Skill UI

Provides a comprehensive reference for implementing Kubernetes security policies, covering NetworkPolicy segmentation, RBAC least-privilege configurations, Pod Security Standards, GuardGate enforcement templates, and Istio mesh controls for secure multi-tenant clusters.

Detects and prevents privilege escalation for Kubernetes pods by combining admission policies (Pod Security Admission, OPA Gatekeeper) and runtime monitoring (Falco) to watch security contexts, capabilities, syscalls, and audit logs for privileged containers, host namespace access, or dangerous capabilities.

Use OPA Gatekeeper to enforce Kubernetes admission policies through ConstraintTemplates, Rego rules, and the upstream policy library so workloads meet label, security, registry, and resource requirements before creation.

Implements Open Policy Agent and Gatekeeper to codify Kubernetes and CI/CD policies, enabling admission control, constraint templates, and local testing via conftest for consistent security governance.