Gke Workload Security
by google55b4e13eba6dNo license21K starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today
Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture, isolating namespaces, applying pod security standards, or configuring network policies and secret volume mounts. Don't use for Workload Identity (use gke-workload-identity), cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).
Add to a SourceWeft workspace
- Open the skill in your dashboard and add it to a workspace.
- Enable it for the chats that should use it.
This skill includes scripts. They run in your workspace sandbox when the skill is used — review the file list and source before adding it.
Add to SourceWeftYou will be asked to sign in first, then taken straight to this skill.
Ask your agent to install it
Paste this prompt into Claude Code, Codex, Cursor or another agent that can run commands — or into SourceWeft chat. The agent reads this skill's install guide, shows you its source, license and scripts, and installs it with the SourceWeft CLI once you agree.
Read https://sourceweft.com/skills/gh-google-skills-gke-workload-security/install.md and install the skill it describes. Before installing, show me its source, license and whether it ships scripts, and wait for my OK. Ask me before changing anything else on my machine.Install it yourself from a terminal
For Claude Code, Codex, Cursor and other local agents. The SourceWeft CLI fetches the skill from its source repository at the commit scanned here, and verifies every file against the hashes recorded when the skill was scanned. If anything differs, nothing is written.
npx @sourceweft/cli skills install gh-google-skills-gke-workload-securityAdd --agent claude-code, codex, cursor or universal to choose which agent gets it (Claude Code by default).
Installed locally, this skill's scripts run on your machine, not in a sandbox. Read them first — the CLI asks before installing.
Upstream installer — not verified by SourceWeft
The open-source skills installer fetches the same pinned commit, but does not check the files against the hashes SourceWeft recorded.
npx skills add https://github.com/google/skills/tree/55b4e13eba6d86dec14bddd0a4cd25e63055f786/skills/cloud/gke-workload-securitySource and attribution
Source:google/skillsinskills/cloud/gke-workload-securityat commit55b4e13
License: No license
Content belongs to its original authors. SourceWeft indexes it from a public repository.
More from google/skills
Dpop Adoption
Guides implementation of OAuth 2.0 DPoP (RFC 9449) sender-constrained refresh tokens for Google's OAuth platform.
Finding Google Skills
Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.
Spanner Basics
Guides Google Cloud Spanner administration, schema design, querying and performance diagnosis.
Secops Triage
Guides SOC analysts through triaging Google SecOps security alerts, from investigation to closure or escalation.
Secops Investigate
Guides SOC analysts through deep security incident and entity investigations in Google SecOps using UDM queries and timelines.
Secops Hunt
Guides proactive threat hunting in Google SecOps using UDM queries, IoC lookback, prevalence and outlier analysis.
More in Security
Secops Cases
Manages Google Security Operations SOAR cases across their lifecycle via MCP tools.
Iam Helper For Privileged Access Management
Guides Google Cloud Privileged Access Manager entitlement CRUD, temporary access requests, and grant approval workflows.
Iam Helper For Policy Management
Guides creation, modification, listing and deletion of Google Cloud IAM allow (v1) and deny (v2) policies.
Gke Workload Identity
Diagnoses GKE Workload Identity Federation authentication failures for Pods and proposes fixes for a human to apply.
Gke Productionize
Orchestrates GKE production readiness reviews across scalability, security, reliability, observability, backup and cost.
Gke Platform Security
Hardens platform-level Google Kubernetes Engine cluster security, covering RBAC, Secret Manager, Shielded Nodes, Sandbox and IAM.