💻 Coding
Kubernetes NetworkPolicy Notes from an Allowlist (No Invented CIDRs)
Write Kubernetes NetworkPolicy notes from an allowlist only. No invented CIDRs, namespaces, or ports.
0Reviews
Prompt
Act as a Kubernetes networking note-taker who only uses a pasted allowlist. You write NetworkPolicy notes the allowlist already supports. You do not invent CIDRs, namespaces, pod selectors, or ports. This is not a cluster audit and not a production apply script unless the YAML is fully sourced. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Allowlist I lock (peers, ports, direction): [Allow] - Kubernetes version I lock: [Version] - Policy name I may name (or UNKNOWN): [Name] - Words I must not use: [Banned] - What I must never invent (CIDRs, namespaces, ports, labels): [Never] - Output format: [Format] - Language: [Lang] - Namespace I may name (or UNKNOWN): [Ns] Generate: 1. Honesty ledger: Allow nouns, Version, Name, Ns, Lang. Forbidden: invented CIDRs, namespaces, ports, labels. 2. Policy sketch: podSelector and policyTypes only from Allow. Missing selectors write NOT IN INPUTS. 3. Ingress/egress rules: peers and ports from Allow only. Unknown CIDRs stay NOT IN INPUTS. 4. YAML stub: apiVersion networking.k8s.io locked to Version. Do not add extra rules. 5. Refuse list: inventing 10.0.0.0/8, inventing kube-system, inventing port 443, inventing app=web. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Notes from Allow only. No invented CIDRs. - Honor Version. No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Allow: ingress from pod label role=api as pasted; port 8080 TCP as pasted; same namespace as pasted. Egress NOT IN INPUTS. CIDR NONE. Other namespaces NONE. Version: 1.31 as pasted (do not invent 1.32) Name: allow-api-8080 Banned: 10.0.0.0/8, 0.0.0.0/0, guaranteed Never: invent CIDRs, invent namespaces, invent ports, invent labels Format: ledger + sketch + rules + yaml + refuse + compliance Lang: English Ns: UNKNOWN
Example Output
1. Ledger. Allow: ingress from pod label role=api; port 8080 TCP; same namespace. Egress NOT IN INPUTS. CIDR NONE. Other namespaces NONE. Version 1.31. Name allow-api-8080. Ns UNKNOWN. Lang English. Forbidden: invented CIDRs, namespaces, ports, labels, 10.0.0.0/8, 0.0.0.0/0, guaranteed.
2. Sketch. kind NetworkPolicy. metadata.name allow-api-8080 as pasted. metadata.namespace UNKNOWN so leave a comment NOT IN INPUTS. podSelector.matchLabels: role=api as pasted. Other labels not added. policyTypes: Ingress only (Egress NOT IN INPUTS).
3. Rules. Ingress from: podSelector matchLabels role=api as pasted. from.namespaceSelector: NONE (other namespaces NONE). from.ipBlock: NONE (CIDR NONE). Ports: 8080 TCP as pasted. UDP not added. Port 443 not added. Egress: omit section.
4. YAML stub (1.31).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-api-8080
# namespace: UNKNOWN
spec:
podSelector:
matchLabels:
role: api
policyTypes: [Ingress]
ingress:
- from:
- podSelector:
matchLabels:
role: api
ports:
- protocol: TCP
port: 8080
# ipBlock not present. kube-system not named. Version 1.32 not used.
5. Refuse. 10.0.0.0/8: refused. kube-system: refused. Port 443: refused. app=web: refused. 0.0.0.0/0: refused.
6. Compliance. Banned hits none. Format ledger+sketch+rules+yaml+refuse+compliance. Gaps: namespace name, egress, CIDR, additional labels, cluster name.
Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.