Kubernetes Network and Identity Policy

When to use

Invoke when establishing the network and identity posture for a workload or namespace, restructuring east-west segmentation, or auditing/hardening NetworkPolicy, RBAC, ingress exposure, and Pod Security Standards before a workload reaches a shared cluster.

Do not use for: Deployment/Service/HPA manifest authoring (use k8s-workload-packaging-and-manifest); autoscaling, PDB sizing, anti-affinity (use k8s-scaling-and-resilience-topology); metrics/log/trace wiring (use k8s-observability-and-operations-readiness); image hardening, signing, SBOM, and the admission-controller policy engine itself (use k8s-supply-chain-and-image-hardening); cluster provisioning, CNI installation, control-plane topology (out of Family G — owned by the cloud platform stack and Terraform).

Inputs

Required:

• A workload manifest set from k8s-workload-packaging-and-manifest (the ServiceAccount reference and Service this skill backs with policy).
• Approved architecture/security decisions on trust zones, identity model, and east-west posture, or explicit confirmation they are intentionally deferred.

Optional: