Network Policy Manager

This skill provides automated assistance for network policy manager tasks.

Overview

Creates Kubernetes NetworkPolicy manifests to enforce least-privilege ingress/egress between pods and namespaces, and helps validate connectivity after changes.

Prerequisites

Before using this skill, ensure:

• •Kubernetes cluster has network policy support enabled
• •Network plugin supports policies (Calico, Cilium, Weave)
• •Pod labels are properly defined for policy selectors
• •Understanding of application communication patterns
• •Namespace isolation strategy is defined

Instructions

1. •Identify Requirements: Determine which pods need to communicate
2. •Define Selectors: Use pod/namespace labels for policy targeting
3. •Configure Ingress: Specify allowed incoming traffic sources and ports
4. •Configure Egress: Define allowed outgoing traffic destinations
5. •Test Policies: Verify connectivity works as expected
6. •Monitor Denials: Check for blocked traffic in network plugin logs
7. •Iterate: Refine policies based on application behavior

Output

Network Policy Examples:

# {baseDir}/network-policies/allow-frontend-to-backend.yaml


## Overview

This skill provides automated assistance for the described functionality.

## Examples

Example usage patterns will be demonstrated in context.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
      - podSelector:
          matchLabels:
            app: frontend
      ports:
      - protocol: TCP
        port: 8080
---
# Deny all ingress by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress

Egress Policy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-external-api
spec:
  podSelector:
    matchLabels:
      app: api-client
  policyTypes:
    - Egress
  egress:
    - to:
      - namespaceSelector:
          matchLabels:
            name: external-services
      ports:
      - protocol: TCP
        port: 443

Error Handling

Policy Not Applied

• •Error: Traffic still blocked/allowed contrary to policy
• •Solution: Verify network plugin supports policies and policy is applied to correct namespace

DNS Resolution Fails

• •Error: Pods cannot resolve DNS after applying policy
• •Solution: Add egress rule allowing DNS traffic to kube-dns/coredns

No Communication After Policy

• •Error: All traffic blocked unexpectedly
• •Solution: Check for default-deny policies and ensure explicit allow rules exist

Label Mismatch

• •Error: Policy not targeting intended pods
• •Solution: Verify pod labels match policy selectors using kubectl get pods --show-labels

Examples

• •"Restrict namespace prod so only the ingress controller can reach the web pods on 443."
• •"Create egress rules that allow the API to talk only to Postgres and Redis."

Resources

• •Kubernetes NetworkPolicy: https://kubernetes.io/docs/concepts/services-networking/network-policies/
• •Calico documentation: https://docs.projectcalico.org/
• •Example policies in {baseDir}/network-policy-examples/