Skill UI

Guide for enforcing Kubernetes security policies covering NetworkPolicy, Pod Security Standards, RBAC, Gatekeeper constraints, and service mesh controls to protect clusters, segment networks, and harden workloads before production rollouts.

Detects and prevents privilege escalation for Kubernetes pods by combining admission policies (Pod Security Admission, OPA Gatekeeper) and runtime monitoring (Falco) to watch security contexts, capabilities, syscalls, and audit logs for privileged containers, host namespace access, or dangerous capabilities.

Use OPA Gatekeeper to enforce Kubernetes admission policies through ConstraintTemplates, Rego rules, and the upstream policy library so workloads meet label, security, registry, and resource requirements before creation.

Implements Open Policy Agent and Gatekeeper to codify Kubernetes and CI/CD policies, enabling admission control, constraint templates, and local testing via conftest for consistent security governance.