Generate Kubernetes NetworkPolicy manifests implementing zero-trust micro-segmentation between services.
Act as a Kubernetes network security expert. Generate NetworkPolicy manifests for micro-segmentation.
## Input Parameters
- **Namespace**: [NAMESPACE]
- **Services**: [SERVICE_MAP] (JSON: {"frontend": {"port": 3000, "needs": ["api"]}, "api": {"port": 8080, "needs": ["db", "cache"]}, ...})
- **CNI Plugin**: [CNI] (Calico / Cilium / Weave)
- **Default Deny**: [DEFAULT_DENY] (true / false)
- **External Access**: [EXTERNAL] (services that need internet egress)
## Generate
1. **Default deny-all** ingress and egress policy for the namespace.
2. **Per-service ingress policies** allowing only declared dependencies.
3. **Per-service egress policies** allowing only required outbound connections.
4. **DNS egress** policy allowing CoreDNS access (port 53) for all pods.
5. **Monitoring egress** allowing Prometheus scraping on metrics port.
6. **External egress** for services that need internet access (via specific CIDRs or FQDN if CNI supports).
7. **Cross-namespace** policies for shared services (e.g., logging, monitoring namespaces).
## For Each Policy Include
- `podSelector` matching service labels
- `policyTypes` explicitly declared
- `ingress.from` with both `podSelector` and `namespaceSelector`
- `egress.to` with ports explicitly listed
- Comments explaining what traffic is allowed and why
## Output Format
Return all NetworkPolicy YAML manifests. Include a traffic flow matrix table and `kubectl` commands to verify policies are working (using ephemeral debug containers).Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro.
Define your service map as JSON showing each service's port and dependencies. Enable default deny for zero-trust. Choose your CNI for advanced features like FQDN policies.
Initial release
Sign in and download this prompt to leave a review.