---
title: "Kubernetes Security Policies"
type: skill
id: "wshobson-agents/devops-cloud/k8s-security-policies"
category: "Engineering"
publisher: "Seth Hobson"
license: "MIT"
source: "https://github.com/wshobson/agents/tree/7e2fb55"
canonical: "https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/k8s-security-policies"
open_in_pho: "https://pho.chat/customize?item=wshobson-agents%2Fdevops-cloud%2Fk8s-security-policies&utm_source=labs&utm_medium=skill-page&utm_campaign=skills-library"
---

# Kubernetes Security Policies

Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

Source: Seth Hobson (MIT), copied at a pinned commit. Free to use. Part of the Phở Skills library (https://labs.pho.chat/en/skills).
Skill set: DevOps, cloud and reliability (https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud.md).

## What it covers
- Purpose
- When to Use This Skill
- Pod Security Standards
  - 1. Privileged (Unrestricted)
  - 2. Baseline (Minimally restrictive)
  - 3. Restricted (Most restrictive)
- Network Policies
  - Default Deny All
  - Allow Frontend to Backend
  - Allow DNS
- RBAC Configuration
  - Role (Namespace-scoped)
  - ClusterRole (Cluster-wide)
  - RoleBinding
- Pod Security Context
  - Restricted Pod
- Policy Enforcement with OPA Gatekeeper
  - ConstraintTemplate
  - Constraint
- Service Mesh Security (Istio)

## Other skills in this set
- [Deployment Pipeline Design](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/deployment-pipeline-design.md): Design multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use this skill when designing zero-downtime deployment pipelines, implementing canary rollout…
- [GitHub Actions Templates](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/github-actions-templates.md): Create production-ready GitHub Actions workflows for automated testing, building, and deploying applications. Use when setting up CI/CD with GitHub Actions, automating development workflows, or…
- [GitLab CI Patterns](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/gitlab-ci-patterns.md): Build GitLab CI/CD pipelines with multi-stage workflows, caching, and distributed runners for scalable automation. Use when implementing GitLab CI/CD, optimizing pipeline performance, or setting up…
- [Secrets Management](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/secrets-management.md): Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD…
- [Cloud Cost Optimization](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/cost-optimization.md): Optimize cloud costs across AWS, Azure, GCP, and OCI through resource rightsizing, tagging strategies, reserved instances, and spending analysis. Use when reducing cloud expenses, analyzing…
- [Hybrid Cloud Networking](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/hybrid-cloud-networking.md): Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting…
- [Istio Traffic Management](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/istio-traffic-management.md): Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or…
- [Linkerd Patterns](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/linkerd-patterns.md): Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking…
- [mTLS Configuration](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/mtls-configuration.md): Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.
- [Multi-Cloud Architecture](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/multi-cloud-architecture.md): Design multi-cloud architectures using a decision framework to select and integrate services across AWS, Azure, GCP, and OCI. Use when building multi-cloud systems, avoiding vendor lock-in, or…
- [Service Mesh Observability](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/service-mesh-observability.md): Implement comprehensive observability for service meshes including distributed tracing, metrics, and visualization. Use when setting up mesh monitoring, debugging latency issues, or implementing…
- [Terraform Module Library](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/terraform-module-library.md): Build reusable Terraform modules for AWS, Azure, GCP, and OCI infrastructure following infrastructure-as-code best practices. Use when creating infrastructure modules, standardizing cloud…
- [GitOps Workflow](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/gitops-workflow.md): Implement GitOps workflows with ArgoCD and Flux for automated, declarative Kubernetes deployments with continuous reconciliation. Use when implementing GitOps practices, automating Kubernetes…
- [Kubernetes Manifest Generator](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/k8s-manifest-generator.md): Create production-ready Kubernetes manifests for Deployments, Services, ConfigMaps, and Secrets following best practices and security standards. Use when generating Kubernetes YAML manifests…
- [Distributed Tracing](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/distributed-tracing.md): Implement distributed tracing with Jaeger and Tempo to track requests across microservices and identify performance bottlenecks. Use when debugging microservices, analyzing request flows, or…
- [Grafana Dashboards](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/grafana-dashboards.md): Create and manage production Grafana dashboards for real-time visualization of system and application metrics. Use when building monitoring dashboards, visualizing metrics, or creating operational…
- [Prometheus Configuration](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/prometheus-configuration.md): Set up Prometheus for comprehensive metric collection, storage, and monitoring of infrastructure and applications. Use when implementing metrics collection, setting up monitoring infrastructure, or…
- [SLO Implementation](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/slo-implementation.md): Define and implement Service Level Indicators (SLIs) and Service Level Objectives (SLOs) with error budgets and alerting. Use when establishing reliability targets, implementing SRE practices, or…
- [Connectivity Triage](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/connectivity-triage.md): Use this skill when debugging active macOS connectivity failures, when an API or MCP service times out or disconnects, when DNS resolution is failing or inconsistent, or when video calls or other…
- [Incident Runbook Templates](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/incident-runbook-templates.md): Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a service outage runbook for a payment processing…
- [On-Call Handoff Patterns](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/on-call-handoff-patterns.md): Master on-call shift handoffs with context transfer, escalation procedures, and documentation. Use this skill when transitioning on-call responsibilities between engineers and ensuring the incoming…
- [Postmortem Writing](https://labs.pho.chat/en/skills/wshobson-agents/devops-cloud/postmortem-writing.md): Write effective blameless postmortems with root cause analysis, timelines, and action items. Use when conducting incident reviews, writing postmortem documents, or improving incident response…

## Use it
- In Phở: open https://pho.chat/customize?item=wshobson-agents%2Fdevops-cloud%2Fk8s-security-policies&utm_source=labs&utm_medium=skill-page&utm_campaign=skills-library and press Try, or add it so Phở loads it whenever a request matches. Phở works with your own API key (OpenAI, Anthropic, Google and others).
- Full instructions (original SKILL.md, unchanged): https://labs.pho.chat/skills/raw/wshobson-agents/devops-cloud/skills/k8s-security-policies/SKILL.md
- Original files: https://github.com/wshobson/agents/tree/7e2fb55 (MIT).
- Full machine-readable index: https://labs.pho.chat/skills.json