Skip to main content Inicio Creadores xalgord xalgorix implementing-kubernetes-network-policy-with-calico
implementing-kubernetes-network-policy-with-calico Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication.
Ir a la instalación Skills Marketplace Descubre y explora habilidades de IA creadas por la comunidad.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Mostrar detalles del prompt Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/xalgord/xalgorix --skill implementing-kubernetes-network-policy-with-calicoEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Descargar Zip Descargando... Ocupaciones relacionadas SOC
Basado en la clasificación ocupacional SOC
name implementing-kubernetes-network-policy-with-calico description Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication. domain cybersecurity subdomain container-security tags ["calico","kubernetes","network-policy","network-segmentation","zero-trust","cni"] version 1.0 author mahipal license Apache-2.0 nist_csf ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]
Implementing Kubernetes Network Policy with Calico
Overview
Calico is an open-source CNI plugin that provides fine-grained network policy enforcement for Kubernetes clusters. It implements the full Kubernetes NetworkPolicy API and extends it with Calico-specific GlobalNetworkPolicy, supporting policy ordering, deny rules, and service-account-based selectors.
When to Use
When deploying or configuring implementing kubernetes network policy with calico capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Common Misconfigurations & Verification
No default-deny: Kubernetes NetworkPolicy is additive and default-allow. Without a podSelector: {} deny-all for both Ingress and Egress, your allow rules don't restrict anything. Apply default-deny per namespace first.CNI not enforcing the policy: a GlobalNetworkPolicy/NetworkPolicy applies cleanly even when the dataplane isn't enforcing. Verify Calico is the active CNI and healthy: kubectl exec -n calico-system calicoctl -- calicoctl node status.Calico order precedence: lower order evaluates first and wins; a broad Allow at low order can shadow a specific Deny. Audit with calicoctl get networkpolicy -A -o wide and calicoctl get globalnetworkpolicy -o wide.Egress deny without DNS allow: omitting the UDP/TCP 53 egress rule breaks service discovery, so operators disable egress policy entirely - add the kube-dns/53 allow before any egress deny.GlobalNetworkPolicy selector too wide/narrow: selector: "projectcalico.org/namespace != 'x'" typos or host-endpoint rules with wrong applyOnForward either lock out system traffic or protect nothing.Verify enforcement, don't assume: kubectl exec -n production frontend-pod -- wget -qO- --timeout=2 http://backend-svc:8080/health should succeed for allowed flows and time out for denied ones; enable Calico flow logs to confirm drops.
Prerequisites
Kubernetes cluster (v1.24+)
Calico CNI installed (v3.26+)
kubectl and
calicoctl
Cluster admin RBAC permissions
Installing Calico
Operator-based Installation (Recommended)
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/tigera-operator.yaml
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/custom-resources.yaml
kubectl get pods -n calico-system
watch kubectl get pods -n calico-system
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calicoctl.yaml
Verify Calico is Running
kubectl get pods -n calico-system
kubectl exec -n calico-system calicoctl -- calicoctl node status
kubectl exec -n calico-system calicoctl -- calicoctl get ippool -o wide
Kubernetes NetworkPolicy
Default Deny All Traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-ingress
namespace: production
spec:
podSelector: {}
policyTypes:
- Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-egress
namespace: production
spec:
podSelector: {}
policyTypes:
- Egress
Allow Specific Pod-to-Pod Communication
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend-to-backend
namespace: production
spec:
podSelector:
matchLabels:
app: backend
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080
Allow DNS Egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-dns-egress
namespace: production
spec:
podSelector: {}
policyTypes:
- Egress
egress:
- to:
- namespaceSelector: {}
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
Namespace Isolation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-same-namespace
namespace: production
spec:
podSelector: {}
policyTypes:
- Ingress
ingress:
- from:
- podSelector: {}
Calico-Specific Policies
GlobalNetworkPolicy (Cluster-Wide)
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
name: deny-external-ingress
spec:
order: 100
selector: "projectcalico.org/namespace != 'ingress-nginx'"
types:
- Ingress
ingress:
- action: Deny
source:
nets:
- 0.0 .0 .0 /0
destination: {}
Calico NetworkPolicy with Deny Rules
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
name: deny-database-from-frontend
namespace: production
spec:
order: 10
selector: app == 'database'
types:
- Ingress
ingress:
- action: Deny
source:
selector: app == 'frontend'
- action: Allow
source:
selector: app == 'backend'
destination:
ports:
- 5432
Service Account Based Policy
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
name: allow-by-service-account
namespace: production
spec:
selector: app == 'api'
ingress:
- action: Allow
source:
serviceAccounts:
names:
- frontend-sa
- monitoring-sa
egress:
- action: Allow
destination:
serviceAccounts:
names:
- database-sa
Host Endpoint Protection
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
name: restrict-host-ssh
spec:
order: 10
selector: "has(kubernetes.io/hostname)"
applyOnForward: false
types:
- Ingress
ingress:
- action: Allow
protocol: TCP
source:
nets:
- 10.0 .0 .0 /8
destination:
ports:
- 22
- action: Deny
protocol: TCP
destination:
ports:
- 22
Calico Policy Tiers
apiVersion: projectcalico.org/v3
kind: Tier
metadata:
name: security
spec:
order: 100
---
apiVersion: projectcalico.org/v3
kind: Tier
metadata:
name: platform
spec:
order: 200
Monitoring and Troubleshooting
kubectl get networkpolicy --all-namespaces
kubectl exec -n calico-system calicoctl -- calicoctl get networkpolicy --all-namespaces -o wide
kubectl exec -n calico-system calicoctl -- calicoctl get globalnetworkpolicy -o wide
kubectl exec -n calico-system calicoctl -- calicoctl get workloadendpoint -n production -o yaml
kubectl logs -n calico-system -l k8s-app=calico-node --tail =100
kubectl exec -n production frontend-pod -- wget -qO- --timeout =2 http://backend-svc:8080/health
Best Practices
Start with default deny - Apply deny-all policies to every namespace, then allow specific trafficUse labels consistently - Define a labeling standard for app, tier, environmentOrder policies - Use Calico policy ordering (order field) to control evaluation precedenceAllow DNS first - Always create DNS egress rules before applying egress deny policiesUse GlobalNetworkPolicy for cluster-wide security baselinesTest policies in staging - Validate network connectivity after applying policiesMonitor denied traffic - Enable Calico flow logs for visibility into blocked connectionsUse tiers - Organize policies into security, platform, and application tiers 