skills.rest
automateyournetwork
automateyournetworkCOMMUNITY
Explore all skills by this author →
Website𝕏@john_capobiancoGitHub

k8s-network-policy

Review Kubernetes NetworkPolicies to determine what traffic is permitted to reach a workload.

650|182|Updated Feb 19, 2026
Search Tags:#kubernetes#kubectl#segmentation#read-only#networkpolicy#cni#Security audit
One-click install
npx skills add https://github.com/automateyournetwork/netclaw --skill k8s-network-policy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: k8s-network-policy
Source: https://github.com/automateyournetwork/netclaw/tree/main/workspace/skills/k8s-network-policy
Command: npx skills add https://github.com/automateyournetwork/netclaw --skill k8s-network-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Kubernetes is default-allow, so a namespace with no NetworkPolicy permits all traffic — and read-only queries can silently return incomplete results when permissions are insufficient. This Skill audits cluster network segmentation correctly, distinguishing "no policies exist" from "policies could not be seen" so security reviews are not based on false negatives.

Core Features & Use Cases

  • Scoped NetworkPolicy Audits: Lists NetworkPolicies cluster-wide or per-namespace via a read-only k8s-mcp server, reporting podSelectors, policyTypes, and ingress/egress rules rather than just policy existence.
  • Permission Preflight: Verifies cluster-wide list permission with kubectl auth can-i before trusting empty results, preventing audit lies caused by silent namespace-scoped fallback.
  • Six-Cause Empty-Result Diagnosis: Distinguishes permission gaps, missing namespaces, empty namespaces, selector typos, missing CRDs (Cilium/Calico), and unreachable clusters.
  • Use Case: During a security review, ask what can reach a production pod and receive the applicable policies, the exact scope queried, which cluster answered, and an explicit statement of what is permitted.

Quick Start

Ask the agent to review which NetworkPolicies apply to the payments namespace and state what traffic is permitted to those pods.

Frequently Asked Questions about k8s-network-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check which NetworkPolicies apply to a Kubernetes pod?▼

List NetworkPolicies in the pod's namespace and inspect each policy's podSelector, policyTypes, and from/to rules to see which ones select the pod. Also check cluster-scoped CRD policies like CiliumClusterwideNetworkPolicy or Calico GlobalNetworkPolicy for a complete picture.

What does it mean when a namespace has no NetworkPolicy?▼

Kubernetes is default-allow, so a namespace with zero NetworkPolicies permits all ingress and egress traffic in both directions. An empty policy list is a security finding, not a neutral observation, and should always be reported with that consequence.

Why does a NetworkPolicy query return empty results when policies exist?▼

Insufficient RBAC permissions can cause silent fallback to a single namespace instead of a cluster-wide list, returning incomplete results without an error. Run kubectl auth can-i list networkpolicies --all-namespaces first to confirm scope before trusting any empty result.

Does observed network traffic prove a NetworkPolicy permits it?▼

No. Observed traffic and declared policy answer different questions: traffic may have flowed before a policy was added, and absent traffic does not prove a policy blocks it. Report packet captures and policy declarations as two separate kinds of evidence.

Can this Skill modify or create Kubernetes NetworkPolicies?▼

No. The underlying k8s-mcp server is strictly read-only with Secrets access denied and no mutation path reachable. It only lists and inspects existing policies; changes must be made through separate tooling.

Related Skills

Explore More Software Engineering Skills→
3horizons3horizons

kubectl-cli

Run kubectl commands for Kubernetes cluster management and troubleshooting.

Official
Intermediate
Marwan78888Marwan78888
16

kubernetes-specialist

Automate Kubernetes workload deployment, RBAC, NetworkPolicies, and multi-cluster management.

Community
Advanced
latestaiagentslatestaiagents
5

metrics-logs-traces

Implement metrics, structured logging, and distributed tracing with OpenTelemetry.

Official
Advanced
martinholovskymartinholovsky
45

cilium-expert

Configure Cilium CNI, network policies, and Hubble observability for Kubernetes.

Community
Advanced