Skip to content
Get packs

GKE Platform Security Hardening

Plans and applies platform-level security settings for Google Kubernetes Engine clusters

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
2 files

What it does

When installed, the agent follows Google's recommended security defaults for Google Kubernetes Engine (GKE) cluster-level configuration. It can check whether settings like Secret Manager integration, insecure RBAC bindings, Shielded Nodes, Binary Authorization and GKE Sandbox are enabled, and it can suggest or run the gcloud commands to change them. Workload-level controls are handled by other skills it points to.

Great for

  • Platform or DevOps engineers who manage GKE clusters and want a consistent security baseline
  • Teams auditing whether an existing cluster disables legacy system:authenticated RBAC bindings
  • Engineers preparing a new cluster to meet a 'golden path' of security defaults

Skip it if

  • Workload-level setup such as Workload Identity, SecretProviderClass, Pod Security Standards or Network Policies, which belong to other skills named in the file
  • Anyone who runs the commands against production clusters without reviewing them first, since the skill can change live cluster settings and some changes need cluster updates

Try asking

  • “Check whether Secret Manager and rotation are enabled on my GKE cluster in us-central1”
  • “Audit my cluster's RBAC for insecure system:authenticated bindings and suggest fixes”
  • “Show me the gcloud commands to enable Shielded Nodes and GKE Sandbox on an existing cluster”
  • “Review which predefined IAM roles my platform team should use for GKE cluster management”
Step-by-step guide: how to use GKE Platform Security HardeningInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the Apache-2.0 licence and an attribution note.

    gke-platform-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip gke-platform-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip gke-platform-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the describe/verify commands first and review output before running any update command, especially on production clusters.
  • Use a non-production cluster to test changes like enabling Binary Authorization or GKE Sandbox, which can affect running workloads.
  • Pair this skill with gke-workload-security and gke-workload-identity for complete coverage, since this one covers only cluster-level settings.

What's inside

  • references/attribution.md
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.