---
name: "cilium-network-policies-l7"
description: "Enforce Layer 3/4/7 network security policies with DNS name filtering and HTTP path restrictions."
metadata:
  author: "Cilium"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "write ciliumnetworkpolicy l7"
  - "restrict pod egress fqdn cilium"
  - "inspect hubble network flows"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Cilium Network Policies & L7 DNS/HTTP Filtering

Authors CiliumNetworkPolicy (CNP): restricting egress to specific FQDN domains (e.g. *.s3.amazonaws.com), enforcing HTTP method/path allowlists, blocking unapproved egress ports, and inspecting Hubble flows.

## When to Invoke
Invoke this skill whenever you need to:
- write ciliumnetworkpolicy l7
- restrict pod egress fqdn cilium
- inspect hubble network flows

## Execution SOP & Rules
1. Define apiVersion: cilium.io/v2, kind: CiliumNetworkPolicy.
2. Configure egress rules with toFQDNs: [{ matchPattern: '*.stripe.com' }] and toPorts: [{ port: '443' }].
3. Configure L7 HTTP rules with rules: { http: [{ method: 'GET', path: '/api/.*' }] }.
4. Monitor traffic flows and policy verdicts: hubble observe --follow --verdict DROPPED.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.