adaptive-enforcement-lab/gke-security-hardening-guide
plugins/secure/skills/gke-security-hardening-guide/SKILL.md
GKE security hardening guide with Pulumi. Private clusters, Workload Identity, Binary Authorization, network policies, IAM configuration, and runtime security enforcement.
testing
Updated Mar 27, 2026
$ install --global
skillsauthnpx skillsauth add adaptive-enforcement-lab/claude-skills gke-security-hardening-guideInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 29, 2026, 11:16 AM36.8s10 files scanned
SKILL.md
- name:
- gke-security-hardening-guide
- description:
- >-
GKE Security Hardening Guide
When to Use This Skill
Defense in Depth
GKE security hardening follows a layered approach:
- Control plane - Private clusters, authenticated access, audit logging
- Network - VPC-native networking, network policies, egress controls
- Identity - Workload Identity Federation, least-privilege IAM, audit trails
- Runtime - Pod Security Standards, admission controllers, monitoring
This guide uses Pulumi for Infrastructure as Code, enabling repeatable, auditable cluster deployments across environments (QAC, DEV, STG, PRD).
Environment Promotion Order
Always promote changes through: QAC → DEV → STG → PRD → OPS
Never skip environments in the promotion pipeline.
Prerequisites
- GCP project with billing enabled
gcloudCLI installed and authenticated- Pulumi 3.0+
- kubectl configured for cluster access
- Appropriate IAM permissions (Project Editor or Security Admin roles)
Production Warning
These configurations enforce strict security controls. Test in QAC/DEV before production deployment.
Implementation
See examples.md for detailed code examples.
Verification
After deployment, verify the security posture using the verification checklists in each configuration module.
Anti-Patterns to Avoid
| Misconfiguration | Risk | Fix |
|------------------|------|-----|
| Public cluster endpoint | Exposed API server | Set privateClusterConfig.enablePrivateNodes = true |
| Metadata server enabled | Pod can access node credentials | Set workloadMetadataConfig.mode = "GKE_METADATA" |
| No network policies | All-to-all traffic | Apply default-deny + explicit policies |
| Privileged containers | Root container escape | Set securityContext.privileged = false |
| No admission controllers | Insecure pods deployed | Deploy validating/mutating webhooks |
| No audit logging | Compliance blind spot | Enable GKE Cloud Logging sink |
| Overpermissioned service accounts | Lateral movement | Use Workload Identity + least-privilege IAM |
| Public container registry | Image tampering | Use private Artifact Registry + Binary Auth |
Attack Surface Reduction
Each misconfiguration listed above represents a verified attack vector. Fix all items before production deployment.
Examples
See examples.md for code examples.
Full Reference
See reference.md for complete documentation.
Related Patterns
- Enforce
- Secure
- Patterns
References
- Source Documentation
- AEL Secure
Related Skills
adaptive-enforcement-lab/workload-identity-federation-implementation
documentation
VerifiedTrustedCommunity
Workload Identity Federation implementation guide. GKE setup, IAM bindings, ServiceAccount configuration, migration from service account keys, and troubleshooting patterns.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/workflow-trigger-security
development
VerifiedTrustedCommunity
Secure GitHub Actions trigger patterns for pull requests, forks, and reusable workflows. Preventing privilege escalation and code injection through trigger misconfiguration.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/third-party-action-risk-assessment
development
VerifiedTrustedCommunity
Structured framework for evaluating GitHub Actions security before adoption. Trust tiers, risk assessment checklist, and decision tree for action evaluation.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/storing-credentials
testing
VerifiedTrustedCommunity
Securely store GitHub App credentials across different environments. GitHub Actions secrets, external CI, Kubernetes, and automated rotation patterns.
SKILL.mdUpdated Mar 27, 2026