adaptive-enforcement-lab/gke-cluster-configuration
plugins/secure/skills/gke-cluster-configuration/SKILL.md
Private GKE cluster setup, Workload Identity, and Shielded Nodes with Binary Authorization using Terraform.
devops
Updated Mar 27, 2026
$ install --global
skillsauthnpx skillsauth add adaptive-enforcement-lab/claude-skills gke-cluster-configurationInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 29, 2026, 11:15 AM36.8s2 files scanned
SKILL.md
- name:
- gke-cluster-configuration
- description:
- >-
GKE Cluster Configuration
When to Use This Skill
This section covers the foundational security configurations for GKE clusters:
- Private GKE Cluster - Private control plane, VPC networking, and encrypted etcd
- Workload Identity - Pod-to-GCP authentication without service account keys
- Binary Authorization - Shielded Nodes and image verification
Public Cluster Risk
Public control planes expose your cluster API to the internet. Even with strong authentication, this increases attack surface and is not recommended for production.
Prerequisites
- GCP project with billing enabled
gcloudCLI installed and authenticated- Terraform 1.0+
- kubectl configured for cluster access
- Appropriate IAM permissions (Project Editor or Security Admin roles)
Production Warning
These configurations enforce strict security controls. Test in QAC/DEV before production deployment.
Implementation
Fundamental cluster security configuration covering private networking, identity federation, and image verification.
Overview
This section covers the foundational security configurations for GKE clusters:
- Private GKE Cluster - Private control plane, VPC networking, and encrypted etcd
- Workload Identity - Pod-to-GCP authentication without service account keys
- Binary Authorization - Shielded Nodes and image verification
Public Cluster Risk
Public control planes expose your cluster API to the internet. Even with strong authentication, this increases attack surface and is not recommended for production.
Security Principles
Defense in Depth
- Private Control Plane: API server accessible only from authorized networks
- Workload Identity: Pods authenticate to GCP without static credentials
- Shielded Nodes: Secure boot, measured boot, and integrity monitoring
- Binary Authorization: Only verified container images run on the cluster
Configuration Management
All configurations use Terraform for Infrastructure as Code, enabling:
- Repeatable deployments across environments
- Version-controlled security policies
- Automated compliance validation
- Drift detection and remediation
Prerequisites
- GCP project with billing enabled
gcloudCLI installed and authenticated- Terraform 1.0+
- kubectl configured for cluster access
- Appropriate IAM permissions (Project Editor or Security Admin roles)
Production Warning
These configurations enforce strict security controls. Test in QAC/DEV before production deployment.
Quick Start
See examples.md for detailed code examples.
Related Configuration
- Network Security - VPC-native networking, Network Policies, Private Service Connect
- IAM Configuration - Least-privilege IAM, audit logging, service accounts
- Runtime Security - Pod Security Standards, admission controllers, monitoring
Overview
This section covers the foundational security configurations for GKE clusters:
- Private GKE Cluster - Private control plane, VPC networking, and encrypted etcd
- Workload Identity - Pod-to-GCP authentication without service account keys
- Binary Authorization - Shielded Nodes and image verification
Public Cluster Risk
Public control planes expose your cluster API to the internet. Even with strong authentication, this increases attack surface and is not recommended for production.
Security Principles
Defense in Depth
- Private Control Plane: API server accessible only from authorized networks
- Workload Identity: Pods authenticate to GCP without static credentials
- Shielded Nodes: Secure boot, measured boot, and integrity monitoring
- Binary Authorization: Only verified container images run on the cluster
Configuration Management
All configurations use Terraform for Infrastructure as Code, enabling:
- Repeatable deployments across environments
- Version-controlled security policies
- Automated compliance validation
- Drift detection and remediation
Prerequisites
- GCP project with billing enabled
gcloudCLI installed and authenticated- Terraform 1.0+
- kubectl configured for cluster access
- Appropriate IAM permissions (Project Editor or Security Admin roles)
Production Warning
These configurations enforce strict security controls. Test in QAC/DEV before production deployment.
Quick Start
See examples.md for detailed code examples.
Related Configuration
- Network Security - VPC-native networking, Network Policies, Private Service Connect
- IAM Configuration - Least-privilege IAM, audit logging, service accounts
- Runtime Security - Pod Security Standards, admission controllers, monitoring
Key Principles
Defense in Depth
- Private Control Plane: API server accessible only from authorized networks
- Workload Identity: Pods authenticate to GCP without static credentials
- Shielded Nodes: Secure boot, measured boot, and integrity monitoring
- Binary Authorization: Only verified container images run on the cluster
Configuration Management
All configurations use Terraform for Infrastructure as Code, enabling:
- Repeatable deployments across environments
- Version-controlled security policies
- Automated compliance validation
- Drift detection and remediation
Related Patterns
- Network Security
- IAM Configuration
- Runtime Security
References
- Source Documentation
- AEL Secure
Related Skills
adaptive-enforcement-lab/workload-identity-federation-implementation
documentation
VerifiedTrustedCommunity
Workload Identity Federation implementation guide. GKE setup, IAM bindings, ServiceAccount configuration, migration from service account keys, and troubleshooting patterns.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/workflow-trigger-security
development
VerifiedTrustedCommunity
Secure GitHub Actions trigger patterns for pull requests, forks, and reusable workflows. Preventing privilege escalation and code injection through trigger misconfiguration.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/third-party-action-risk-assessment
development
VerifiedTrustedCommunity
Structured framework for evaluating GitHub Actions security before adoption. Trust tiers, risk assessment checklist, and decision tree for action evaluation.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/storing-credentials
testing
VerifiedTrustedCommunity
Securely store GitHub App credentials across different environments. GitHub Actions secrets, external CI, Kubernetes, and automated rotation patterns.
SKILL.mdUpdated Mar 27, 2026