Cilium Network Policy Checklist from Cluster Notes (No Invented Alert Flow Totals)

Prompt

Act as a Cilium network policy engineer who only uses pasted cluster notes. You compile a network-policy checklist the notes already support. You do not invent alert totals, flow totals, node counts, or CVE severity scores. This is not a live ciliumctl apply run and not a compliance auditor certificate.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Cluster notes I lock (policy stubs, selector cues, port cues): [ClusterNotes]
- Cilium version or chart notes I lock: [Version]
- Cluster or namespace label I may quote (or UNKNOWN): [ClusterLabel]
- Policy names already present (or UNKNOWN): [PolicyNames]
- Endpoint selector cues already present (or UNKNOWN): [SelectorCues]
- Port or L7 cues already present (or UNKNOWN): [PortCues]
- Deny or allow cues already present (or UNKNOWN): [AllowDenyCues]
- Words I must not use: [Banned]
- What I must never invent (alert totals, flow totals, node counts, CVE severity scores): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: ClusterNotes nouns, Version, ClusterLabel, PolicyNames, SelectorCues, PortCues, AllowDenyCues, Lang. Forbidden: invented alert totals, flow totals, node counts, CVE severity scores.
2. Network-policy checklist: one checkbox row per PolicyNames entry. Attach only SelectorCues named beside that policy in ClusterNotes. Missing selector write NOT IN INPUTS.
3. Port cue sketch: for each PortCues entry, list policies that name it. Do not invent a 38-alert total if absent.
4. Allow/deny caution block: quote AllowDenyCues only. Default-deny packs not in ClusterNotes stay NOT IN INPUTS.
5. Refuse list: inventing 38 alert totals, inventing 12k flow totals, inventing 72 node counts, inventing CVE severity score 9.8.
6. Compliance pass: quote Banned and Never hits. Cut them. Print policy and selector counts from ClusterNotes only. Format as Format.

Constraints:
- Network-policy checklist from ClusterNotes only. No invented alert or flow totals.
- Honor Version. No emojis. Not a live Hubble console.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

Cilium Network Policy Checklist from Cluster Notes (No Invented Alert Flow Totals) - Result

Examples

Example Input

ClusterNotes: policy Harbor Ingress Allow as pasted selector app=harbor as pasted; policy Quay Egress Deny as pasted selector app=quay as pasted. Alert invent NONE. Flow invent NONE.
Version: Cilium as pasted (do not invent unreleased AI policy coach)
ClusterLabel: Harbor Quay staging as pasted
PolicyNames: Harbor Ingress Allow as pasted; Quay Egress Deny as pasted. Privilege Esc UNKNOWN.
SelectorCues: app=harbor as pasted for Harbor Ingress Allow; app=quay as pasted for Quay Egress Deny. namespace=kube-system UNKNOWN.
PortCues: port 443/TCP as pasted for Harbor Ingress Allow; Quay Egress Deny port NOT IN INPUTS.
AllowDenyCues: allow cue Ingress as pasted for Harbor Ingress Allow. Default-deny UNKNOWN.
Banned: 38 alerts, 12k flows, 72 nodes
Never: invent alert totals, invent flow totals, invent node counts, invent CVE severity scores
Format: ledger + network-policy checklist + port sketch + allow/deny caution + refuse + compliance
Lang: English

Example Output

1. Ledger. ClusterNotes: policy Harbor Ingress Allow + selector app=harbor; policy Quay Egress Deny + selector app=quay. Alert invent NONE. Flow invent NONE. Version Cilium. ClusterLabel Harbor Quay staging. PolicyNames Harbor Ingress Allow; Quay Egress Deny. SelectorCues app=harbor; app=quay. PortCues 443/TCP for Harbor Ingress Allow; Quay Egress Deny port NOT IN INPUTS. AllowDenyCues Ingress for Harbor Ingress Allow. Default-deny UNKNOWN. Lang English. Forbidden: invented alert totals, flow totals, node counts, CVE severity scores, 38 alerts, 12k flows, 72 nodes.

2. Network-policy checklist.
[ ] Harbor Ingress Allow | selector app=harbor as pasted.
[ ] Quay Egress Deny | selector app=quay as pasted.
Privilege Esc not attached. namespace=kube-system not added.

3. Port cue sketch.
port 443/TCP | policy Harbor Ingress Allow as pasted.
Quay Egress Deny port | NOT IN INPUTS.
Alert total NOT IN INPUTS so do not invent 38 alerts. Second 443 cue not invented.

4. Allow/deny caution. Ingress as pasted for Harbor Ingress Allow. Default-deny UNKNOWN. CVE pack NOT IN INPUTS. Do not invent severity score 9.8 packs.

5. Refuse. 38 alert totals: refused. 12k flow totals: refused. 72 node counts: refused. CVE severity score 9.8: refused. Unreleased AI policy coach: refused.

6. Compliance. Banned hits none. Policies 2. Selectors 2. Format ledger+network-policy checklist+port sketch+allow/deny caution+refuse+compliance. Gaps: Quay Egress Deny port, Privilege Esc, namespace=kube-system, Default-deny, alert total.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.