skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-container-network-policies-with-calico

Implement and audit Calico network policies for Kubernetes pod traffic segmentation.

954|172|Updated Mar 13, 2026
Search Tags:#kubernetes#container security#network policy#Zero Trust#calico#cni#microsegmentation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-container-network-policies-with-calico
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-container-network-policies-with-calico
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/implementing-container-network-policies-with-calico
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-container-network-policies-with-calico

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires kubernetes.

What problem does it solve?

Kubernetes clusters default to allow-all networking, leaving pod-to-pod traffic unrestricted and exposing workloads to lateral movement, SSRF against cloud metadata endpoints, and unintended egress. This Skill guides the creation and auditing of Calico NetworkPolicy and GlobalNetworkPolicy resources to enforce zero-trust microsegmentation.

Core Features & Use Cases

  • Policy Auditing: Inventory existing network policies with calicoctl and kubectl to identify unprotected namespaces.
  • Default-Deny Baselines: Create deny-all ingress and egress policies per namespace or cluster-wide as a zero-trust foundation.
  • Granular Allow Rules: Define workload-specific rules for legitimate pod-to-pod and pod-to-service communication, including DNS egress handling.
  • Enforcement Validation: Test connectivity between pods to confirm policies are actually enforced by the Calico dataplane.
  • Use Case: A platform engineer securing a multi-tenant cluster applies default-deny policies per namespace, allows only required service-to-service flows, blocks egress to 169.254.169.254, and verifies enforcement with connectivity tests.

Quick Start

Audit my Kubernetes cluster's Calico network policies and generate default-deny baselines for all unprotected namespaces.

Frequently Asked Questions about implementing-container-network-policies-with-calico

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement default-deny network policies in Kubernetes with Calico?▼

Create a NetworkPolicy per namespace that denies all ingress and egress, or a cluster-wide GlobalNetworkPolicy with a high order value. Then layer workload-specific allow rules on top, since Kubernetes defaults to allow-all without a deny baseline.

How to audit existing Calico network policies in a cluster?▼

Use calicoctl and kubectl to inventory all NetworkPolicy and GlobalNetworkPolicy resources and identify namespaces without any policy coverage. The audit produces a JSON report listing policies, unprotected namespaces, and rule counts.

Why is my Calico network policy not being enforced?▼

Common causes include Calico not being the active CNI, a non-enforcing dataplane, or inverted policy order where a permissive rule with a lower order number shadows a deny rule. Verify with calicoctl node status and calicoctl get globalnetworkpolicy -o wide.

Does Calico network policy block access to cloud metadata endpoints?▼

Only if you explicitly exclude 169.254.169.254/32 from egress allow rules. An unrestricted egress policy leaves the cloud metadata endpoint reachable, enabling SSRF and credential theft from compromised pods.

Why does DNS resolution break after applying egress deny policies?▼

A default-deny egress policy blocks UDP and TCP port 53, breaking name resolution for all pods. Add an explicit egress allow rule for DNS before applying the deny, or admins may remove the deny entirely to restore service.

Related Skills

Explore More Software Engineering Skills→
kubespherekubesphere
17.0k

kubesphere-network-extension-operations

Install, configure, and troubleshoot the KubeSphere network extension, Calico IPPools, and NetworkPolicy resources.

Official
Advanced
littlebearappslittlebearapps

zero-trust

Audits and remediates Cloudflare Zero Trust gaps in deployments.

Official
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

runtime-security

Enforce runtime security policies and monitor anomalous behavior in GKE clusters.

Official
Advanced
ConnectiveTCSConnectiveTCS

cilium-expert

Deploy Cilium eBPF networking with identity-based policies and Hubble observability.

Community
Advanced