthropic-Cybersecurity-Skills/detecting-privilege-escalation-in-kubernetes-pods

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do not use for escalation through RBAC and service-account permissions - use auditing-kubernetes-rbac-privilege-escalation.

io.github.mukul975/Anthropic-Cybersecurity-Skills/performing-kubernetes-etcd-security-assessment

Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use performing-kubernetes-cis-benchmark-with-kube-bench.

io.github.mukul975/Anthropic-Cybersecurity-Skills/performing-kubernetes-cis-benchmark-with-kube-bench

Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled compliance audit, triaging kube-bench results, deciding which controls are not applicable on EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes Benchmark, control plane, remediation, compliance evidence, SOC 2, PCI DSS, managed cluster exception. Do not use for installing and running the tool - use benchmarking-kubernetes-with-kube-bench.

io.github.mukul975/Anthropic-Cybersecurity-Skills/implementing-rbac-hardening-for-kubernetes

Hardens Kubernetes RBAC by designing least-privilege Roles and ClusterRoles, auditing RoleBindings, eliminating cluster-admin sprawl, separating service accounts, and integrating an external OIDC identity provider. Use when tightening cluster access control, removing excessive ClusterRoleBindings, or hardening service-account permissions against escalation and lateral movement. Keywords: RBAC, Role, ClusterRole, RoleBinding, least privilege, service account, OIDC, cluster-admin. Do not use for discovering existing escalation paths - use auditing-kubernetes-rbac-privilege-escalation.

io.github.mukul975/Anthropic-Cybersecurity-Skills/implementing-kubernetes-pod-security-standards

Chooses and applies the correct Kubernetes Pod Security Standard (Privileged, Baseline, Restricted) for a workload: what each profile forbids, how to map existing workloads to a profile, which securityContext fields must change, and how to plan a PodSecurityPolicy-to-PSS migration without breaking running pods. Use when deciding which pod security profile a namespace or workload should run under, auditing which workloads would fail Restricted, planning a PSP migration, or mapping pod security posture to a compliance control. Keywords: Pod Security Standards, PSS, Privileged, Baseline, Restricted, securityContext, runAsNonRoot, drop ALL capabilities, seccomp RuntimeDefault, PSP migration. Do not use for configuring the admission controller that enforces these profiles - use implementing-pod-security-admission-controller.

io.github.mukul975/Anthropic-Cybersecurity-Skills/implementing-kubernetes-network-policy-with-calico

Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny baselines, policy ordering and precedence, service-account-based selectors, and verifying that policy is genuinely being enforced. Use when adopting Calico as the enforcement CNI, establishing a default-deny baseline, or debugging why a NetworkPolicy is not taking effect under Calico. Keywords: Calico CNI, NetworkPolicy, default deny, policy order, Felix, service account selector. Do not use for Calico-only CRDs such as GlobalNetworkPolicy or DNS egress - use implementing-container-network-policies-with-calico; for CNI-agnostic policy use implementing-network-policies-for-kubernetes.

io.github.mukul975/Anthropic-Cybersecurity-Skills/benchmarking-kubernetes-with-kube-bench

Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.

io.github.mukul975/Anthropic-Cybersecurity-Skills/auditing-kubernetes-rbac-privilege-escalation

Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change. Keywords: RBAC, ClusterRoleBinding, service account token, auth can-i, rbac-police, escalate, bind, impersonate. Do not use for designing and applying hardened RBAC - use implementing-rbac-hardening-for-kubernetes.

io.github.mukul975/Anthropic-Cybersecurity-Skills/analyzing-kubernetes-audit-logs

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '

io.github.mukul975/Anthropic-Cybersecurity-Skills/scanning-kubernetes-manifests-with-kubesec

Scores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deployment, mapping each finding back to the securityContext change that fixes it. Use when gating manifests in CI, reviewing YAML or a rendered chart before it reaches a cluster, or explaining why a manifest scored negatively. Keywords: Kubesec, manifest score, securityContext, readOnlyRootFilesystem, runAsNonRoot, CI gate. Do not use for scanning built images for CVEs - use scanning-docker-images-with-trivy; for admission-time enforcement use implementing-opa-gatekeeper-for-policy-enforcement.

io.github.mukul975/Anthropic-Cybersecurity-Skills/performing-kubernetes-penetration-testing

Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise. Use for an authorized penetration test or hands-on validation that controls actually stop an attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token theft, lateral movement, cluster takeover. Do not use for a configuration-only compliance audit - use performing-kubernetes-cis-benchmark-with-kube-bench.

io.github.mukul975/Anthropic-Cybersecurity-Skills/implementing-network-policies-for-kubernetes

Writes portable upstream Kubernetes NetworkPolicy YAML - default-deny-all, DNS egress, namespace and pod selector rules - that works on any conformant CNI such as Calico or Cilium. Use when segmentation must stay CNI-portable, introducing a default-deny posture, or restricting east-west traffic between pods and namespaces without depending on a vendor CRD. Keywords: NetworkPolicy, default deny, podSelector, namespaceSelector, ingress, egress, CNI portable. Do not use for Calico-specific resources - use implementing-kubernetes-network-policy-with-calico.

io.github.affaan-m/ECC/kubernetes-patterns

Kubernetes workload patterns, resource management, RBAC, probes, autoscaling, ConfigMap/Secret handling, and kubectl debugging for production-grade deployments. Use when writing or reviewing Kubernetes manifests, or debugging probes, RBAC, autoscaling, or resource limits.

io.github.mukul975/Anthropic-Cybersecurity-Skills/securing-kubernetes-on-cloud

Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity (IRSA for EKS, Workload Identity for GKE, Managed Identities for AKS), RBAC scoping, image admission controls, and runtime security monitoring. Use when deploying a new managed Kubernetes cluster with security requirements or hardening an existing EKS, AKS, or GKE cluster after an audit or pentest finding.

io.github.jeremylongshore/claude-code-plugins-plus-skills/kubernetes-rbac-analyzer

Analyze kubernetes rbac analyzer operations. Auto-activating skill for Security Advanced. Triggers on: kubernetes rbac analyzer, kubernetes rbac analyzer Part of the Security Advanced skill category. Use when analyzing or auditing kubernetes rbac analyzer. Trigger with phrases like "kubernetes rbac analyzer", "kubernetes analyzer", "analyze kubernetes rbac r".

io.github.jeremylongshore/claude-code-plugins-plus-skills/kubernetes-service-manager

Manage kubernetes service manager operations. Auto-activating skill for DevOps Advanced. Triggers on: kubernetes service manager, kubernetes service manager Part of the DevOps Advanced skill category. Use when working with kubernetes service manager functionality. Trigger with phrases like "kubernetes service manager", "kubernetes manager", "kubernetes".

io.github.jeremylongshore/claude-code-plugins-plus-skills/kubernetes-secrets-manager

Manage kubernetes secrets manager operations. Auto-activating skill for DevOps Advanced. Triggers on: kubernetes secrets manager, kubernetes secrets manager Part of the DevOps Advanced skill category. Use when working with kubernetes secrets manager functionality. Trigger with phrases like "kubernetes secrets manager", "kubernetes manager", "kubernetes".

io.github.jeremylongshore/claude-code-plugins-plus-skills/kubernetes-ingress-config

Configure kubernetes ingress config operations. Auto-activating skill for DevOps Advanced. Triggers on: kubernetes ingress config, kubernetes ingress config Part of the DevOps Advanced skill category. Use when configuring systems or services. Trigger with phrases like "kubernetes ingress config", "kubernetes config", "kubernetes".

io.github.jeremylongshore/claude-code-plugins-plus-skills/kubernetes-deployment-creator

Create kubernetes deployment creator operations. Auto-activating skill for DevOps Advanced. Triggers on: kubernetes deployment creator, kubernetes deployment creator Part of the DevOps Advanced skill category. Use when deploying applications or services. Trigger with phrases like "kubernetes deployment creator", "kubernetes creator", "deploy kubernetes ment creator".

io.github.jeremylongshore/claude-code-plugins-plus-skills/kubernetes-configmap-handler

Configure kubernetes configmap handler operations. Auto-activating skill for DevOps Advanced. Triggers on: kubernetes configmap handler, kubernetes configmap handler Part of the DevOps Advanced skill category. Use when configuring systems or services. Trigger with phrases like "kubernetes configmap handler", "kubernetes handler", "kubernetes".

io.github.notque/vexjoy-agent/kubernetes-security

Kubernetes security: RBAC, PodSecurity, network policies.

io.github.notque/vexjoy-agent/kubernetes-debugging

Kubernetes debugging for pod failures and networking.

io.github.Dynatrace/dynatrace-for-ai/dt-obs-kubernetes

Kubernetes cluster, pod, node, and workload monitoring. Use when analyzing K8s health, resource optimization, pod failures, OOMKills, scheduling, or security posture. Also use for Kubernetes operational events like pod restarts, OOM events, evictions, and cluster event history. Trigger: "Kubernetes pods", "K8s cluster health", "OOMKill", "pod restarts", "container CPU", "namespace resource usage", "over-provisioned pods", "privileged containers", "pod placement", "K8s node capacity", "running containers by cluster", "workload scheduling", "pod evictions", "K8s labels and annotations", "kubernetes events", "pod restart events", "OOM events", "K8s event history". Do NOT use for explaining existing queries, product documentation questions, AWS-specific resource queries, service-level RED metrics, distributed tracing, or log analysis — use the relevant skill instead.

io.github.cosmix/loom/loom-kubernetes

Kubernetes deployment, cluster architecture, security, and operations. Use for manifests, Helm charts, RBAC, network policies, operators/CRDs, PodSecurityStandards, troubleshooting, and production best practices.