Skill UI

Guide for using Calico CNI and calicoctl to create and audit network and global network policies in Kubernetes, enforcing pod-to-pod/egress control, namespace isolation, and zero-trust microsegmentation with connectivity validation.

Provides guidance on installing Calico CNI and writing Kubernetes NetworkPolicy and Calico GlobalNetworkPolicy definitions to enforce default-deny, pod-to-pod, namespace, service-account, and host endpoint controls, enabling zero-trust communication and compliance-ready segmentation in clusters.

Walkthrough for implementing Kubernetes Pod Security Standards with PSA, covering namespace labeling, compliance-aware pod specs, enforcement modes, and a phased migration strategy for container security teams.

Enforces Kubernetes Pod Security Standards by using the built-in Pod Security Admission controller to label namespaces, set enforcement/audit/warn modes, and apply cluster defaults for baseline, restricted, and privileged profiles—ideal for compliance or hardened clusters.

Implement Kubernetes RBAC to enforce least-privilege access across namespaces, covering Role/ClusterRole design, binding configuration, service account hardening, OIDC integration, and audit logging for multi-tenant clusters.

Guides operators through hardening Kubernetes RBAC by auditing excessive cluster-admin bindings, preferring namespace-scoped roles, dedicating service accounts, restricting dangerous verbs, and integrating OIDC, so teams can safely enforce least-privilege controls and prepare for compliance reviews.

Analyzes Kubernetes pod configurations using the Python client to spot privileged containers, dangerous capabilities, host namespaces and mounts that could signal container escape attempts during audits or incident response.

Hardens managed Kubernetes clusters on EKS, AKS, and GKE through Pod Security Standards, namespace network policies, workload identity bindings, RBAC scoping, image admission controls, and runtime security monitoring for production compliance.