/gke-workload-security
稽核、設定並強化 GKE 應用程式與命名空間的工作負載層級安全控制，涵蓋執行安全稽核、強制 Network Policy 與在 GKE Sandbox 隔離高風險 pod。
- 安裝次數
- 5400
- 專案星數
- 2.2 萬 ★
- 授權
- Apache-2.0
- 專案更新
- 2026-11-02
怎麼裝
npx skills add https://github.com/google/skills --skill gke-workload-security安裝前請先看過原文內容。中文說明是 AI 翻譯，不保證安全。
原文
Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture, isolating namespaces, applying pod security standards, or configuring network policies and secret volume mounts. Don't use for Workload Identity (use gke-workload-identity), cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).