Enforce Kubernetes network segmentation using Calico CNI network policies and global network policies to control pod-to-pod traffic, restrict egress, and implement zero-trust microsegmentation.
Calico provides Kubernetes-native and extended network policy enforcement through its CNI plugin. This skill covers creating and auditing Calico NetworkPolicy and GlobalNetworkPolicy resources to implement pod-to-pod traffic control, namespace isolation, egress restrictions, and DNS-based policy rules using calicoctl and the Kubernetes API.
kubernetes client libraryUse calicoctl and kubectl to inventory current network policies and identify unprotected namespaces.
Create default-deny ingress and egress policies per namespace as a zero-trust baseline.
Define granular allow rules for legitimate pod-to-pod and pod-to-service communication.
Test connectivity between pods to verify policies are correctly enforced.
JSON audit report listing all network policies, unprotected namespaces, policy rule counts, and connectivity test results.