skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-kubernetes-network-policy-with-calico

Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy resources.

954|172|Updated Mar 13, 2026
Search Tags:#kubernetes#container security#network policy#zero-trust#calico#network segmentation#cni
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-kubernetes-network-policy-with-calico
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-kubernetes-network-policy-with-calico
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/implementing-kubernetes-network-policy-with-calico
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-kubernetes-network-policy-with-calico

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Kubernetes clusters default to allow-all pod networking, leaving workloads exposed to lateral movement and unauthorized pod-to-pod traffic. This Skill guides the implementation of zero-trust network segmentation with Calico, covering default-deny baselines, granular allow rules, and cluster-wide policies.

Core Features & Use Cases

  • Default-Deny Baselines: Apply deny-all ingress and egress NetworkPolicies per namespace, then layer explicit allow rules for pod-to-pod and DNS traffic.
  • Calico Extensions: Use GlobalNetworkPolicy, deny rules, policy ordering, tiers, and service-account selectors that go beyond the standard Kubernetes NetworkPolicy API.
  • Verification & Troubleshooting: Validate enforcement with calicoctl, connectivity tests, and flow logs to catch shadowed rules and non-enforcing dataplanes.
  • Use Case: A platform engineer isolates a production namespace so only frontend pods can reach backend services on port 8080, while DNS egress remains functional and all other traffic is denied.

Quick Start

Ask the AI to generate a default-deny Calico network policy set for a production namespace that allows frontend pods to reach backend pods on TCP 8080 and permits DNS egress.

Frequently Asked Questions about implementing-kubernetes-network-policy-with-calico

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a default deny network policy in Kubernetes?▼

Create a NetworkPolicy with an empty podSelector and policyTypes set to Ingress and Egress in each namespace. Kubernetes NetworkPolicy is additive and default-allow, so without this deny-all baseline your allow rules do not restrict anything.

How to allow pod-to-pod traffic with Calico NetworkPolicy?▼

Define a NetworkPolicy selecting the destination pods and an ingress rule with a podSelector matching the source pods, plus allowed ports. For example, allow pods labeled app=frontend to reach app=backend on TCP 8080.

What is the difference between NetworkPolicy and GlobalNetworkPolicy in Calico?▼

NetworkPolicy is namespaced and applies to pods within one namespace, while GlobalNetworkPolicy is cluster-wide and can select endpoints across namespaces and host endpoints. Calico also adds deny actions, rule ordering, and tiers.

Why does egress policy break DNS in Kubernetes?▼

An egress deny without a DNS allow rule blocks UDP and TCP port 53, breaking service discovery. Always add an egress rule permitting port 53 to kube-dns before applying any egress deny policy.

How do I verify Calico network policies are enforced?▼

Check Calico node health with calicoctl node status, list policies with calicoctl get networkpolicy -A -o wide, and test connectivity with kubectl exec between pods. Allowed flows should succeed and denied flows should time out.

Can Calico network policies select pods by service account?▼

Yes, Calico NetworkPolicy supports serviceAccounts selectors in source and destination rules. This lets you allow traffic based on workload identity, such as permitting only frontend-sa and monitoring-sa to reach an API service.

Related Skills

Explore More Software Engineering Skills→
kettleofketchupkettleofketchup

calico

Deploy, configure, and troubleshoot Calico for Kubernetes cluster networking.

Community
Advanced
luiscamaralluiscamaral
1

security-audit

Audit Kubernetes RBAC, network policies, and pod security with kubectl and jq.

Community
Advanced
haryelramalhoharyelramalho

k8s-security-policies

Generate Kubernetes security policies for network segmentation, pod security, and RBAC.

Community
Advanced
martinholovskymartinholovsky
45

cilium-expert

Configure Cilium CNI, network policies, and Hubble observability for Kubernetes.

Community
Advanced