domains / families / security / gke-workload-security

gke-workload-security

separate

Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture, isolating namespaces, applying pod security standards, or configuring network policies and secret volume mounts. Don't use for Workload Identity (use gke-workload-identity), cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).

When to use

• auditing workload security posture
• isolating namespaces
• applying pod security standards
• configuring network policies
• configuring secret volume mounts
• enforcing default-deny Network Policies
• isolating high-risk pods inside GKE Sandbox
• enforcing Pod Security Standards restricted labeling

When not to use

• Workload Identity
• cluster-wide control plane security
• RBAC hardening
• Binary Authorization
• Shielded Nodes
• enabling platform-level GKE add-ons

Skill page

Source