Defending Kubernetes
trilwu/secskills
Harden and monitor a Kubernetes cluster against the attacks that actually happen — RBAC least privilege and escalation paths, Pod Security Admission enforcement, network policy default-deny, secrets…
Plans and configures multi-tenancy on GKE. An agent skill from google/skills.
Install Gke Multitenancy
$ npx skills add google/skills --skill gke-multitenancy -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install google/skills gke-multitenancy --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/google/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/cloud/gke-multitenancy .claude/skills/gke-multitenancy && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "gke-multitenancy" agent skill from https://github.com/google/skills/tree/main/skills/cloud/gke-multitenancy into .claude/skills/gke-multitenancy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gke-multitenancy", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/google/skills/tree/main/skills/cloud/gke-multitenancyType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add google/skills --skill gke-multitenancy -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install google/skills gke-multitenancy --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/google/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/cloud/gke-multitenancy .agents/skills/gke-multitenancy && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "gke-multitenancy" agent skill from https://github.com/google/skills/tree/main/skills/cloud/gke-multitenancy into .agents/skills/gke-multitenancy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gke-multitenancy", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add google/skills --skill gke-multitenancy -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install google/skills gke-multitenancy --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/google/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/cloud/gke-multitenancy .cursor/skills/gke-multitenancy && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "gke-multitenancy" agent skill from https://github.com/google/skills/tree/main/skills/cloud/gke-multitenancy into .cursor/skills/gke-multitenancy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gke-multitenancy", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/google/skills.git --path skills/cloud/gke-multitenancy--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add google/skills --skill gke-multitenancy -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install google/skills gke-multitenancy --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/google/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/cloud/gke-multitenancy .gemini/skills/gke-multitenancy && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "gke-multitenancy" agent skill from https://github.com/google/skills/tree/main/skills/cloud/gke-multitenancy into .gemini/skills/gke-multitenancy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gke-multitenancy", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install google/skills gke-multitenancyInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add google/skills --skill gke-multitenancy -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/google/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/cloud/gke-multitenancy .github/skills/gke-multitenancy && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "gke-multitenancy" agent skill from https://github.com/google/skills/tree/main/skills/cloud/gke-multitenancy into .github/skills/gke-multitenancy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gke-multitenancy", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add google/skills --skill gke-multitenancy -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install google/skills gke-multitenancy --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/google/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/cloud/gke-multitenancy .opencode/skills/gke-multitenancy && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "gke-multitenancy" agent skill from https://github.com/google/skills/tree/main/skills/cloud/gke-multitenancy into .opencode/skills/gke-multitenancy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gke-multitenancy", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
gke-multitenancy- GitHub stars
- 21k
- Token cost
- ~1.3k tokens
- SKILL.md length
- 256 words
- Files
- 1
- Skills in repo
- 145
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Plans and configures multi-tenancy on GKE. An agent skill from google/skills.
- Works in 5 steps: Create Namespaces → RBAC Configuration → Resource Quotas → …
- Designing GKE multi-tenancy
- SKILL.md covers When to Use, Multi-Tenancy Models, Namespace Isolation Setup and Cost Allocation
- Calls kubectl and gcloud
What it does
Gke Multitenancy is an agent skill from google/skills, published by the product's own GitHub organization. Plans and configures multi-tenancy on GKE. Covers namespace isolation, RBAC planning for teams, resource quotas, LimitRanges, network isolation, and cost allocation. Use when designing GKE multi-tenancy, configuring GKE namespaces, setting up resource quotas, or isolating GKE teams. Don't use for single-tenant cluster configuration or general deployment instructions (use gke-basics or gke-app-onboarding instead).
Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Authorization and RBAC, Multi-tenancy and Cloud cost optimization. It works with Google Kubernetes Engine and Kubernetes. The repository describes itself as: Agent Skills for Google products and technologies. The licence is Apache-2.0.
When your agent uses it
- Designing GKE multi-tenancy
- Configuring GKE namespaces
- Setting up resource quotas
- Isolating GKE teams
Example prompts
- “Use the gke-multitenancy skill to plan and configures multi-tenancy on GKE. An agent skill from google/skills”
- “/gke-multitenancy”
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 8a1ac05. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
kubectlgcloud
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use kubectl and gcloud, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Gke Multitenancy loads about 1.3k tokens when it runs. Until then it costs about 108 tokens; SKILL.md has 256 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from google/skills at commit 8a1ac05, republished under its Apache-2.0 licence (© google). 256 words, ~1,345 tokens.
Download SKILL.mdSave it as
.claude/skills/gke-multitenancy/SKILL.md (or your agent's skills folder).- name
- gke-multitenancy
- description
- Plans and configures multi-tenancy on GKE. Covers namespace isolation, RBAC planning for teams, resource quotas, LimitRanges, network isolation, and cost allocation. Use when designing GKE multi-tenancy, configuring GKE namespaces, setting up resource quotas, or isolating GKE teams. Don't use for single-tenant cluster configuration or general deployment instructions (use gke-basics or gke-app-onboarding instead).
- metadata.version
- 1.0.0
- metadata.category
- Containers
GKE Multi-Tenancy
This reference covers enterprise multi-tenancy patterns on GKE, including namespace isolation, RBAC planning, resource quotas, and network segmentation.
MCP Tools:
apply_k8s_manifest,get_k8s_resource,check_k8s_auth,describe_k8s_resource,delete_k8s_resource
When to Use
- Multiple teams sharing a single GKE cluster
- Isolating workloads by environment (dev/staging/prod) within one cluster
- Implementing least-privilege access control
- Cost allocation across teams or projects
Multi-Tenancy Models
| Model | Isolation | Complexity | Cost |
|---|---|---|---|
| Namespace-per-team | Soft (RBAC + | Low | Lowest (shared |
| : : Network : : cluster) : | |||
| : : Policy) : : : | |||
| Namespace-per-environment | Soft | Low | Low |
| Node pool-per-team | Medium | Medium | Medium |
| : : (dedicated : : : | |||
| : : compute) : : : | |||
| Cluster-per-team | Hard (full | High | Highest |
| : : isolation) : : : |
Golden path recommendation: Start with namespace-per-team for cost efficiency. Escalate to stronger isolation only when compliance requires it.
Namespace Isolation Setup
1. Create Namespaces
kubectl create namespace team-a
kubectl create namespace team-b
kubectl label namespace team-a team=a
kubectl label namespace team-b team=b2. RBAC Configuration
Principle: Grant minimal permissions per namespace. Never bind to
system:authenticated.
# Namespace-scoped role for a team
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: team-a-developer
namespace: team-a
rules:
- apiGroups: ["", "apps", "batch"]
resources: ["pods", "deployments", "services", "configmaps", "jobs"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: team-a-developers
namespace: team-a
subjects:
- kind: Group
name: "team-a@example.com" # Google Group
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: team-a-developer
apiGroup: rbac.authorization.k8s.ioRBAC best practices: Use Google Groups for subject bindings. Prefer
namespace-scoped Roles over ClusterRoles. See the gke-platform-security skill
for full RBAC hardening guidance.
3. Resource Quotas
Prevent any single team from consuming all cluster resources:
apiVersion: v1
kind: ResourceQuota
metadata:
name: team-a-quota
namespace: team-a
spec:
hard:
requests.cpu: "10"
requests.memory: "20Gi"
limits.cpu: "20"
limits.memory: "40Gi"
pods: "50"
services: "10"
persistentvolumeclaims: "10"4. LimitRanges
Set default and maximum resource constraints per container:
apiVersion: v1
kind: LimitRange
metadata:
name: team-a-limits
namespace: team-a
spec:
limits:
- type: Container
default:
cpu: "500m"
memory: "512Mi"
defaultRequest:
cpu: "100m"
memory: "128Mi"
max:
cpu: "4"
memory: "8Gi"[!IMPORTANT] Mandatory Defaults: When defining
minormaxlimits in aLimitRange, you must also define correspondingdefaultanddefaultRequestvalues. If you set aminormaxwithout defaults, any pod deployed without explicit resource requests/limits will be rejected by the admission controller.
5. Network Isolation
Apply default-deny per namespace (see the gke-workload-security skill), then
allow intra-team traffic:
# Allow same-namespace pods to talk + DNS
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-same-namespace
namespace: team-a
spec:
podSelector: {}
ingress:
- from:
- podSelector: {}
egress:
- to:
- podSelector: {}
- to: # Allow DNS
- namespaceSelector: {}
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53Cost Allocation
Labels for Cost Attribution
# Label namespaces for billing
kubectl label namespace team-a cost-center=engineering
kubectl label namespace team-b cost-center=data-scienceGKE Cost Allocation
Enable GKE cost allocation to break down costs by namespace and label:
gcloud container clusters update <CLUSTER_NAME> --region <REGION> \
--enable-cost-allocationView in Cloud Billing > GKE Cost Allocation.
© google, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/cloud/gke-multitenancy of google/skills.
Open the folder on GitHubat commit 8a1ac05
Compare with similar skills
Gke Multitenancy next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Gke Multitenancy this skillgoogle/skills | 21k | — | ~1.3k | Automated safety check: Pass | Apache-2.0 | |
| Defending Kubernetestrilwu/secskills | 156 | — | ~2.2k | Automated safety check: Pass | MIT | |
| Mirrord Operatoraiskillstore/marketplace | 430 | — | ~4.6k | Automated safety check: Pass | None | |
| KubeSphere Multi-Tenant Managementkubesphere/kubesphere | 17k | — | ~3.1k | Automated safety check: Pass | Custom licence | |
| Kubernetes SpecialistJeffallan/claude-skills | 12k | 1 repos | ~2.1k | Automated safety check: Pass | MIT | |
| Securing Kubernetes On Cloudmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.3k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Mirrord Operator
aiskillstore/marketplace
Help users install and configure the mirrord Operator for team/enterprise environments.
KubeSphere Multi-Tenant Management
kubesphere/kubesphere
Creates and queries KubeSphere users, workspaces and projects and assigns built-in roles, defaulting to least privilege and never deleting anything.
Kubernetes Specialist
Jeffallan/claude-skills
Creates and checks Kubernetes manifests, Helm charts, RBAC and network policies, and helps debug pod problems, with kubectl checks and rollback steps.
Securing Kubernetes On Cloud
mukul975/Anthropic-Cybersecurity-Skills
Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity (IRSA for EKS, Workload Identity for GKE, Managed Identities for…
K8s Security Policies
Cybereason-Public/owLSM
Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.
More from google/skills
All 145 skills in this repo- Official
Google Cloud PAM Helper
google/skills
Manages Google Cloud Privileged Access Manager entitlements and grants: create and edit entitlements, request temporary access, and approve or deny pending grants.
- Official
Agent Platform Alert Configuration
google/skills
Writes Terraform alerting policies for AI agents that emit OpenTelemetry metrics, covering reliability, cost, safety, security and quality signals on Google Cloud.
- Official
Model Garden Deployment
google/skills
Deploys open models or custom weights from Model Garden to Agent Platform endpoints, checks deployment status and cleans up endpoints, confirming before any change.
- Official
Agent Platform Skill Registry
google/skills
Searches, manages and scaffolds skills in the Gemini Enterprise Agent Platform Skill Registry using bundled Python scripts and Google Cloud credentials.
- Official
GCP Application Design Center Deploy
google/skills
Designs GCP infrastructure as local Terraform, validates and scans it against best practices, then imports it to Application Design Center for deployment and troubleshooting.
- Official
BigQuery Slot and Cost Optimizer
google/skills
Analyzes BigQuery slot use, query costs and execution bottlenecks from INFORMATION_SCHEMA to diagnose slow queries, slot contention and unpartitioned scans.
Related
Works with
Categories
Questions about Gke Multitenancy
What does Gke Multitenancy do?
Plans and configures multi-tenancy on GKE. An agent skill from google/skills. Gke Multitenancy is an agent skill from google/skills, published by the product's own GitHub organization. Plans and configures multi-tenancy on GKE.
When should I use Gke Multitenancy?
Gke Multitenancy fits situations like: designing GKE multi-tenancy; configuring GKE namespaces; setting up resource quotas; isolating GKE teams.
How do I install Gke Multitenancy in Claude Code?
Run `npx skills add google/skills --skill gke-multitenancy -a claude-code`. Or copy the skill folder (skills/cloud/gke-multitenancy in google/skills) into .claude/skills/gke-multitenancy in your project. Claude Code loads it when a task matches its description.
How do I install Gke Multitenancy in Codex?
Run `npx skills add google/skills --skill gke-multitenancy -a codex`. Or copy the skill folder (skills/cloud/gke-multitenancy in google/skills) into .agents/skills/gke-multitenancy in your project. Codex loads it when a task matches its description.
Can I use Gke Multitenancy in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add google/skills --skill gke-multitenancy -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/gke-multitenancy, .gemini/skills/gke-multitenancy, .github/skills/gke-multitenancy and .opencode/skills/gke-multitenancy in your project.
What does Gke Multitenancy need to run?
Going by SKILL.md and its folder, Gke Multitenancy needs the command-line tools its instructions call (kubectl and gcloud).
Does Gke Multitenancy access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Gke Multitenancy safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Gke Multitenancy use?
Gke Multitenancy is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Gke Multitenancy use?
About 1.3k tokens (SKILL.md is roughly 5.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Gke Multitenancy?
Skills that share tags, products or a category with Gke Multitenancy: Defending Kubernetes (trilwu/secskills, 156 stars), Mirrord Operator (aiskillstore/marketplace, 430 stars), KubeSphere Multi-Tenant Management (kubesphere/kubesphere, 17k stars) and Kubernetes Specialist (Jeffallan/claude-skills, 12k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Gke Multitenancy?
google (a GitHub organization, an official publisher) maintains it in google/skills, which has 20,994 GitHub stars. The repository holds 145 skills in this directory. The repository was last updated on October 6, 2026.
Source: google/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.