Generate hardened Kubernetes manifests with Pod Security Standards, RBAC policies, network policies, and OPA constraints.
You are a Kubernetes security engineer. Generate hardened manifests for the following workload. ## Workload Details - **Application**: [APP e.g. web API / worker service / database / message queue] - **Image**: [IMAGE e.g. myapp:v1.2.3] - **Namespace**: [NAMESPACE e.g. production] - **Replicas**: [REPLICAS e.g. 3] - **Compliance**: [COMPLIANCE e.g. CIS Kubernetes Benchmark / NSA Hardening Guide / PCI-DSS] ## Security Manifests ### 1. Pod Security (`pod-security.yaml`) - SecurityContext: - runAsNonRoot: true, runAsUser: [UID e.g. 1000] - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: drop ALL, add only required - seccompProfile: RuntimeDefault - Resource limits: CPU and memory to prevent DoS - Liveness and readiness probes - Pod Disruption Budget - Pod Anti-Affinity for spread across nodes - Automount service account token: false (unless needed) ### 2. RBAC (`rbac.yaml`) - ServiceAccount with minimal permissions - Role with least-privilege verbs on specific resources - RoleBinding scoped to [NAMESPACE] - ClusterRole only if cross-namespace access required - Audit policy for RBAC events - No wildcard permissions ### 3. Network Policies (`network-policy.yaml`) - Default deny all ingress and egress for [NAMESPACE] - Allow ingress only from specific pods/namespaces - Allow egress only to required services (DNS, database, external APIs) - Label-based pod selection for policies - Namespace isolation ### 4. Secrets Management (`secrets.yaml`) - External Secrets Operator integration with [VAULT e.g. HashiCorp Vault / AWS Secrets Manager] - Encrypted at rest with KMS provider - Secret rotation policy - No secrets in environment variables (use volume mounts) ### 5. OPA/Gatekeeper Constraints (`constraints/`) - Require resource limits on all containers - Block privileged containers - Enforce approved image registries - Require labels (app, team, environment) - Block hostPath volumes - Require network policies in namespace - Block latest tag usage ### 6. Runtime Security (`runtime/`) - Falco rules for [APP] anomaly detection - Read-only filesystem exceptions list - Syscall filtering with seccomp profiles - AppArmor/SELinux profiles Generate all manifests with comments explaining each security control.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.
Describe your workload and compliance requirements. Apply manifests to a test cluster first. Run kube-bench to validate CIS compliance. Adjust resource limits based on actual usage patterns.
Initial release
Sign in and download this prompt to leave a review.