Agent skill
gke-security-hardening-guide
GKE security hardening guide with Pulumi. Private clusters, Workload Identity, Binary Authorization, network policies, IAM configuration, and runtime security enforcement.
Install this agent skill to your Project
npx add-skill https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/secure/skills/gke-security-hardening-guide
SKILL.md
GKE Security Hardening Guide
When to Use This Skill
Defense in Depth
GKE security hardening follows a layered approach:
- Control plane - Private clusters, authenticated access, audit logging
- Network - VPC-native networking, network policies, egress controls
- Identity - Workload Identity Federation, least-privilege IAM, audit trails
- Runtime - Pod Security Standards, admission controllers, monitoring
This guide uses Pulumi for Infrastructure as Code, enabling repeatable, auditable cluster deployments across environments (QAC, DEV, STG, PRD).
Environment Promotion Order
Always promote changes through: QAC → DEV → STG → PRD → OPS
Never skip environments in the promotion pipeline.
Prerequisites
- GCP project with billing enabled
gcloudCLI installed and authenticated- Pulumi 3.0+
- kubectl configured for cluster access
- Appropriate IAM permissions (Project Editor or Security Admin roles)
Production Warning
These configurations enforce strict security controls. Test in QAC/DEV before production deployment.
Implementation
See examples.md for detailed code examples.
Verification
After deployment, verify the security posture using the verification checklists in each configuration module.
Anti-Patterns to Avoid
| Misconfiguration | Risk | Fix |
|---|---|---|
| Public cluster endpoint | Exposed API server | Set privateClusterConfig.enablePrivateNodes = true |
| Metadata server enabled | Pod can access node credentials | Set workloadMetadataConfig.mode = "GKE_METADATA" |
| No network policies | All-to-all traffic | Apply default-deny + explicit policies |
| Privileged containers | Root container escape | Set securityContext.privileged = false |
| No admission controllers | Insecure pods deployed | Deploy validating/mutating webhooks |
| No audit logging | Compliance blind spot | Enable GKE Cloud Logging sink |
| Overpermissioned service accounts | Lateral movement | Use Workload Identity + least-privilege IAM |
| Public container registry | Image tampering | Use private Artifact Registry + Binary Auth |
Attack Surface Reduction
Each misconfiguration listed above represents a verified attack vector. Fix all items before production deployment.
Examples
See examples.md for code examples.
Full Reference
See reference.md for complete documentation.
Related Patterns
- Enforce
- Secure
- Patterns
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
adaptive-enforcement-lab/claude-skills
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
adaptive-enforcement-lab/claude-skills
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
adaptive-enforcement-lab/claude-skills
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
adaptive-enforcement-lab/claude-skills
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
adaptive-enforcement-lab/claude-skills
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
adaptive-enforcement-lab/claude-skills
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
Didn't find tool you were looking for?