feat(ocp-admin): add network-policy-architect skill

[p-rog]

Summary

Adds a new network-policy-architect skill to the ocp-admin pack for designing and validating Kubernetes NetworkPolicies following Zero Trust principles (NIST SP 800-207).

Rationale

NetworkPolicy is the primary application-level microsegmentation mechanism in Kubernetes, yet designing correct policies is error-prone and rarely verified against live clusters. Common pitfalls include:

• Missing default-deny (pods with no matching policy have unrestricted network access)
• Incorrect selectors that silently fail to match (especially after label changes)
• OVN-Kubernetes-specific behaviors (DNS on port 5353, not 53; hostNetwork pods exempt from policies; OCP router ingress via policy-group labels)
• Helm template boolean coercion issues ("true" vs true) causing policies to silently not render
• Operator-managed policies being accidentally duplicated or overridden

This skill addresses these gaps with a structured two-tier workflow — architecture analysis followed by live cluster verification — that produces a verified implementation plan, not just untested YAML.

The skill was developed alongside an article on OCP/Kubernetes network policy best practices ("Closing the Loop: From Network Policy Intent to Verified Reality") and incorporates real-world lessons learned from the Layered Zero Trust Validated Pattern (article is not published yet).

What's included

New file

• ocp-admin/skills/network-policy-architect/SKILL.md — full skill definition (450 lines)

Updated files

• ocp-admin/AGENTS.md — intent routing entry + skill chaining + MCP server reference
• ocp-admin/README.md — skill section (Rh developer/troubleshooting #8), sample workflow, architecture tree
• ocp-admin/.catalog/collection.yaml — skill entry, decision guide, sample workflow, keywords
• ocp-admin/.catalog/collection.json — mirror of YAML catalog changes

Skill design

Two-tier workflow

• Tier 1 (Architecture Analysis) — offline analysis of source code, Helm charts, and deployment manifests to map pod types, services, communication flows, and special networking cases (hostNetwork, operator-managed policies, OVN-K specifics)
• Tier 2 (Live Cluster Verification) — validates draft rules against a running cluster using MCP tools: verifies pod labels, services, existing policies, applies policies as dry-run, checks pod health and logs, then cleans up

MCP-first approach

All cluster operations use openshift-administration MCP server tools (pods_list, resources_list, resources_get, resources_create_or_update, resources_delete, pods_log). No raw oc or kubectl CLI commands. This addresses the oc CLI availability issue previously identified in MGMT-24450.

Human-in-the-loop

Explicit user confirmation required before:

• Applying dry-run NetworkPolicies to the cluster
• Deleting dry-run policies after verification
• Accepting a deviation from default-deny (with NIST SP 800-207 acknowledgment)

Key domain knowledge encoded

• OVN-Kubernetes DNS on port 5353 (not 53), target namespace openshift-dns
• OCP router ingress via policy-group.network.openshift.io/ingress namespace label
• K8s API server endpoints are node IPs after DNAT — requires port-only rules
• hostNetwork pods are exempt from NetworkPolicies
• Helm | toString for boolean conditions in extraValueFiles pattern frameworks
• Operator-managed NetworkPolicies (e.g., RHBK keycloak-network-policy) must not be duplicated

Validation results

Check	Result
Tier 1 (agentskills.io spec)	PASS
Tier 2 (design principles)	PASS (1 warning — section ordering, same as existing skills)
Structure validation	PASS
Doc links	PASS
Docs tree links	PASS
Collection compliance	PASS
MCP tool references	PASS
cisco-ai-skill-scanner (static + behavioral + overlap)	SAFE — 0 findings

Test plan

• make validate passes (full suite: Tier 1 + Tier 2 + structure + compliance + MCP tools)
• validate_skill_doc_links.py — 0 errors
• validate_docs_tree_links.py — 0 errors
• validate_structure.py — all 7 packs pass
• skill-scanner scan-all (static + behavioral + overlap) — SAFE, 0 findings
• Invoke skill locally in Cursor/Claude Code against a live cluster with NetworkPolicy workload

Made with Cursor