skills.rest
david-driscoll
david-driscollCOMMUNITY
Explore all skills by this author →
Website𝕏@david_dotnetGitHub

network-policy

Diagnose Cilium network policy drops using Hubble observations and namespace labels.

1|Updated Apr 6, 2025
Search Tags:#kubernetes#network policy#gitops#cilium#hubble#namespace labeling#escape hatch
One-click install
npx skills add https://github.com/david-driscoll/stargate-command-cluster --skill network-policy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: network-policy
Source: https://github.com/david-driscoll/stargate-command-cluster/tree/main/.agents/skills/network-policy
Command: npx skills add https://github.com/david-driscoll/stargate-command-cluster --skill network-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill resolves blocked or unexpected Kubernetes network traffic by helping you choose the correct Cilium network policy profile, add the required access labels, and debug drops with Hubble so you can restore connectivity safely.

Core Features & Use Cases

  • Profile selection & namespace labeling: Maps application traffic patterns to the correct network-policy.homelab/profile value and documents how to set it declaratively in kubernetes/platform/namespaces.yaml.
  • Hubble-first debugging of dropped flows: Provides a structured investigation workflow for DROPPED verdicts, including flow details, common egress/ingress checks (DNS/DB/internet/gateway/Prometheus), and policy visibility commands.
  • Emergency escape hatch with safety guardrails: Guides temporary namespace enforcement disabling via labels, explains the specific alerts that will fire, verifies traffic while investigating, and restores enforcement by removing the escape-hatch label.
  • Platform CNP creation guidance: Documents what platform namespace CNPs must include and where they must be added in the repository structure.

Quick Start

Ask: "In namespace my-app, traffic to database is being blocked—what Hubble command should I run and which namespace access label and profile should I set to fix it?"

Frequently Asked Questions about network-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I debug dropped traffic in Kubernetes using Hubble and Cilium?▼

Debug Cilium dropped traffic by querying Hubble for DROPPED verdicts, inspecting flow details, and checking common egress or ingress rules like DNS, database, or internet gateway connections to identify the blocking policy.

What is the best way to fix blocked application traffic in a Kubernetes namespace?▼

Fix blocked application traffic by mapping traffic patterns to the correct Cilium network policy profile and applying the required namespace access labels declaratively in your GitOps repository to restore connectivity.

Can I temporarily disable Cilium network policy enforcement for a namespace?▼

You can temporarily disable Cilium enforcement using an escape-hatch label on the namespace, which allows traffic while firing specific alerts so you can investigate safely before removing the label to restore enforcement.

How do I set namespace labels for Cilium network policies in a GitOps workflow?▼

Set namespace labels for Cilium policies declaratively by updating the namespace definitions in your repository, such as kubernetes/platform/namespaces.yaml, to apply the required network-policy profile values.

When should I create a platform Cilium Network Policy and what must it include?▼

Create a platform Cilium Network Policy when provisioning shared resource access, ensuring it includes the required ingress and egress rules and is placed in the correct repository structure location.

Related Skills

Explore More Software Engineering Skills→
rohitg00rohitg00
944

k8s-cilium

Observe and troubleshoot Cilium networking in Kubernetes clusters.

Community
Advanced
cdonohuecdonohue

color-tokens

Generates Tailwind-like CSS color tokens and accessibility data from a single hex value.

Community
Basic
woernflwoernfl

kubernetes-architect

Design and implement scalable Kubernetes platforms with GitOps integration.

Community
Advanced
ConnectiveTCSConnectiveTCS

cilium-expert

Deploy Cilium eBPF networking with identity-based policies and Hubble observability.

Community
Advanced