mcpField
I
implementing-container-network-policies-with-calico

implementing-container-network-policies-with-calico

github.com/mukul975Security35.2k54 installsUpdated 8w ago
Repository

About implementing-container-network-policies-with-calico

A security skill for auditing and configuring Calico network policies in Kubernetes. It guides operators through namespace isolation, traffic rules, and connectivity validation using calicoctl and the Kubernetes API.

Key features

  1. 01Audit existing policies
  2. 02Set namespace default-deny rules
  3. 03Define workload-specific allow rules
  4. 04Validate connectivity enforcement
  5. 05Generate a JSON audit report

Use cases

  1. 01Find namespaces without network protection
  2. 02Establish default-deny ingress and egress controls
  3. 03Allow required pod and service traffic
  4. 04Verify policy behavior between pods

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill implementing-container-network-policies-with-calico

After installing, type/implementing-container-network-policies-with-calicoin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Implementing Container Network Policies with Calico

Overview

Calico provides Kubernetes-native and extended network policy enforcement through its CNI plugin. This skill covers creating and auditing Calico NetworkPolicy and GlobalNetworkPolicy resources to implement pod-to-pod traffic control, namespace isolation, egress restrictions, and DNS-based policy rules using calicoctl and the Kubernetes API.

When to Use

  • When deploying or configuring implementing container network policies with calico capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Kubernetes cluster with Calico CNI installed
  • Python 3.9+ with kubernetes client library
  • calicoctl CLI tool installed and configured
  • kubectl access with RBAC permissions for network policy management

Steps

Step 1: Audit Existing Network Policies

Use calicoctl and kubectl to inventory current network policies and identify unprotected namespaces.

Step 2: Implement Default-Deny Policies

Create default-deny ingress and egress policies per namespace as a zero-trust baseline.

Step 3: Create Workload-Specific Allow Rules

Define granular allow rules for legitimate pod-to-pod and pod-to-service communication.

Step 4: Validate Policy Enforcement

Test connectivity between pods to verify policies are correctly enforced.

Expected Output

JSON audit report listing all network policies, unprotected namespaces, policy rule counts, and connectivity test results.

Comments

Markdown supported