managing-network-policies

name	managing-network-policies
description	Execute use when managing Kubernetes network policies and firewall rules. Trigger with phrases like "create network policy", "configure firewall rules", "restrict pod communication", or "setup ingress/egress rules". Generates Kubernetes NetworkPolicy manifests following least privilege and zero-trust principles.
allowed-tools	Read, Write, Edit, Grep, Glob, Bash(kubectl:*)
version	1.0.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatible-with	claude-code, codex, openclaw
tags	["devops","kubernetes","network-policies"]

Managing Network Policies

Overview

Create and manage Kubernetes NetworkPolicy manifests to enforce zero-trust networking between pods, namespaces, and external endpoints. Generate ingress and egress rules with label selectors, namespace selectors, CIDR blocks, and port specifications following the principle of least privilege.

Prerequisites

• Kubernetes cluster with a CNI plugin that supports NetworkPolicy (Calico, Cilium, Weave Net)
• kubectl configured with permissions to create and manage NetworkPolicy resources
• Pod labels consistently defined across deployments for accurate selector targeting
• Service communication map documenting which pods need to talk to which pods on which ports
• Understanding of DNS requirements (pods need egress to kube-dns on port 53 for name resolution)

Instructions

1. Map the application communication patterns: identify all service-to-service, service-to-database, and service-to-external connections
2. Start with a default-deny policy for both ingress and egress in each namespace to establish zero-trust baseline
3. Add explicit allow rules for each legitimate communication path: specify source pod labels, destination pod labels, and ports
4. Always include a DNS egress rule allowing traffic to kube-system namespace on UDP/TCP port 53 for CoreDNS
5. Define egress rules for external API access: use CIDR blocks or namespaceSelector for known external services
6. Apply policies to a test namespace first and verify connectivity with kubectl exec curl/wget commands
7. Monitor for blocked traffic in the CNI plugin logs (Calico: calicoctl node status, Cilium: cilium monitor)
8. Iterate on policies: add missing allow rules for any legitimate traffic that gets blocked
9. Document each policy with annotations explaining the business reason for the allowed communication

Output

• Default-deny NetworkPolicy manifests for ingress and egress per namespace
• Allow-list NetworkPolicy manifests for each service communication path
• DNS egress policy allowing pod name resolution
• External access egress policies with CIDR blocks
• Connectivity test commands for validation

Error Handling

Error	Cause	Solution
All traffic blocked after applying policy	Default-deny applied without corresponding allow rules