How do I install the K8S Cni Network skill?

Run npx skillmds@latest add gesh75/k8s-cni-network in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the K8S Cni Network skill do?

Design and triage Kubernetes networking with Cilium or Calico, NetworkPolicy, and egress control. Use when pods cannot reach a service, a NetworkPolicy is too open, or a node drops overlay traffic. It is listed under DevOps & Infra on SkillMD.

Is K8S Cni Network safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with K8S Cni Network?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is K8S Cni Network free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published K8S Cni Network?

gesh75 (@gesh75) published this skill. Their other Agent Skills are listed on their SkillMD profile.

K8S Cni Network by gesh75 — Agent Skill

Name: K8S Cni Network
Author: gesh75

File contents

Kubernetes CNI network

Do not use for app manifest authoring or Helm values. Not for service-mesh mTLS policy in depth.

Procedure

Identify CNI (Cilium eBPF vs Calico iptables/eBPF). Overlay vs native routing vs BGP to the fabric.
Services: ClusterIP inside, LoadBalancer via BGP (MetalLB / Cilium BGP) to the ToR, not a cloud NLB in on-prem.
NetworkPolicy default-deny per namespace. Egress to DNS and the allowed CIDR only.
Node MTU and kube-proxy-free mode. VXLAN fabric MTU must fit.
Verify: a probe pod, cilium connectivity test or calico equivalent, and a deny that still denies.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
  egress:
    - to: [{namespaceSelector: {matchLabels: {name: kube-system}}}]
      ports: [{port: 53, protocol: UDP}]

Anti-patterns

Never run the cluster overlay on a fabric already doing VXLAN without MTU math.
Do not leave egress any.

Safety

CNI swaps are a maintenance window. Policy edits are reviewed.

Frequently asked questions

K8S Cni Network