Agent skill
gke-cluster-configuration
Private GKE cluster setup, Workload Identity, and Shielded Nodes with Binary Authorization using Terraform.
Install this agent skill to your Project
npx add-skill https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/secure/skills/gke-cluster-configuration
SKILL.md
GKE Cluster Configuration
When to Use This Skill
This section covers the foundational security configurations for GKE clusters:
- Private GKE Cluster - Private control plane, VPC networking, and encrypted etcd
- Workload Identity - Pod-to-GCP authentication without service account keys
- Binary Authorization - Shielded Nodes and image verification
Public Cluster Risk
Public control planes expose your cluster API to the internet. Even with strong authentication, this increases attack surface and is not recommended for production.
Prerequisites
- GCP project with billing enabled
gcloudCLI installed and authenticated- Terraform 1.0+
- kubectl configured for cluster access
- Appropriate IAM permissions (Project Editor or Security Admin roles)
Production Warning
These configurations enforce strict security controls. Test in QAC/DEV before production deployment.
Implementation
Fundamental cluster security configuration covering private networking, identity federation, and image verification.
Overview
This section covers the foundational security configurations for GKE clusters:
- Private GKE Cluster - Private control plane, VPC networking, and encrypted etcd
- Workload Identity - Pod-to-GCP authentication without service account keys
- Binary Authorization - Shielded Nodes and image verification
Public Cluster Risk
Public control planes expose your cluster API to the internet. Even with strong authentication, this increases attack surface and is not recommended for production.
Security Principles
Defense in Depth
- Private Control Plane: API server accessible only from authorized networks
- Workload Identity: Pods authenticate to GCP without static credentials
- Shielded Nodes: Secure boot, measured boot, and integrity monitoring
- Binary Authorization: Only verified container images run on the cluster
Configuration Management
All configurations use Terraform for Infrastructure as Code, enabling:
- Repeatable deployments across environments
- Version-controlled security policies
- Automated compliance validation
- Drift detection and remediation
Prerequisites
- GCP project with billing enabled
gcloudCLI installed and authenticated- Terraform 1.0+
- kubectl configured for cluster access
- Appropriate IAM permissions (Project Editor or Security Admin roles)
Production Warning
These configurations enforce strict security controls. Test in QAC/DEV before production deployment.
Quick Start
See examples.md for detailed code examples.
Related Configuration
- Network Security - VPC-native networking, Network Policies, Private Service Connect
- IAM Configuration - Least-privilege IAM, audit logging, service accounts
- Runtime Security - Pod Security Standards, admission controllers, monitoring
Overview
This section covers the foundational security configurations for GKE clusters:
- Private GKE Cluster - Private control plane, VPC networking, and encrypted etcd
- Workload Identity - Pod-to-GCP authentication without service account keys
- Binary Authorization - Shielded Nodes and image verification
Public Cluster Risk
Public control planes expose your cluster API to the internet. Even with strong authentication, this increases attack surface and is not recommended for production.
Security Principles
Defense in Depth
- Private Control Plane: API server accessible only from authorized networks
- Workload Identity: Pods authenticate to GCP without static credentials
- Shielded Nodes: Secure boot, measured boot, and integrity monitoring
- Binary Authorization: Only verified container images run on the cluster
Configuration Management
All configurations use Terraform for Infrastructure as Code, enabling:
- Repeatable deployments across environments
- Version-controlled security policies
- Automated compliance validation
- Drift detection and remediation
Prerequisites
- GCP project with billing enabled
gcloudCLI installed and authenticated- Terraform 1.0+
- kubectl configured for cluster access
- Appropriate IAM permissions (Project Editor or Security Admin roles)
Production Warning
These configurations enforce strict security controls. Test in QAC/DEV before production deployment.
Quick Start
See examples.md for detailed code examples.
Related Configuration
- Network Security - VPC-native networking, Network Policies, Private Service Connect
- IAM Configuration - Least-privilege IAM, audit logging, service accounts
- Runtime Security - Pod Security Standards, admission controllers, monitoring
Key Principles
Defense in Depth
- Private Control Plane: API server accessible only from authorized networks
- Workload Identity: Pods authenticate to GCP without static credentials
- Shielded Nodes: Secure boot, measured boot, and integrity monitoring
- Binary Authorization: Only verified container images run on the cluster
Configuration Management
All configurations use Terraform for Infrastructure as Code, enabling:
- Repeatable deployments across environments
- Version-controlled security policies
- Automated compliance validation
- Drift detection and remediation
Related Patterns
- Network Security
- IAM Configuration
- Runtime Security
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
adaptive-enforcement-lab/claude-skills
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
adaptive-enforcement-lab/claude-skills
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
adaptive-enforcement-lab/claude-skills
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
adaptive-enforcement-lab/claude-skills
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
adaptive-enforcement-lab/claude-skills
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
adaptive-enforcement-lab/claude-skills
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
Didn't find tool you were looking for?