New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Kubernetes Hardening

by BagelHole in BagelHole/DevOps-Security-Agent-Skills

Implement Kubernetes security contexts, Pod Security Standards, and network policies.

MITAuto-check passedDevOps & Cloud

Install Kubernetes Hardening

skills CLI
$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill kubernetes-hardening -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install BagelHole/DevOps-Security-Agent-Skills kubernetes-hardening --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/security/hardening/kubernetes-hardening .claude/skills/kubernetes-hardening && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
kubernetes-hardening
GitHub stars
1.2k
Token cost
~632 tokens
SKILL.md length
74 words
Files
1
Skills in repo
44
Repo updated
First seen
Licence
MIT

At a glance

Implement Kubernetes security contexts, Pod Security Standards, and network policies.

  • Hardening Kubernetes deployments
  • SKILL.md covers When to Use This Skill, Pod Security Standards, Security Context and Network Policies, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Meeting security compliance

What it does

Kubernetes Hardening is an agent skill from BagelHole/DevOps-Security-Agent-Skills. Implement Kubernetes security contexts, Pod Security Standards, and network policies. Secure cluster components and workloads. Use when hardening Kubernetes deployments or meeting security compliance.

Its SKILL.md is about 630 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Container orchestration, SOC 2 and security compliance and Cloud security. It works with Kubernetes. The repository describes itself as: Agent-ready DevOps, security, infrastructure, and compliance knowledge base with 80+ skills across Kubernetes, Terraform, AWS/Azure/GCP, AI platform operations, container… The licence is MIT.

When your agent uses it

  • Hardening Kubernetes deployments
  • Meeting security compliance

Example prompts

  • “/kubernetes-hardening”

What it can do on your machine

Read from SKILL.md and the folder at commit 0365f57. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are yaml).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Kubernetes Hardening loads about 632 tokens when it runs. Until then it costs about 55 tokens; SKILL.md has 74 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~55
When it runs · the whole SKILL.md, loaded when a task matches
~632

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from BagelHole/DevOps-Security-Agent-Skills at commit 0365f57, republished under its MIT licence (© BagelHole). 74 words, ~632 tokens.

Download SKILL.mdSave it as .claude/skills/kubernetes-hardening/SKILL.md (or your agent's skills folder).
name
kubernetes-hardening
description
Implement Kubernetes security contexts, Pod Security Standards, and network policies. Secure cluster components and workloads. Use when hardening Kubernetes deployments or meeting security compliance.
license
MIT
metadata.author
devops-skills
metadata.version
1.0

Kubernetes Hardening

Secure Kubernetes clusters and workloads.

When to Use This Skill

Use this skill when:

  • Hardening Kubernetes clusters
  • Implementing Pod Security Standards
  • Configuring network policies
  • Meeting security compliance

Pod Security Standards

yaml
# Namespace with restricted policy
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Security Context

yaml
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Network Policies

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web
spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 8080

RBAC

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-reader
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-reader-binding
subjects:
- kind: ServiceAccount
  name: myapp
roleRef:
  kind: Role
  name: app-reader
  apiGroup: rbac.authorization.k8s.io

Best Practices

  • Enable Pod Security Standards
  • Implement network policies
  • Use RBAC with least privilege
  • Enable audit logging
  • Secure etcd with encryption
  • Use service mesh for mTLS
  • Regular security scanning

© BagelHole, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in security/hardening/kubernetes-hardening of BagelHole/DevOps-Security-Agent-Skills.

Open the folder on GitHubat commit 0365f57

Compare with similar skills

Kubernetes Hardening next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Kubernetes Hardening compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Kubernetes Hardening this skillBagelHole/DevOps-Security-Agent-Skills1.2k—~632Automated safety check: PassMIT
KubeShark for KubernetesLukasNiessen/kubernetes-skill446—~1.2kAutomated safety check: PassMIT
Gke Manifest Generationgoogle/skills21k—~3.1kAutomated safety check: PassApache-2.0
Kubeshark Installerkubeshark/kubeshark12k—~3.6kAutomated safety check: NotesApache-2.0
Mirrord Operatormetalbear-co/mirrord5.4k1 repos~4.6kAutomated safety check: PassMIT
KubeSphere ServiceMesh Managerkubesphere/kubesphere17k—~2.4kAutomated safety check: PassCustom licence

Similar skills

  • KubeShark for Kubernetes

    LukasNiessen/kubernetes-skill

    Keeps Kubernetes manifests, Helm charts and policies grounded by diagnosing six failure modes, such as insecure defaults and API drift, and loading only matching references.

    446 GitHub stars~1.2k tokensUpdated 27 days ago
    DevOps & CloudAuto-check passed

  • Gke Manifest Generation

    google/skills

    Official

    Generates and updates secure, production-ready Kubernetes YAML manifests optimized for GKE Autopilot and GKE Standard clusters.

    21k GitHub stars~3.1k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • Kubeshark Installer

    kubeshark/kubeshark

    Installs and configures Kubeshark on a Kubernetes cluster, choosing between the quick CLI path and a Helm install with custom values.

    12k GitHub stars~3.6k tokensUpdated yesterday
    DevOps & CloudAuto-check: notes

  • Mirrord Operator

    metalbear-co/mirrord

    Help users install and configure the mirrord Operator for team/enterprise environments.

    5.4k GitHub starsUsed in 1 repo~4.6k tokens
    DevOps & CloudAuto-check passed

  • KubeSphere ServiceMesh Manager

    kubesphere/kubesphere

    Installs, checks and troubleshoots the KubeSphere ServiceMesh extension (Istio, Kiali, Jaeger), including grayscale release, sidecar injection, topology and tracing issues.

    17k GitHub stars~2.4k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

  • LangBot Deployment Guide

    langbot-app/LangBot

    Deploys and configures a LangBot instance with Docker Compose or Kubernetes, covering config.yaml, the Box sandbox runtime, the plugin runtime and the global API key.

    18k GitHub stars~1.5k tokensUpdated today
    DevOps & CloudAuto-check: notes

More from BagelHole/DevOps-Security-Agent-Skills

All 44 skills in this repo

  • Hashicorp Vault

    BagelHole/DevOps-Security-Agent-Skills

    Manage secrets and PKI with HashiCorp Vault. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.2k GitHub stars~2k tokensUpdated 4 mo ago
    Auto-check passed

  • Incident Response

    BagelHole/DevOps-Security-Agent-Skills

    Handle security incidents with IR playbooks and procedures. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.2k GitHub stars~4.5k tokensUpdated 4 mo ago
    Auto-check passed

  • Kubernetes Ops

    BagelHole/DevOps-Security-Agent-Skills

    Deploy, scale, and manage Kubernetes workloads. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.2k GitHub stars~2.3k tokensUpdated 4 mo ago
    Auto-check passed

  • Linux Hardening

    BagelHole/DevOps-Security-Agent-Skills

    Apply CIS benchmarks and secure Linux servers. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.2k GitHub stars~662 tokensUpdated 4 mo ago
    Auto-check: notes

  • Prometheus Grafana

    BagelHole/DevOps-Security-Agent-Skills

    Set up metrics collection and visualization with Prometheus and Grafana.

    1.2k GitHub stars~2.5k tokensUpdated 4 mo ago
    Auto-check passed

  • Vulnerability Scanning

    BagelHole/DevOps-Security-Agent-Skills

    Scan systems and dependencies for CVEs and security vulnerabilities.

    1.2k GitHub stars~2.4k tokensUpdated 4 mo ago
    Auto-check passed

Works with

Categories

Questions about Kubernetes Hardening

What does Kubernetes Hardening do?

Implement Kubernetes security contexts, Pod Security Standards, and network policies. Kubernetes Hardening is an agent skill from BagelHole/DevOps-Security-Agent-Skills. Implement Kubernetes security contexts, Pod Security Standards, and network policies.

When should I use Kubernetes Hardening?

Kubernetes Hardening fits situations like: hardening Kubernetes deployments; meeting security compliance.

How do I install Kubernetes Hardening in Claude Code?

Run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill kubernetes-hardening -a claude-code`. Or copy the skill folder (security/hardening/kubernetes-hardening in BagelHole/DevOps-Security-Agent-Skills) into .claude/skills/kubernetes-hardening in your project. Claude Code loads it when a task matches its description.

How do I install Kubernetes Hardening in Codex?

Run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill kubernetes-hardening -a codex`. Or copy the skill folder (security/hardening/kubernetes-hardening in BagelHole/DevOps-Security-Agent-Skills) into .agents/skills/kubernetes-hardening in your project. Codex loads it when a task matches its description.

Can I use Kubernetes Hardening in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill kubernetes-hardening -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/kubernetes-hardening, .gemini/skills/kubernetes-hardening, .github/skills/kubernetes-hardening and .opencode/skills/kubernetes-hardening in your project.

What does Kubernetes Hardening need to run?

SKILL.md names no scripts, command-line tools or credentials: Kubernetes Hardening is instructions for the agent only.

Does Kubernetes Hardening access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Kubernetes Hardening safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Kubernetes Hardening use?

Kubernetes Hardening is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Kubernetes Hardening use?

About 632 tokens (SKILL.md is roughly 2.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Kubernetes Hardening?

Skills that share tags, products or a category with Kubernetes Hardening: KubeShark for Kubernetes (LukasNiessen/kubernetes-skill, 446 stars), Gke Manifest Generation (google/skills, 21k stars), Kubeshark Installer (kubeshark/kubeshark, 12k stars) and Mirrord Operator (metalbear-co/mirrord, 5.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Kubernetes Hardening?

BagelHole (a GitHub user) maintains it in BagelHole/DevOps-Security-Agent-Skills, which has 1,152 GitHub stars. The repository holds 44 skills in this directory. The repository was last updated on May 22, 2026.

Source: BagelHole/DevOps-Security-Agent-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.