skills.rest
TheViziusGroup
TheViziusGroupOFFICIAL
Explore all skills by this author →
WebsiteGitHub

network-modern-stack

Guides design of Kubernetes networking, eBPF data planes, and zero trust architectures.

1|Updated Aug 10, 2026
Search Tags:#kubernetes#network policy#ebpf#zero trust#spiffe#cilium#aks networking
One-click install
npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill network-modern-stack-theviziusgroup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: network-modern-stack
Source: https://github.com/TheViziusGroup/vibe-engineering-skills/tree/main/plugins/network-engineering/skills/network-modern-stack
Command: npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill network-modern-stack-theviziusgroup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Modern production networking spans eBPF, Cilium, AKS CNI modes, workload identity, and service meshes, and engineers struggle to choose the right combination and configure it correctly for Kubernetes and cloud environments. ## Core Features & Use Cases - AKS CNI Decision Guidance: Compares Azure CNI Overlay, Pod Subnet, Node Subnet, and Kubenet with the production-standard az aks create command using Cilium dataplane and ACNS. - eBPF and Cilium Reference: Covers XDP, TC hooks, kube-proxy replacement, CiliumNetworkPolicy examples, Hubble observability, and service mesh selection among Istio, Linkerd, and Cilium. - Zero Trust and Identity Patterns: Provides default-deny NetworkPolicy layering, SPIFFE/SPIRE workload identity architecture, mTLS overhead benchmarks, and network SLO targets with multi-burn-rate alerting. - Use Case: When designing a new AKS cluster, use this Skill to select the CNI mode, write Cilium network policies with FQDN egress filtering, configure Entra Workload Identity, and set up Hubble-based observability. ## Quick Start Ask the AI to design a production AKS networking stack with Cilium, network policies, and workload identity for a payments microservices environment.

Frequently Asked Questions about network-modern-stack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Which AKS CNI mode should I use for production clusters?▼

Azure CNI Overlay with the Cilium dataplane is the recommended production standard, supporting 5,000 nodes and 250 pods per node while conserving VNet IP space. Kubenet is retiring March 31, 2028, and Azure CNI Node Subnet is being superseded.

How do I write a Cilium network policy with FQDN egress filtering?▼

Create a CiliumNetworkPolicy with an endpointSelector matching your workload labels and an egress rule using toFQDNs with matchName for the target domain plus toPorts for the allowed port. FQDN filtering requires ACNS or Cilium Enterprise.

Cilium vs Istio vs Linkerd: which service mesh should I choose?▼

Use Cilium if you already run Cilium CNI since it adds no extra infrastructure. Choose Linkerd for the lowest overhead at about 10MB RAM per proxy, or Istio for maximum features and multi-cluster support. Istio Ambient mode reduces mTLS overhead to about 8%.

Does Cilium replace kube-proxy in Kubernetes?▼

Yes, Cilium replaces kube-proxy by intercepting connections at the socket level during the connect() syscall, eliminating per-packet NAT overhead and conntrack contention. Seznam.cz reported a 72x CPU reduction after switching from iptables-based kube-proxy.

Why use SPIFFE/SPIRE instead of IP-based network policies?▼

IP addresses are not stable identity in dynamic environments because pod IPs change on every restart. SPIFFE issues cryptographically verifiable SVIDs that are short-lived and automatically rotated, enabling identity-based access that survives workload churn.

How do I test network resilience with chaos engineering on Kubernetes?▼

Use Chaos Mesh NetworkChaos CRDs to inject latency, packet loss, or partitions into selected pods, starting with a small blast radius and a defined steady-state hypothesis. Ground experiments in SLO preservation and set abort criteria before running.

Related Skills

Explore More Software Engineering Skills→
AraflyArafly

kubernetes-cluster-onboarding

Map an unfamiliar Kubernetes cluster before making changes.

Community
Advanced
parandurume-labsparandurume-labs
1

azure-security-audit

Audit and harden Azure infrastructure security configurations across identity, network, and monitoring.

Official
Advanced
Samuelca6399Samuelca6399

observability

Correlate structured logs, metrics, and distributed traces for production monitoring.

Community
Advanced
lapc506lapc506
4

Network Policies & Security

Manage Kubernetes network policies with ingress and egress rules.

Community
Advanced