A guide to this Kubernetes network: Gateway API routes, Envoy gateways, DNS records, load-balancer addresses, BGP, and network policies. DNS is the system that maps hostnames to network addresses.

Use it when adding or editing HTTP routes, gateways, DNS automation, load-balancer or BGP settings, network policies, or when a hostname is unreachable or resolves incorrectly.

It prevents routes from publishing the wrong DNS target, unmanaged records from being changed unexpectedly, and network policies from allowing or blocking the wrong traffic.

How Aviator-Coding/home-ops configures Claude Code and Codex

Reuse

Borrowing it

Nothing to install: this file belongs to Aviator-Coding/home-ops. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/Aviator-Coding/home-ops/main/.agents/skills/networking/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/Aviator-Coding/home-ops

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/aviator-coding/home-ops/networking/github.svg)](https://agentmods.dev/skills/aviator-coding/home-ops/networking)

Your own site

<a href="https://agentmods.dev/skills/aviator-coding/home-ops/networking"><img src="https://agentmods.dev/badge/skills/aviator-coding/home-ops/networking/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/aviator-coding/home-ops/networking"><img src="https://agentmods.dev/badge/skills/aviator-coding/home-ops/networking.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 86 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,318 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00086	$0.01318
Opus 5.5	$0.00034	$0.00527
Sonnet 5.5	$0.00017	$0.00264
Haiku 4.5	$0.00009	$0.00132

Measured 23d ago against content hash ba75997080cb, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

networking scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`curl -H 'Accept: application/external.dns.webhook+json;version=1' localhost:8888/records`.

.agents/skills/networking/SKILL.md · 83 lines

How it starts

The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Networking: Gateway API, DNS, BGP and NetworkPolicy

Cilium is the CNI: BGP LoadBalancer, kube-proxy replacement, no L2 announcements. Gateways are Envoy Gateway (gatewayClassName: envoy) for envoy-internal / envoy-external, and agentgateway for its own listeners. Host firewall policy is skill cilium-host-policy. ExtAuth ownership is skill authentik-terraform.

Tripwires

The DNS target comes from the parent Gateway. For the gateway-httproute source, external-dns.alpha.kubernetes.io/target on the HTTPRoute does not decide the record. A route on both envoy gateways yields both targets, and the UniFi webhook keeps the first. Route-level targets that match their Gateway are documentation.
A record with no TXT twin is hand-made. Every record network/unifi-dns manages has a k8s.main.<type>-<name>.${SECRET_DOMAIN} TXT twin. external-dns will not update or delete a record that lacks one. The LAN wildcard *.${SECRET_DOMAIN} -> 10.50.0.27 is hand-made, which is why unclaimed names hit the AI gateway. dns-ownership.md
A NetworkPolicy ports: entry matches the destination port on the protected pod. A DNS reply arrives on the querier's ephemeral port, never 53, so port: 53 cannot admit it. Drop the ports: restriction on the from-kube-dns rule. Source-port filtering is not expressible in networking.k8s.io/v1.
Chart-owned policies get a supplemental NetworkPolicy, same podSelector. NetworkPolicies on the same pod OR-combine. Do not disable the chart policy. Shared dragonfly policy: kubernetes/components/dragonfly/networkpolicy.yaml.
Envoy controller resources live under deployment.envoyGateway. A resources: block under config.envoyGateway is the config-file schema and is silently ignored. envoy-gateway.md
Restart Envoy after a GatewayNamespaceMode outage before calling it healthy. Stale proxy SA tokens storm xDS auth. The controller's exit-137 was that storm, not an OOM.
nslookup needs a trailing dot on a name you do not want search appended. Alpine busybox nslookup does not apply resolv.conf search to short names (NXDOMAIN). musl and glibc getent hosts do. Pods use nameserver 10.43.0.10 and ndots:5.
LoadBalancer IPs are pinned with lbipam.cilium.io/ips. The pool is 10.50.0.0/24. internal-noauth stays ClusterIP. Do not put it back on the pool. bgp-unifi.md
Every browser terminal is behind Authentik SSO. hermes-code and hass-code run code-server with --auth none, so the SecurityPolicy (hermes-code-auth, hass-code-auth) is the only gate on the route. A new code-server route needs one in the same change. The Service port stays open to in-cluster callers, so this is an outer layer only.
Host-endpoint Cilium policy (default-deny, selector labels, msgr ports) is skill cilium-host-policy. The manifests live next to the CNI. Do not edit that skill from a networking change.

Read the full file on GitHub · 83 lines

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

23d ago Changed · +6 lines ba75997080cb
25d ago First seen · 77 lines · 86 tokens per session scan A f3d1f780e27f

Subscribe to this mod's changes

networking is a skill published in the GitHub repository Aviator-Coding/home-ops (3 stars, last pushed today), licensed MIT. It adds 86 tokens to every session and 1,318 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-29.

Backend and APIs Cloud DevOps and cloud

stripe-projects

Provision SaaS services + sync creds via Stripe Projects.

NousResearch/hermes-agent · 15 tokens

django-storages-s3

Use when configuring Django to store static and media files on AWS S3 with django-storages. Invoke when working with the STORAGES setting, S3 buckets, presigned URLs, CloudFront, or boto3-backed file storage in settings.py. Configures the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST…

Jeffallan/claude-skills · 138 tokens

websocket-engineer

Use when building real-time communication systems with WebSockets or Socket.IO. Invoke for bidirectional messaging, horizontal scaling with Redis, presence tracking, room management.

Jeffallan/claude-skills · 36 tokens

azure-eventhub-dotnet

Azure Event Hubs SDK for .NET. Use for high-throughput event streaming: sending events (EventHubProducerClient, EventHubBufferedProducerClient), receiving events (EventProcessorClient with checkpointing), partition management, and real-time data ingestion. Triggers: "Event Hubs", "event streaming"…

microsoft/skills · 94 tokens

azure-mgmt-botservice-dotnet

Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".

microsoft/skills · 78 tokens

aws-blocks

Guides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework. Applies when creating APIs, selecting Building Blocks (KVStore, DistributedTable, Database, AuthBasic, AuthCognito, Realtime, AsyncJob, FileBucket, etc.), running local development, or deploying AWS Blocks applications.…

aws/agent-toolkit-for-aws · 105 tokens

home-ops: Skill for Claude Code