skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-network-policies-for-kubernetes

Implement Kubernetes NetworkPolicies for pod-level ingress and egress traffic segmentation.

954|172|Updated Mar 13, 2026
Search Tags:#kubernetes#container security#network policy#kubectl#Zero Trust#microsegmentation#egress control
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-network-policies-for-kubernetes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-network-policies-for-kubernetes
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/implementing-network-policies-for-kubernetes
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-network-policies-for-kubernetes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Kubernetes clusters default to allow-all pod networking, leaving workloads exposed to lateral movement and SSRF attacks against cloud metadata endpoints. This Skill provides a step-by-step workflow for enforcing zero-trust microsegmentation with NetworkPolicies.

Core Features & Use Cases

  • Default-Deny Baseline: Apply namespace-wide deny-all ingress and egress policies, then layer explicit allow rules for DNS, application tiers, and monitoring.
  • Tiered Traffic Rules: Configure pod-to-pod, cross-namespace, and external ipBlock rules so frontends reach backends and backends reach databases only on required ports.
  • Cloud Metadata Protection: Block egress to 169.254.169.254 and Azure metadata endpoints to close the SSRF-to-IMDS credential theft path.
  • Use Case: A platform engineer hardening a production namespace applies the default-deny, DNS, and per-tier policies, then verifies enforcement with kubectl test pods that must time out on blocked connections.

Quick Start

Ask the AI to generate a default-deny NetworkPolicy plus DNS and frontend-to-backend allow rules for the production namespace, with commands to verify enforcement.

Frequently Asked Questions about implementing-network-policies-for-kubernetes

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a default deny NetworkPolicy in Kubernetes?▼

Create a NetworkPolicy with an empty podSelector and both Ingress and Egress in policyTypes, applied per namespace. This blocks all traffic, after which you add explicit allow rules such as DNS egress to kube-system on port 53.

How to allow DNS traffic with Kubernetes egress policies?▼

Add an egress rule targeting the kube-system namespace via namespaceSelector with UDP and TCP port 53. Without this rule, a default-deny egress policy breaks name resolution and operators often remove the policy entirely.

Which CNI plugins support Kubernetes NetworkPolicy?▼

Calico, Cilium, and Antrea enforce NetworkPolicy objects. Plain flannel ignores them, so kubectl apply succeeds but nothing is enforced; confirm your CNI supports policies before relying on them.

How do I block cloud metadata access from Kubernetes pods?▼

Create an egress policy allowing 0.0.0.0/0 with an except list containing 169.254.169.254/32 for AWS and GCP, plus 100.100.100.200/32 for Azure. This closes the SSRF-to-IMDS credential theft path.

Why is my NetworkPolicy not blocking pod traffic?▼

Common causes are a CNI that does not implement NetworkPolicy, a selector typo matching no pods, or missing policyTypes. Verify with kubectl get networkpolicies and a test pod whose connection to a blocked service must time out.

Related Skills

Explore More Software Engineering Skills→
altrupetsaltrupets

Network Policies & Security

Manage Kubernetes network policies to control pod and namespace traffic flows.

Official
Advanced
foxj77foxj77
18

kyverno-troubleshooting

Diagnose Kyverno policy violations and admission webhook failures in Kubernetes clusters.

Community
Advanced
haryelramalhoharyelramalho

k8s-security-policies

Generate Kubernetes security policies for network segmentation, pod security, and RBAC.

Community
Advanced
kagentikagenti
292

istio:ambient-waypoint

Configure L7 AuthorizationPolicy in Istio Ambient mode with waypoint proxies.

Official
Advanced