Build Your Cloud Security Skill

In January 2024, a major cryptocurrency exchange lost $230 million because an attacker exploited misconfigured Kubernetes RBAC—a service account with cluster-admin privileges was exposed through a debugging pod left running in production. The attacker didn't break encryption or exploit zero-days. They walked through a door that should have been locked.

Your Task API is running in Kubernetes. Before learning how to protect it—configuring RBAC, isolating network traffic, enforcing Pod Security Standards—you will own a cloud-security skill that generates secure configurations from day one.

This skill becomes a component of your sellable Digital FTE portfolio. By the end of this chapter, you will have a production-tested skill that implements defense-in-depth security for any Kubernetes workload.

---

Step 1: Get the Skills Lab

1. Go to github.com/fistasolutions/claude-code-skills-lab
2. Click the green Code button
3. Select Download ZIP
4. Extract the ZIP file
5. Open the extracted folder in your terminal

Output:

---

Step 2: Write Your LEARNING-SPEC.md

Before asking Claude to build your skill, define what you want to learn. Create a file named LEARNING-SPEC.md:

Output:

This specification tells Claude exactly what you need and how you will measure success.

---

Step 3: Fetch Official Documentation

Ask Claude to gather the authoritative source material:

Claude will retrieve documentation from the official Kubernetes project, giving your skill accurate, up-to-date patterns rather than hallucinated configurations.

Output:

---

Step 4: Create Your Skill

Now prompt Claude to build the skill using the fetched documentation:

Claude will:

1. Study the fetched documentation
2. Ask clarifying questions about your security requirements
3. Create the skill with security templates and best practices

Output:

Your skill appears at .claude/skills/cloud-security/.

---

Step 5: Test Your Skill

Verify your new skill generates valid Kubernetes YAML:

Output:

Save the output and validate:

Output:

If dry-run succeeds, your skill generates valid RBAC configurations following least privilege principles. Notice that the Role specifies only configmaps with get and list verbs—no wildcards, no cluster-wide access.

---

Done

You now own a cloud-security skill built from official Kubernetes security documentation. The rest of this chapter teaches you what it knows—and how to make it better.

Next Lesson: The 4C Security Model

---

Try With AI

Now that you have a working skill, test its gap identification capabilities.

Prompt 1:

What you're learning: How your skill generates RBAC patterns following least privilege. Notice whether it avoids wildcards (*) in verbs and resources, and whether it suggests automountServiceAccountToken: false by default.

Prompt 2:

What you're learning: Gap identification is a critical meta-skill. Your skill might be missing NetworkPolicy defaults, PSS enforcement labels, Trivy scanning integration, or Dapr component scopes. Each gap becomes a learning target for this chapter's lessons.

Security Reminder

Never test security configurations on production clusters. Always use --dry-run=client first, then apply to a development namespace. Security misconfigurations can expose your entire cluster.