Claude Code for Calico Network Policy Workflow

Calico is one of the most popular container networking and security solutions for Kubernetes, providing fine-grained network policies that control traffic flow between pods, services, and external endpoints. Managing Calico network policies effectively requires understanding both Kubernetes networking concepts and Calico’s specific CRDs (Custom Resource Definitions). In this guide, we’ll explore how Claude Code can accelerate your Calico network policy workflow, from initial policy design to testing and maintenance.

Understanding Calico Network Policies

Before diving into the Claude Code workflow, it’s essential to understand what Calico brings to the table. Calico extends Kubernetes NetworkPolicy with additional features like:

Tiered policies: Organization into hierarchical tiers (default, security, network)
Global network policies: Apply across namespaces
Host endpoints: Control traffic to/from nodes
Service account matching: Fine-grained controls based on service accounts
DNS policies: Domain-based traffic filtering

Calico policies use its own GlobalNetworkPolicy and NetworkPolicy resources, which provide more capabilities than standard Kubernetes NetworkPolicies.

Setting Up Your Claude Code Environment

To work with Calico network policies, ensure Claude Code has access to your Kubernetes configuration:

# Verify kubectl access
kubectl cluster-info

# Check Calico operator status
kubectl get tigerastatus

Create a .claude/settings.local.md file to configure your Kubernetes context:

# Kubernetes Context
- Use context: production-cluster
- Default namespace: networking
- Kubeconfig: ~/.kube/config

Generating Calico Network Policies

One of the most powerful Claude Code capabilities is generating Kubernetes manifests from natural language descriptions. Here’s how to create a comprehensive Calico network policy:

Request Claude Code to Generate a Policy

Provide detailed specifications including:

Source and destination workloads
Allowed ports and protocols
Action (allow or deny)
Namespace constraints
Selector criteria

Example prompt to Claude Code:

Create a Calico GlobalNetworkPolicy that allows traffic from the frontend namespace to the backend namespace on ports 80 and 443. Also add a rule that denies all other ingress traffic to the backend namespace except from the ingress controller.

Claude Code will generate a manifest similar to:

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: frontend-to-backend-access
spec:
  tier: security
  selector: 'namespace() == "backend"'
  ingress:
    - action: Allow
      protocol: TCP
      source:
        namespaceSelector: 'name == "frontend"'
      destination:
        ports:
          - '80'
          - '443'
    - action: Deny
      source:
        notSelector: 'has(ingress-noise)'
  egress:
    - action: Allow
---
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: backend-deny-ingress
  namespace: backend
spec:
  selector: app == 'backend'
  types:
    - Ingress
  ingress:
    - action: Allow
      source:
        serviceAccounts:
          selector: name == 'ingress-controller'

Policy Validation and Best Practices

Claude Code can analyze your policies for common issues:

过于宽泛的选择器: Overly permissive selectors that match unintended pods
缺少 egress 规则: Missing egress rules causing connectivity issues
策略顺序错误: Incorrect policy tier ordering
DNS 放行: Missing DNS egress rules causing name resolution failures

Ask Claude Code to audit your policies:

Review these Calico network policies and identify any security concerns or misconfigurations. Check for overly permissive rules, missing egress policies, and potential connectivity issues.

Automating Policy Testing

Testing Calico policies manually can be time-consuming. Claude Code can help automate verification:

Generating Test Scenarios

Request test cases for your policies:

Generate Kubernetes test pods for the frontend-to-backend-access policy. Include a test client in the frontend namespace and test servers in both frontend and backend namespaces. Include tests for allowed traffic (port 80, 443) and denied traffic (other ports).

Claude Code will generate deployment manifests:

apiVersion: v1
kind: Pod
metadata:
  name: test-client-frontend
  namespace: frontend
  labels:
    app: test-client
spec:
  containers:
    - name: client
      image: curlimages/curl:latest
      command: ['sleep', 'infinity']
---
apiVersion: v1
kind: Pod
metadata:
  name: test-server-backend
  namespace: backend
  labels:
    app: test-server
spec:
  containers:
    - name: server
      image: nginx:latest
      ports:
        - containerPort: 80
          name: http
        - containerPort: 443
          name: https
        - containerPort: 8080
          name: admin

Network Connectivity Verification

After deploying test workloads, use Claude Code to guide verification:

Create a bash script that tests connectivity from the frontend test client to the backend test server on all three ports (80, 443, 8080). The script should verify that 80 and 443 succeed while 8080 is denied.

#!/bin/bash
# Test allowed ports
for port in 80 443; do
  echo "Testing port $port..."
  kubectl exec -n frontend test-client-frontend -- \
    curl -s -o /dev/null -w "%{http_code}" \
    http://test-server-backend.backend.svc.cluster.local:$port
done

# Test denied port
echo "Testing denied port 8080..."
kubectl exec -n frontend test-client-frontend -- \
  curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 \
  http://test-server-backend.backend.svc.cluster.local:8080 || echo "Connection refused (expected)"

Policy Migration and Conversion

If you’re migrating from standard Kubernetes NetworkPolicies to Calico policies, Claude Code can assist:

Converting Kubernetes NetworkPolicy to Calico

Convert this Kubernetes NetworkPolicy to a Calico GlobalNetworkPolicy with the same semantics but additional Calico features like tiering and logging.

Claude Code will convert and enhance:

# Original Kubernetes NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

Becomes:

# Enhanced Calico GlobalNetworkPolicy
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: production.api-allow
spec:
  tier: security
  selector: 'app == "api" && namespace() == "production"'
  ingress:
    - action: Allow
      protocol: TCP
      destination:
        ports:
          - '8080'
      source:
        selector: 'app == "frontend" && namespace() == "production"'
  doNotTrack: false
  applyOnForward: true

Managing Policy at Scale

For large Kubernetes deployments, managing many Calico policies becomes complex. Claude Code can help organize and document:

Generating Policy Documentation

Generate a markdown document that documents all Calico network policies in the production namespace. Include policy name, purpose, source/destination workloads, allowed ports, and any dependencies.

Claude Code will parse your policies and create comprehensive documentation.

Policy Backup and Versioning

Implement a workflow for policy backup:

# Backup all Calico policies
kubectl get globalnetworkpolicies -o yaml > calico-gnp-backup.yaml
kubectl get networkpolicies --all-namespaces -o yaml > calico-np-backup.yaml

Ask Claude Code to create a GitOps workflow for managing Calico policies alongside your application code.

Actionable Best Practices

Based on common patterns and pitfalls, here are actionable recommendations:

Start with deny-all policies: Begin with restrictive policies and incrementally add allow rules
Use tiers effectively: Organize policies into security tiers (default, security, network)
Test in staging first: Always validate policies in non-production environments
Monitor denied traffic: Enable Calico flow logs to identify blocked traffic patterns
Document policy intent: Add annotations explaining the purpose of each policy
Automate policy reviews: Use Claude Code to regularly audit policies for drift

Conclusion

Claude Code significantly streamlines the Calico network policy workflow by generating manifests, validating configurations, creating test scenarios, and assisting with policy documentation. By integrating Claude Code into your Kubernetes networking workflow, you can reduce manual errors, accelerate policy development, and maintain robust security posture.

Remember to always test policies in non-production environments before deploying to production, and use Calico’s logging and visibility features to understand the impact of your policies in real-time.

Built by theluckystrike — More at zovo.one