What it does. Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny baselines, policy ordering and precedence, service-account-based selectors, and verifying that policy is genuinely being enforced. Use when adopting Calico as the enforcement CNI, establishing a default-deny baseline, or debugging why a NetworkPolicy is not taking effect under Calico. Keywords: Calico CNI, NetworkPolicy, default deny, policy order, Felix, service account selector. Do not use for Calico-only CRDs such as GlobalNetworkPolicy or DNS egress - use implementing-container-network-policies-with-calico; for CNI-agnostic policy use implementing-network-policies-for-kubernetes. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-kubernetes-network-policy-with-calico/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-kubernetes-network-policy-with-calico, or copy the skill folder into ~/.claude/skills/implementing-kubernetes-network-policy-with-calico/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-network-policy-with-calico/SKILL.md

SKILL.md (verbatim)

name: implementing-kubernetes-network-policy-with-calico
description: >-
  Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it,
  covering default-deny baselines, policy ordering and precedence, service-account-based
  selectors, and verifying that policy is genuinely being enforced. Use when adopting Calico
  as the enforcement CNI, establishing a default-deny baseline, or debugging why a
  NetworkPolicy is not taking effect under Calico. Keywords: Calico CNI, NetworkPolicy,
  default deny, policy order, Felix, service account selector. Do not use for Calico-only CRDs
  such as GlobalNetworkPolicy or DNS egress - use
  implementing-container-network-policies-with-calico; for CNI-agnostic policy use
  implementing-network-policies-for-kubernetes.
domain: cybersecurity
subdomain: container-security
tags:
- calico
- kubernetes
- network-policy
- network-segmentation
- zero-trust
- cni
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525

Implementing Kubernetes Network Policy with Calico

Overview

Calico is an open-source CNI plugin that provides fine-grained network policy enforcement for Kubernetes clusters. It implements the full Kubernetes NetworkPolicy API and extends it with Calico-specific GlobalNetworkPolicy, supporting policy ordering, deny rules, and service-account-based selectors.

When to Use

• When deploying or configuring implementing kubernetes network policy with calico capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Kubernetes cluster (v1.24+)
• Calico CNI installed (v3.26+)
• kubectl and calicoctl CLI tools
• Cluster admin RBAC permissions

Installing Calico

Operator-based Installation (Recommended)

# Install the Tigera operator
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/tigera-operator.yaml

# Install Calico custom resources
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/custom-resources.yaml

# Verify installation
kubectl get pods -n calico-system
watch kubectl get pods -n calico-system

# Install calicoctl
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calicoctl.yaml

Verify Calico is Running

# Check Calico pods
kubectl get pods -n calico-system

# Check Calico node status
kubectl exec -n calico-system calicoctl -- calicoctl node status

# Check IP pools
kubectl exec -n calico-system calicoctl -- calicoctl get ippool -o wide

Kubernetes NetworkPolicy

Default Deny All Traffic

# deny-all-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress

---
# deny-all-egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress

Allow Specific Pod-to-Pod Communication

# allow-frontend-to-backend.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

Allow DNS Egress

# allow-dns-egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector: {}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

Namespace Isolation

# allow-same-namespace.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-same-namespace
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector: {}

Calico-Specific Policies

GlobalNetworkPolicy (Cluster-Wide)

# global-deny-external.yaml
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: deny-external-ingress
spec:
  order: 100
  selector: "projectcalico.org/namespace != 'ingress-nginx'"
  types:
    - Ingress
  ingress:
    - action: Deny
      source:
        nets:
          - 0.0.0.0/0
      destination: {}

Calico NetworkPolicy with Deny Rules

# calico-deny-policy.yaml
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: deny-database-from-frontend
  namespace: production
spec:
  order: 10
  selector: app == 'database'
  types:
    - Ingress
  ingress:
    - action: Deny
      source:
        selector: app == 'frontend'
    - action: Allow
      source:
        selector: app == 'backend'
      destination:
        ports:
          - 5432

Service Account Based Policy

# sa-based-policy.yaml
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: allow-by-service-account
  namespace: production
spec:
  selector: app == 'api'
  ingress:
    - action: Allow
      source:
        serviceAccounts:
          names:
            - frontend-sa
            - monitoring-sa
  egress:
    - action: Allow
      destination:
        serviceAccounts:
          names:
            - database-sa

Host Endpoint Protection

# host-endpoint-policy.yaml
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: restrict-host-ssh
spec:
  order: 10
  selector: "has(kubernetes.io/hostname)"
  applyOnForward: false
  types:
    - Ingress
  ingress:
    - action: Allow
      protocol: TCP
      source:
        nets:
          - 10.0.0.0/8
      destination:
        ports:
          - 22
    - action: Deny
      protocol: TCP
      destination:
        ports:
          - 22

Calico Policy Tiers

# security-tier.yaml
apiVersion: projectcalico.org/v3
kind: Tier
metadata:
  name: security
spec:
  order: 100

---
# platform-tier.yaml
apiVersion: projectcalico.org/v3
kind: Tier
metadata:
  name: platform
spec:
  order: 200

Monitoring and Troubleshooting

# List all network policies
kubectl get networkpolicy --all-namespaces

# List Calico-specific policies
kubectl exec -n calico-system calicoctl -- calicoctl get networkpolicy --all-namespaces -o wide
kubectl exec -n calico-system calicoctl -- calicoctl get globalnetworkpolicy -o wide

# Check policy evaluation for a specific endpoint
kubectl exec -n calico-system calicoctl -- calicoctl get workloadendpoint -n production -o yaml

# View Calico logs
kubectl logs -n calico-system -l k8s-app=calico-node --tail=100

# Test connectivity
kubectl exec -n production frontend-pod -- wget -qO- --timeout=2 http://backend-svc:8080/health

Best Practices

1. Start with default deny - Apply deny-all policies to every namespace, then allow specific traffic
2. Use labels consistently - Define a labeling standard for app, tier, environment
3. Order policies - Use Calico policy ordering (order field) to control evaluation precedence
4. Allow DNS first - Always create DNS egress rules before applying egress deny policies
5. Use GlobalNetworkPolicy for cluster-wide security baselines
6. Test policies in staging - Validate network connectivity after applying policies
7. Monitor denied traffic - Enable Calico flow logs for visibility into blocked connections
8. Use tiers - Organize policies into security, platform, and application tiers

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Network Policy Design Template

Application Traffic Flow Matrix

Source	Destination	Port	Protocol	Justification
frontend	backend-api	8080	TCP	REST API calls
backend-api	postgres-db	5432	TCP	Database queries
backend-api	redis-cache	6379	TCP	Session caching
all pods	kube-dns	53	UDP/TCP	DNS resolution
ingress-nginx	frontend	80	TCP	External traffic
prometheus	all pods	9090	TCP	Metrics scraping

Namespace Policy Checklist

Per Namespace

• Default deny ingress applied
• Default deny egress applied
• DNS egress allowed
• Required ingress rules created per traffic flow
• Required egress rules created per traffic flow
• Cross-namespace policies documented
• Policies tested with connectivity checks

Cluster-Wide (GlobalNetworkPolicy)

• Block external access to non-ingress namespaces
• Allow monitoring namespace to scrape metrics
• Allow kube-system health checks
• Emergency isolation policy prepared

Policy Naming Convention

{action}-{source}-to-{destination}-{port}

Examples:

• allow-frontend-to-backend-8080
• deny-external-to-database-5432
• allow-monitoring-to-all-9090

Emergency Isolation Policy

# Apply this to immediately isolate a compromised namespace
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: emergency-isolate-NAMESPACE
spec:
  order: 1
  selector: "projectcalico.org/namespace == 'NAMESPACE'"
  types:
    - Ingress
    - Egress
  ingress:
    - action: Deny
  egress:
    - action: Deny

Review Schedule

Review Type	Frequency	Owner
Policy audit	Monthly	Security Team
Traffic flow validation	After each deployment	DevOps
Compliance check	Quarterly	GRC Team
Emergency drill	Semi-annually	Security + SRE

references/api-reference.md (verbatim)

API Reference: Implementing Kubernetes Network Policy with Calico

Kubernetes NetworkPolicy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

Calico GlobalNetworkPolicy

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: deny-external
spec:
  order: 100
  selector: app == "backend"
  types: [Ingress]
  ingress:
    - action: Deny
      source:
        nets: ["0.0.0.0/0"]

calicoctl CLI

# Apply policy
calicoctl apply -f policy.yaml
# Get policies
calicoctl get globalnetworkpolicy -o yaml
# Get host endpoints
calicoctl get hostendpoint

Policy Types

Type	Scope	Ordering
NetworkPolicy	Namespace	Additive (OR)
GlobalNetworkPolicy	Cluster-wide	Ordered by order field

Common Policy Patterns

Pattern	Description
Default deny	Empty podSelector, no rules
Allow DNS	Egress to kube-system UDP/TCP 53
Allow ingress from namespace	namespaceSelector match
Allow to external CIDR	ipBlock in egress

References

• Calico Docs: https://docs.tigera.io/calico/
• K8s NetworkPolicy: https://kubernetes.io/docs/concepts/services-networking/network-policies/
• Calico Policy Tutorial: https://docs.tigera.io/calico/latest/network-policy/

references/standards.md (verbatim)

Standards and References - Kubernetes Network Policy with Calico

Industry Standards

NIST SP 800-190: Application Container Security Guide

• Section 4.4: Container Networking - Isolate container network traffic using network policies
• Section 5.3: Network Security - Implement micro-segmentation between containers
• Recommends default-deny policies with explicit allowlisting

CIS Kubernetes Benchmark v1.8

• 5.3.1: Ensure that the CNI in use supports Network Policies
• 5.3.2: Ensure that all Namespaces have Network Policies defined
• 5.3.3: Ensure that the default namespace does not contain any pods

NIST SP 800-53 Rev 5

• SC-7: Boundary Protection - Implement network segmentation controls
• AC-4: Information Flow Enforcement - Control network traffic between pods
• SC-7(5): Deny by Default / Allow by Exception

NSA/CISA Kubernetes Hardening Guide v1.2

• Section 3: Network Separation and Hardening
  • Use network policies to isolate workloads
  • Implement default deny ingress and egress policies
  • Limit pod-to-pod communication to minimum required

Calico Documentation References

Resource	URL
Calico NetworkPolicy	https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy
Kubernetes Policy Tutorial	https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-basic
GlobalNetworkPolicy	https://docs.tigera.io/calico/latest/reference/resources/globalnetworkpolicy
Policy Tiers	https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy
Calico eBPF Dataplane	https://docs.tigera.io/calico/latest/operations/ebpf/enabling-ebpf

Zero Trust Network Model

Principles Applied

1. Never trust, always verify - Default deny all traffic between pods
2. Least privilege access - Only allow specific required communication paths
3. Micro-segmentation - Isolate workloads at pod-to-pod granularity
4. Identity-based policies - Use service accounts and labels for policy selection
5. Continuous monitoring - Log and alert on denied traffic patterns

Compliance Mappings

PCI DSS v4.0

• Requirement 1.2.1: Restrict inbound and outbound traffic to that which is necessary
• Requirement 1.3.1: Inbound traffic is restricted to that which is necessary
• Requirement 1.3.2: Outbound traffic is restricted to that which is necessary

SOC 2 Type II

• CC6.1: Logical access security - Network isolation between components
• CC6.6: Network boundaries - Restrict access at network boundaries

HIPAA

• 164.312(e)(1): Transmission Security - Protect data in transit between services

references/workflows.md (verbatim)

Workflow - Implementing Kubernetes Network Policy with Calico

Phase 1: Discovery and Planning

Map Application Communication Flows

# Identify all namespaces
kubectl get namespaces

# List all services per namespace
kubectl get svc --all-namespaces -o wide

# Identify pod labels
kubectl get pods --all-namespaces --show-labels

# Check existing network policies
kubectl get networkpolicy --all-namespaces

Document Required Traffic Flows

Create a traffic matrix documenting:

• Source pod/namespace -> Destination pod/namespace
• Protocol and port
• Business justification

Phase 2: Install and Verify Calico

# Install Tigera operator
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/tigera-operator.yaml

# Wait for operator
kubectl wait --for=condition=Available deployment/tigera-operator -n tigera-operator --timeout=120s

# Install Calico custom resources
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/custom-resources.yaml

# Verify all Calico pods are running
kubectl get pods -n calico-system -w

# Install calicoctl as a pod
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calicoctl.yaml

# Verify node status
kubectl exec -n calico-system calicoctl -- calicoctl node status

Phase 3: Apply Default Deny Policies

Step 1 - Create DNS Allow Policy First

kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to: []
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
EOF

Step 2 - Apply Default Deny Ingress

kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
EOF

Step 3 - Apply Default Deny Egress

kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
EOF

Step 4 - Apply Allow Rules per Traffic Flow

# Allow frontend to backend
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
EOF

Phase 4: Validate Policies

Connectivity Testing

# Test allowed path (should succeed)
kubectl exec -n production deploy/frontend -- wget -qO- --timeout=5 http://backend-svc:8080/health

# Test blocked path (should timeout/fail)
kubectl exec -n production deploy/frontend -- wget -qO- --timeout=5 http://database-svc:5432

# Test cross-namespace (should fail if denied)
kubectl exec -n staging deploy/test -- wget -qO- --timeout=5 http://backend-svc.production:8080/health

Monitor Denied Connections

# Check Calico logs for denied connections
kubectl logs -n calico-system -l k8s-app=calico-node --tail=50 | grep -i deny

# Enable flow logs (Calico Enterprise)
kubectl exec -n calico-system calicoctl -- calicoctl get felixconfiguration default -o yaml

Phase 5: Advanced Calico Policies

Apply Global Security Baseline

kubectl exec -n calico-system calicoctl -- calicoctl apply -f - <<EOF
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: security-baseline
spec:
  order: 100
  types:
    - Ingress
    - Egress
  egress:
    - action: Allow
      protocol: UDP
      destination:
        ports:
          - 53
    - action: Allow
      protocol: TCP
      destination:
        ports:
          - 53
  ingress:
    - action: Allow
      source:
        selector: "projectcalico.org/namespace in {'kube-system', 'monitoring'}"
EOF

Phase 6: Ongoing Operations

Regular Policy Audits

1. Review traffic flow matrix monthly
2. Validate policies match documented flows
3. Remove stale policies for decommissioned services
4. Update policies when new services are deployed

Incident Response

1. If suspicious traffic detected, apply emergency deny policy
2. Analyze Calico flow logs for investigation
3. Identify compromised pod via workload endpoint
4. Isolate pod by applying targeted deny policy

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.