Skill UI

This guide details how to use Google Distroless images to drastically reduce the attack surface of containerized applications. By eliminating shells, package managers, and unnecessary OS utilities, these minimal base images enhance security, align with compliance standards, and improve supply chain security in Kubernetes and Docker deployments. It provides multi-stage build patterns for various languages (Go, Java, Python, Node.js).

This skill provides comprehensive guidance on implementing robust network security controls in Kubernetes using Calico's CNI capabilities. Learn to define and audit NetworkPolicy and GlobalNetworkPolicy resources to achieve zero-trust microsegmentation, restrict egress traffic, and control all pod-to-pod communications, ensuring compliance and enhanced security posture.

This guide details implementing robust container image provenance verification using Cosign, a Sigstore tool. It covers key-based and keyless (OIDC) signing methods, enabling secure supply chain practices. Users can sign images, attach critical attestations (such as SBOMs and vulnerability scans), and enforce verification in CI/CD pipelines and Kubernetes environments to ensure high integrity and trust.

This skill guides the implementation of automated security scanning for Infrastructure as Code (IaC) templates using industry-leading tools like Checkov and tfsec. It focuses on integrating security checks into CI/CD pipelines to detect misconfigurations (e.g., public buckets, open ports) in Terraform, CloudFormation, and Kubernetes manifests before they reach production, thereby enforcing policy-based governance and securing the development lifecycle.

This guide provides a comprehensive deep dive into implementing advanced network segmentation and zero-trust security controls within Kubernetes clusters using Calico. It covers standard Kubernetes NetworkPolicy, utilizing Calico's GlobalNetworkPolicy, and defining security Tiers, ensuring fine-grained, least-privilege communication between pods, and establishing robust security architectures for compliance.

This guide details how to implement Kubernetes Pod Security Standards (PSS) using the Pod Security Admission (PSA) controller. PSS defines three mandatory security levels—Privileged, Baseline, and Restricted—for container workloads. It is essential for enhancing security posture, ensuring compliance, and migrating away from deprecated PodSecurityPolicy (PSP) controls by applying namespace labels and defining compliant pod specifications.

This guide details the implementation of microsegmentation using Akamai Guardicore, enabling organizations to map complex application dependencies, visualize east-west traffic flows, and enforce least-privilege network policies. It is crucial for achieving zero-trust compliance by preventing lateral movement across heterogeneous workloads in data centers, cloud environments, and Kubernetes clusters.

This guide details how to use Kubernetes NetworkPolicies to enforce granular, pod-level network segmentation. It covers establishing default deny rules, defining specific ingress and egress rules for services, and implementing zero-trust microsegmentation. Use this skill to build robust security architecture and prevent lateral movement within a container cluster.

OPA Gatekeeper is a powerful Kubernetes admission controller that enforces policies using Rego rules. It utilizes ConstraintTemplates and Constraints to validate, mutate, or deny API requests at the cluster admission stage. This tool is essential for implementing policy-as-code practices, ensuring that Kubernetes deployments adhere to organizational security standards, compliance requirements, and best practices, such as mandating labels or blocking privileged containers.

Pod Security Admission (PSA) is a built-in Kubernetes admission controller designed to enforce Pod Security Standards (Baseline, Restricted, Privileged) at the namespace level. It serves as a crucial replacement for the deprecated PodSecurityPolicy (PSP), allowing users to implement robust security controls and maintain compliance. By applying specific labels, administrators can set enforcement modes (enforce, audit, warn) to harden container environments against unauthorized privilege escalation and security risks.

This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for robust policy-as-code enforcement. Learn to write complex Rego policies, deploy OPA Gatekeeper as a Kubernetes admission controller, and integrate policy evaluation into CI/CD pipelines to enforce security and compliance across clusters.

Implement Kubernetes RBAC to enforce least-privilege access across namespaces, covering Role/ClusterRole design, binding configuration, service account hardening, OIDC integration, and audit logging for multi-tenant clusters.