skills.rest
lurodrisilva
lurodrisilvaCOMMUNITY
Explore all skills by this author →
GitHub

kubernetes-networking

Guides Kubernetes networking design and Calico CNI implementation including IPAM, BGP, and policy mechanics.

Updated Apr 11, 2026
Search Tags:#networking#Kubernetes#network policy#IPAM#bgp#calico#cni
One-click install
npx skills add https://github.com/lurodrisilva/personal-skills --skill kubernetes-networking-lurodrisilva
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kubernetes-networking
Source: https://github.com/lurodrisilva/personal-skills/tree/main/networking/kubernetes-networking
Command: npx skills add https://github.com/lurodrisilva/personal-skills --skill kubernetes-networking-lurodrisilva

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Designing and configuring the Kubernetes networking plane requires deep knowledge of the pod network model, CNI mechanics, Services/kube-proxy, and Calico's architecture, and mistakes like wrong API groups, unsupported eBPF combinations, or HostEndpoint lockouts can break a cluster. ## Core Features & Use Cases - Network Model & CNI Mechanics: Explains the IP-per-pod no-NAT model, the four networking problems, CNI ADD/DEL invocation, conflist chaining, and Services/kube-proxy/CoreDNS behavior. - Calico Architecture & Dataplanes: Covers Felix/BIRD/confd/Typha components, iptables/eBPF/nftables/VPP dataplanes, Tigera operator install, IPAM pools and borrowing, BGP mesh vs route reflectors, and VXLAN/IPIP/native encapsulation decisions. - Policy Data Model: Details NetworkPolicy/GlobalNetworkPolicy on projectcalico.org/v3 with action, order, tiers, HostEndpoint failsafes, and network sets, including OSS vs Enterprise feature gates. - Use Case: When migrating a 200-node on-prem cluster off node-to-node BGP mesh, use this Skill to configure route reflectors, advertise service ClusterIPs with externalTrafficPolicy, and choose native routing over overlay. ## Quick Start Ask the AI to design a Calico IPPool and BGPConfiguration for a cluster that needs routable LoadBalancer service IPs without an external load balancer.

Frequently Asked Questions about kubernetes-networking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Calico IP pools in Kubernetes?▼

Create an IPPool resource on projectcalico.org/v3 with a cidr, blockSize, encapsulation mode, natOutgoing, and nodeSelector. Note that blockSize is immutable after creation and every node must be selected by at least one pool or its pods receive no IP.

VXLAN vs IPIP vs native routing in Calico, which should I use?▼

Prefer native no-encap routing when the fabric can route pod CIDRs, since it has the lowest overhead. Use IPIP for cross-subnet IPv4 traffic, and VXLAN when IPIP or BGP is blocked, such as on Azure, since VXLAN needs no BGP.

Does Calico eBPF dataplane work with IP-in-IP overlay?▼

No, the eBPF dataplane is unsupported with IP-in-IP overlay, the etcd datastore, GKE, and mixed eBPF/standard nodes. It requires kernel 5.10 or later, the Kubernetes API datastore, and kube-proxy removed before enabling BPF mode.

How do I advertise Kubernetes service IPs over BGP with Calico?▼

Set serviceClusterIPs and serviceLoadBalancerIPs CIDRs in the BGPConfiguration resource. With externalTrafficPolicy Cluster all nodes advertise the CIDR for ECMP, while Local advertises /32 routes only from nodes hosting a backing pod, preserving client source IP.

Why did creating a Calico HostEndpoint lock me out of the node?▼

A HostEndpoint defaults to deny-all on its interface, which can sever node access including SSH. Configure failsafe ports in FelixConfiguration, such as SSH 22 and BGP 179, plus a permissive GlobalNetworkPolicy before applying the HostEndpoint.

Are Calico policy tiers and domain-based egress open source?▼

Tiers are available in open-source Calico only in recent releases, so verify your version. Domain-based egress via allowedEgressDomains and L7 HTTPMatch are Enterprise/Cloud only, and OSS network sets are CIDR-only.

Related Skills

Explore More Software Engineering Skills→
hb-chenhb-chen
3

kubekey

Automate Kubernetes cluster deployment, scaling, and upgrades with KubeKey.

Community
Intermediate
Arete-ConsortiumArete-Consortium
4

networking

Diagnose Linux network connectivity, DNS, firewall, and routing issues with layer-by-layer troubleshooting.

Official
Intermediate
rloisellrloisell
7

zero-trust-architect

Design Zero Trust Architecture and SASE deployment models with NIST SP 800-207 mapping.

Community
Advanced
xalgordxalgord
954

implementing-network-policies-for-kubernetes

Implement Kubernetes NetworkPolicies for pod-level ingress and egress traffic segmentation.

Community
Intermediate