How do I install the Cis Oke V170 5.1.3 skill?

Run npx skillmds@latest add cyberstrikeus/cis-oke-v170-5-1-3 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Oke V170 5.1.3 skill do?

Minimize cluster access to read-only (Manual) It is listed under DevOps & Infra on SkillMD.

Is Cis Oke V170 5.1.3 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Oke V170 5.1.3?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Oke V170 5.1.3 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Oke V170 5.1.3?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Oke V170 5.1.3 by cyberstrikeus

Name: Cis Oke V170 5.1.3
Author: cyberstrikeus

File contents

CIS OKE Benchmark v1.7.0 - Control 5.1.3

Profile Applicability

Level: 1

Description

Configure the Cluster Service Account to only allow read-only access to OKE.

Rationale

The Cluster Service Account does not require administrative access to OCR, only requiring pull access to containers to deploy onto OKE. Restricting permissions follows the principles of least privilege and prevents credentials from being abused beyond the required role.

Impact

A separate dedicated service account may be required for use by build servers and other robot users pushing or managing container images.

Audit Procedure

Review Oracle OCS worker node IAM role IAM Policy Permissions to verify that they are set and the minimum required level.

If utilizing a 3rd party tool to scan images utilize the minimum required permission level required to interact with the cluster - generally this should be read-only.

Remediation

To access a cluster using kubectl, you have to set up a Kubernetes configuration file (commonly known as a 'kubeconfig' file) for the cluster. The kubeconfig file (by default named config and stored in the $HOME/.kube directory) provides the necessary details to access the cluster. Having set up the kubeconfig file, you can start using kubectl to manage the cluster.

The steps to follow when setting up the kubeconfig file depend on how you want to access the cluster:

To access the cluster using kubectl in Cloud Shell, run an Oracle Cloud Infrastructure CLI command in the Cloud Shell window to set up the kubeconfig file.
To access the cluster using a local installation of kubectl:
1. Generate an API signing key pair (if you don't already have one).
2. Upload the public key of the API signing key pair.
3. Install and configure the Oracle Cloud Infrastructure CLI.
4. Set up the kubeconfig file.

See Setting Up Local Access to Clusters

Default Value

The default permissions for the cluster Service account is dependent on the initial configuration and IAM policy.

References

https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengdownloadkubeconfigfile.htm

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts	*	*	*
v7	14 Controlled Access Based on the Need to Know

MITRE ATT&CK Mappings

Techniques / Sub-techniques	Tactics	Mitigations
T1552	TA0006	M1026

Profile

Level 1 (Manual)

---name: cis-oke-v170-5-1-3description: Minimize cluster access to read-only (Manual)---# CIS OKE Benchmark v1.7.0 - Control 5.1.3## Profile Applicability- **Level:** 1## DescriptionConfigure the Cluster Service Account to only allow read-only access to OKE.## RationaleThe Cluster Service Account does not require administrative access to OCR, only requiring pull access to containers to deploy onto OKE. Restricting permissions follows the principles of least privilege and prevents credentials from being abused beyond the required role.## ImpactA separate dedicated service account may be required for use by build servers and other robot users pushing or managing container images.## Audit ProcedureReview Oracle OCS worker node IAM role IAM Policy Permissions to verify that they are set and the minimum required level.If utilizing a 3rd party tool to scan images utilize the minimum required permission level required to interact with the cluster - generally this should be read-only.## RemediationTo access a cluster using kubectl, you have to set up a Kubernetes configuration file (commonly known as a 'kubeconfig' file) for the cluster. The kubeconfig file (by default named config and stored in the $HOME/.kube directory) provides the necessary details to access the cluster. Having set up the kubeconfig file, you can start using kubectl to manage the cluster.The steps to follow when setting up the kubeconfig file depend on how you want to access the cluster:- To access the cluster using kubectl in Cloud Shell, run an Oracle Cloud Infrastructure CLI command in the Cloud Shell window to set up the kubeconfig file.- To access the cluster using a local installation of kubectl: 1. Generate an API signing key pair (if you don't already have one). 2. Upload the public key of the API signing key pair. 3. Install and configure the Oracle Cloud Infrastructure CLI. 4. Set up the kubeconfig file.See [Setting Up Local Access to Clusters](https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengdownloadkubeconfigfile.htm)## Default ValueThe default permissions for the cluster Service account is dependent on the initial configuration and IAM policy.## References1. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengdownloadkubeconfigfile.htm## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ------------------------------------------------------------------------- | ---- | ---- | ---- || v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | \* | \* | \* || v7 | 14 Controlled Access Based on the Need to Know | | | |## MITRE ATT&CK Mappings| Techniques / Sub-techniques | Tactics | Mitigations || --------------------------- | ------- | ----------- || T1552 | TA0006 | M1026 |## Profile**Level 1** (Manual)

Frequently asked questions

Cis Oke V170 5.1.3