Gke Workload Security
by google55b4e13eba6dNo license21K starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today
Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture, isolating namespaces, applying pod security standards, or configuring network policies and secret volume mounts. Don't use for Workload Identity (use gke-workload-identity), cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).
- 55b4e13eba6dCurrentcommit 55b4e13Published Oct 8, 2026
Source and attribution
Source:google/skillsinskills/cloud/gke-workload-securityat commit55b4e13
License: No license
Content belongs to its original authors. SourceWeft indexes it from a public repository.
More from google/skills
Dpop Adoption
Guides implementation of OAuth 2.0 DPoP (RFC 9449) sender-constrained refresh tokens for Google's OAuth platform.
Finding Google Skills
Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.
Spanner Basics
Guides Google Cloud Spanner administration, schema design, querying and performance diagnosis.
Secops Triage
Guides SOC analysts through triaging Google SecOps security alerts, from investigation to closure or escalation.
Secops Investigate
Guides SOC analysts through deep security incident and entity investigations in Google SecOps using UDM queries and timelines.
Secops Hunt
Guides proactive threat hunting in Google SecOps using UDM queries, IoC lookback, prevalence and outlier analysis.
More in Security
Secops Cases
Manages Google Security Operations SOAR cases across their lifecycle via MCP tools.
Iam Helper For Privileged Access Management
Guides Google Cloud Privileged Access Manager entitlement CRUD, temporary access requests, and grant approval workflows.
Iam Helper For Policy Management
Guides creation, modification, listing and deletion of Google Cloud IAM allow (v1) and deny (v2) policies.
Gke Workload Identity
Diagnoses GKE Workload Identity Federation authentication failures for Pods and proposes fixes for a human to apply.
Gke Productionize
Orchestrates GKE production readiness reviews across scalability, security, reliability, observability, backup and cost.
Gke Platform Security
Hardens platform-level Google Kubernetes Engine cluster security, covering RBAC, Secret Manager, Shielded Nodes, Sandbox and IAM.