# K8S Cni Network

> Design and triage Kubernetes networking with Cilium or Calico, NetworkPolicy, and egress control. Use when pods cannot reach a service, a NetworkPolicy is too open, or a node drops overlay traffic.

- Skill: `gesh75/k8s-cni-network` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gesh75/k8s-cni-network`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gesh75/k8s-cni-network/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: gesh75 (https://skillmd.com/u/gesh75)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gesh75/k8s-cni-network

---


# Kubernetes CNI network

Do not use for app manifest authoring or Helm values. Not for service-mesh mTLS policy in depth.

## Procedure

1. Identify CNI (Cilium eBPF vs Calico iptables/eBPF). Overlay vs native routing vs BGP to the fabric.
2. Services: ClusterIP inside, LoadBalancer via BGP (MetalLB / Cilium BGP) to the ToR, not a cloud NLB in on-prem.
3. NetworkPolicy default-deny per namespace. Egress to DNS and the allowed CIDR only.
4. Node MTU and kube-proxy-free mode. VXLAN fabric MTU must fit.
5. Verify: a probe pod, `cilium connectivity test` or calico equivalent, and a deny that still denies.

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
  egress:
    - to: [{namespaceSelector: {matchLabels: {name: kube-system}}}]
      ports: [{port: 53, protocol: UDP}]
```

## Anti-patterns

- Never run the cluster overlay on a fabric already doing VXLAN without MTU math.
- Do not leave egress any.

## Safety

CNI swaps are a maintenance window. Policy edits are reviewed.