sota-kuberneteslisted
State-of-the-art Kubernetes platform security and operations (2026) for cloud-managed (EKS/GKE/AKS) and self-hosted clusters (kubeadm, k3s/k0s, Talos). Use when building, operating, hardening, or auditing the cluster PLATFORM layer: control plane and etcd, API server/kubelet, RBAC, admission control and policy-as-code, GitOps controllers, operators/CRDs/admission webhooks, Helm/Kustomize supply chain, multi-tenancy, cluster lifecycle/upgrades/CVE response, and audit logging. Trigger keywords: Kubernetes, k8s, cluster, control plane, etcd, kube-apiserver, kubelet, RBAC, ClusterRole, ServiceAccount, admission controller, Pod Security Admission, PSA, Kyverno, Gatekeeper, OPA, ValidatingAdmissionPolicy, Argo CD, Flux, GitOps, operator, CRD, admission webhook, Helm, Kustomize, multi-tenancy, vCluster, Talos, k3s, k0s, kubeadm, EKS, GKE, AKS, CIS benchmark, kube-bench, audit log, version skew. NOT pod-level securityContext/seccomp (sota-sandboxing) or NetworkPolicy/CNI depth (sota-network-security).
martinholovsky/SOTA-skills · ★ 8 · DevOps & Infrastructure · score 75
Install: claude install-skill martinholovsky/SOTA-skills
# SOTA Kubernetes Platform Security & Operations
## Purpose
Engineer and audit the Kubernetes **platform** so that a compromised workload, a
hostile chart, a leaked token, or a malicious controller cannot pivot to cluster-admin,
read every Secret, or take the cluster down. This skill owns the layer above the pod:
control plane and etcd, API server and kubelet hardening, RBAC and ServiceAccount
identity, admission control and policy-as-code, GitOps controllers, operators/CRDs and
admission webhooks, Helm/Kustomize at admission, multi-tenancy boundaries, cluster
lifecycle, and K8s audit logging.
It does **not** re-teach pod isolation mechanics. Boundaries it defers:
- **Pod `securityContext`, seccomp, AppArmor, capabilities, PSA pod-level fields** → `sota-sandboxing` (rules/03 containers & microVMs; rules/01 boundaries). This skill owns the *admission-time enforcement* of those fields, not their internals.
- **NetworkPolicy semantics, CNI choice, service mesh, mTLS** → `sota-network-security`. This skill states only the *requirement* (default-deny per namespace, enforced at admission).
- **OIDC/SSO and RBAC-role *design* methodology** → `sota-identity-access`. This skill owns the K8s RBAC *mechanics and escalation traps*.
- **Runtime/audit-log detection content (Falco/Tetragon rules, detections)** → `sota-detection-engineering`. This skill owns *producing and shipping* the audit stream.
- **Workload identity, Secret storage backends (ESO, sealed-secrets, CSI)** → `sota-secre