What it does. Writes portable upstream Kubernetes NetworkPolicy YAML - default-deny-all, DNS egress, namespace and pod selector rules - that works on any conformant CNI such as Calico or Cilium. Use when segmentation must stay CNI-portable, introducing a default-deny posture, or restricting east-west traffic between pods and namespaces without depending on a vendor CRD. Keywords: NetworkPolicy, default deny, podSelector, namespaceSelector, ingress, egress, CNI portable. Do not use for Calico-specific resources - use implementing-kubernetes-network-policy-with-calico. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-network-policies-for-kubernetes, or copy the skill folder into ~/.claude/skills/implementing-network-policies-for-kubernetes/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-policies-for-kubernetes/SKILL.md

SKILL.md (verbatim)

name: implementing-network-policies-for-kubernetes
description: >-
  Writes portable upstream Kubernetes NetworkPolicy YAML - default-deny-all, DNS egress,
  namespace and pod selector rules - that works on any conformant CNI such as Calico or
  Cilium. Use when segmentation must stay CNI-portable, introducing a default-deny posture, or
  restricting east-west traffic between pods and namespaces without depending on a vendor CRD.
  Keywords: NetworkPolicy, default deny, podSelector, namespaceSelector, ingress, egress, CNI
  portable. Do not use for Calico-specific resources - use
  implementing-kubernetes-network-policy-with-calico.
domain: cybersecurity
subdomain: container-security
tags:
- containers
- kubernetes
- security
- network-policies
- microsegmentation
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525

Implementing Network Policies for Kubernetes

Overview

Kubernetes NetworkPolicies provide pod-level network segmentation by defining ingress and egress rules that control traffic flow between pods, namespaces, and external endpoints. Combined with CNI plugins like Calico or Cilium, network policies enforce zero-trust microsegmentation to prevent lateral movement within the cluster.

When to Use

• When deploying or configuring implementing network policies for kubernetes capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Kubernetes cluster with NetworkPolicy-supporting CNI (Calico, Cilium, Antrea)
• kubectl configured with admin access
• Understanding of pod labels and selectors

Workflow

Step 1: Default Deny All Traffic

# default-deny-all.yaml - Apply to every namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}  # Applies to all pods
  policyTypes:
    - Ingress
    - Egress

Step 2: Allow DNS Egress (Required for Service Discovery)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

Step 3: Application-Specific Policies

# Allow frontend to reach backend only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-allow-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
---
# Allow backend to reach database only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: database-allow-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: backend
      ports:
        - protocol: TCP
          port: 5432

Step 4: Cross-Namespace Policies

# Allow monitoring namespace to scrape metrics
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-monitoring-scrape
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              purpose: monitoring
      ports:
        - protocol: TCP
          port: 9090  # Prometheus metrics port

Step 5: Egress Restrictions

# Restrict egress to specific external services
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Egress
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432
    - to:  # Allow external API
        - ipBlock:
            cidr: 203.0.113.0/24
      ports:
        - protocol: TCP
          port: 443
    - to:  # DNS
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53

Step 6: Block Cloud Metadata Access

# Prevent SSRF to cloud metadata service
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: block-metadata
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32  # AWS/GCP metadata
              - 100.100.100.200/32  # Azure metadata

Validation Commands

# Verify policies are applied
kubectl get networkpolicies -n production

# Test connectivity (should be blocked)
kubectl run test-pod --image=busybox --restart=Never -n production -- wget -qO- --timeout=2 http://database-service:5432
# Expected: timeout (blocked by policy)

# Test allowed traffic
kubectl run frontend-test --image=busybox --labels=app=frontend --restart=Never -n production -- wget -qO- --timeout=2 http://backend-service:8080
# Expected: connection succeeds

References

• Kubernetes Network Policies
• Calico Network Policies
• Cilium Network Policies
• Network Policy Editor

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Network Policy Audit Template

Namespace Policy Matrix

Service Communication Map

Remediation

references/api-reference.md (verbatim)

API Reference: Implementing Network Policies for Kubernetes

Default Deny-All Policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: production
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

Allow Specific Ingress

spec:
  podSelector:
    matchLabels: { app: backend }
  ingress:
    - from:
        - podSelector: { matchLabels: { app: frontend } }
      ports:
        - port: 8080

kubectl Commands

# List all network policies
kubectl get networkpolicy --all-namespaces
# Describe policy
kubectl describe networkpolicy default-deny -n production
# Apply policy
kubectl apply -f netpol.yaml

Policy Types

Common Patterns

References

• K8s NetworkPolicy: https://kubernetes.io/docs/concepts/services-networking/network-policies/
• Network Policy Editor: https://editor.networkpolicy.io/
• CNI Comparison: https://kubernetes.io/docs/concepts/cluster-administration/networking/

references/standards.md (verbatim)

Standards Reference - Kubernetes Network Policies

CIS Kubernetes Benchmark v1.8 - Section 5.3

• 5.3.1: Ensure CNI supports Network Policies
• 5.3.2: Ensure default deny NetworkPolicy for all namespaces

NSA/CISA Kubernetes Hardening Guide

• Implement network segmentation between namespaces
• Apply default-deny network policies
• Restrict pod-to-pod communication to required paths only
• Block access to cloud metadata endpoints

MITRE ATT&CK Mitigations

references/workflows.md (verbatim)

Workflows - Kubernetes Network Policies

Workflow 1: Network Policy Deployment

[Identify communication paths] --> [Create default-deny] --> [Add allow rules per service]
         |                                |                           |
         v                                v                           v
  Map pod-to-pod traffic         Apply to all namespaces    Test with connectivity checks
  Document required flows        Verify DNS still works     Monitor for broken connections

Workflow 2: Progressive Enforcement

Step 1: Deploy in audit mode (Calico: log-only)
Step 2: Monitor traffic patterns for 1 week
Step 3: Create policies matching observed traffic
Step 4: Apply default-deny in non-production
Step 5: Validate application functionality
Step 6: Roll out to production namespaces

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.