feat(ocp-admin): add network-policy-architect skill

ocp-admin/.catalog/collection.json

@@ -13,7 +13,7 @@
     "Vulnerability Management"
   ],
   "contents": {
-    "description": "The pack provides seven skills for cluster lifecycle, fleet visibility, and security validation on OpenShift,\nusing Assisted Installer and OCM APIs for cluster management, read-only cluster APIs for consolidated reports,\nand Python helper scripts for CVE/SBOM/VEX-based security validation.\n",
+    "description": "The pack provides eight skills for cluster lifecycle, fleet visibility, security validation, and network\nsecurity on OpenShift, using Assisted Installer and OCM APIs for cluster management, read-only cluster APIs\nfor consolidated reports, Python helper scripts for CVE/SBOM/VEX-based security validation, and MCP-based\nNetworkPolicy design with live cluster verification.\n",
     "orchestration_skills": [],
     "skills": [
       {
@@ -50,6 +50,11 @@
         "description": "Container image metadata inspection with SBOM reference and registry ownership validation.",
         "name": "image-inspect",
         "summary_markdown": "Fetch image labels, validate registry ownership, resolve tag/digest via SBOM.\n**Use when:**\n- \"Inspect this container image\"\n- \"What SBOM does this image have?\"\n**What it does:**\n- Extracts labels, validates ownership, resolves SBOM artifact OCI reference.\n"
+      },
+      {
+        "description": "Zero Trust NetworkPolicy design and live cluster verification following NIST SP 800-207.",
+        "name": "network-policy-architect",
+        "summary_markdown": "Two-tier NetworkPolicy architecture analysis and live cluster verification for Kubernetes workloads.\n**Use when:**\n- \"Create NetworkPolicies for my namespace\"\n- \"Audit network isolation for this workload\"\n- \"Design network segmentation following Zero Trust\"\n**What it does:**\n- Tier 1: Maps pod types, services, communication flows, and special networking cases from source and manifests.\n- Tier 2: Validates draft rules against a running cluster via MCP tools with temporary apply-and-verify.\n- Produces verified implementation plan with default-deny, per-pod rules, and NIST alignment.\n"
       }
     ],
     "skills_decision_guide": [
@@ -87,6 +92,11 @@
         "reason": "Fetches image labels, registry ownership, and SBOM artifact reference.",
         "skill_to_use": "image-inspect",
         "user_request": "\"Inspect this container image\" or \"What SBOM does this image have?\""
+      },
+      {
+        "reason": "Two-tier Zero Trust NetworkPolicy design with architecture analysis and live cluster verification.",
+        "skill_to_use": "network-policy-architect",
+        "user_request": "\"Create NetworkPolicies\" or \"Audit network isolation\" or \"Design network segmentation\""
       }
     ]
   },
@@ -105,7 +115,10 @@
     "vex",
     "security",
     "vulnerability",
-    "coreos"
+    "coreos",
+    "networkpolicy",
+    "zero-trust",
+    "microsegmentation"
   ],
   "legal_resources": {
     "license_agreement_url": "https://github.com/RHEcosystemAppEng/agentic-plugins/blob/main/LICENSE",
@@ -173,6 +186,10 @@
     {
       "name": "CoreOS vulnerability check",
       "workflow": "User: \"Does CVE-2025-61726 affect CoreOS in OCP 4.20.16?\"\n- `/coreos-cve-validator` extracts RPMs, finds affected package, checks VEX under OCP and RHEL EUS CPEs\n"
+    },
+    {
+      "name": "Zero Trust NetworkPolicy design",
+      "workflow": "User: \"Create NetworkPolicies for the qtodo namespace following Zero Trust\"\n- `/network-policy-architect` maps communication flows, drafts per-pod rules, verifies on live cluster with temporary apply-and-verify\n"
     }
   ],
   "summary": "The ocp-admin collection covers Assisted Installer cluster creation, multi-cluster discovery across self-managed and managed\nOpenShift, kubeconfig-backed fleet health reporting, and security validation for Red Hat container images and CoreOS using\nofficial SBOMs and VEX data. Use AGENTS.md intent routing to pick the right skill.\n",

ocp-admin/.catalog/collection.yaml

@@ -31,9 +31,10 @@ summary: |
   official SBOMs and VEX data. Use AGENTS.md intent routing to pick the right skill.
 contents:
   description: |
-    The pack provides seven skills for cluster lifecycle, fleet visibility, and security validation on OpenShift,
-    using Assisted Installer and OCM APIs for cluster management, read-only cluster APIs for consolidated reports,
-    and Python helper scripts for CVE/SBOM/VEX-based security validation.
+    The pack provides eight skills for cluster lifecycle, fleet visibility, security validation, and network
+    security on OpenShift, using Assisted Installer and OCM APIs for cluster management, read-only cluster APIs
+    for consolidated reports, Python helper scripts for CVE/SBOM/VEX-based security validation, and MCP-based
+    NetworkPolicy design with live cluster verification.
   skills:
   - name: cluster-creator
     description: End-to-end OpenShift cluster creation using Red Hat Assisted Installer (SNO and HA; bare metal, vSphere, OCI, Nutanix).
@@ -106,6 +107,18 @@ contents:
       - "What SBOM does this image have?"
       **What it does:**
       - Extracts labels, validates ownership, resolves SBOM artifact OCI reference.
+  - name: network-policy-architect
+    description: Zero Trust NetworkPolicy design and live cluster verification following NIST SP 800-207.
+    summary_markdown: |
+      Two-tier NetworkPolicy architecture analysis and live cluster verification for Kubernetes workloads.
+      **Use when:**
+      - "Create NetworkPolicies for my namespace"
+      - "Audit network isolation for this workload"
+      - "Design network segmentation following Zero Trust"
+      **What it does:**
+      - Tier 1: Maps pod types, services, communication flows, and special networking cases from source and manifests.
+      - Tier 2: Validates draft rules against a running cluster via MCP tools with temporary apply-and-verify.
+      - Produces verified implementation plan with default-deny, per-pod rules, and NIST alignment.
   orchestration_skills: []
   skills_decision_guide:
   - user_request: '"Create cluster" or "install OpenShift with Assisted Installer"'
@@ -129,6 +142,9 @@ contents:
   - user_request: '"Inspect this container image" or "What SBOM does this image have?"'
     skill_to_use: image-inspect
     reason: Fetches image labels, registry ownership, and SBOM artifact reference.
+  - user_request: '"Create NetworkPolicies" or "Audit network isolation" or "Design network segmentation"'
+    skill_to_use: network-policy-architect
+    reason: Two-tier Zero Trust NetworkPolicy design with architecture analysis and live cluster verification.
 mcp_section: '#mcp_section.md'
 deploy_and_use: '#deploy_and_use.md'
 sample_workflows:
@@ -153,6 +169,10 @@ sample_workflows:
   workflow: |
     User: "Does CVE-2025-61726 affect CoreOS in OCP 4.20.16?"
     - `/coreos-cve-validator` extracts RPMs, finds affected package, checks VEX under OCP and RHEL EUS CPEs
+- name: Zero Trust NetworkPolicy design
+  workflow: |
+    User: "Create NetworkPolicies for the qtodo namespace following Zero Trust"
+    - `/network-policy-architect` maps communication flows, drafts per-pod rules, verifies on live cluster with temporary apply-and-verify
 resources:
 - title: OpenShift documentation
   url: https://docs.redhat.com/en/documentation/openshift_container_platform/
@@ -190,3 +210,6 @@ keywords:
 - security
 - vulnerability
 - coreos
+- networkpolicy
+- zero-trust
+- microsegmentation

ocp-admin/AGENTS.md

@@ -1,6 +1,6 @@
 # ocp-admin Plugin
 
-You are an OpenShift administrator and security assistant. You help users create OpenShift clusters using Red Hat Assisted Installer, manage multi-cluster fleets, monitor cluster health across self-managed (OCP, SNO) and managed service (ROSA, ARO, OSD) deployments, and validate CVEs against Red Hat container images and OpenShift CoreOS using official SBOMs and VEX data.
+You are an OpenShift administrator and security assistant. You help users create OpenShift clusters using Red Hat Assisted Installer, manage multi-cluster fleets, monitor cluster health across self-managed (OCP, SNO) and managed service (ROSA, ARO, OSD) deployments, validate CVEs against Red Hat container images and OpenShift CoreOS using official SBOMs and VEX data, and design Zero Trust NetworkPolicies for Kubernetes workloads.
 
 ## Skill-First Rule
 
@@ -21,6 +21,7 @@ Match the user's request to the correct skill:
 | Validate a CVE against CoreOS/RHCOS in a specific OCP version | `/coreos-cve-validator` |
 | Look up CVE details, affected packages, version ranges, ecosystem info | `/cve-recon` |
 | Inspect container image metadata, labels, SBOM reference, registry ownership | `/image-inspect` |
+| Create NetworkPolicies, audit network isolation, design network segmentation, verify Zero Trust, default-deny | `/network-policy-architect` |
 
 If the request doesn't clearly match one skill, ask the user to clarify.
 
@@ -33,6 +34,7 @@ Some workflows require multiple skills in sequence:
 - **Container image metadata audit then CVE validation**: `/image-inspect` (check metadata and SBOM) → `/container-cve-validator` (validate specific CVE)
 - **CVE research then validate**: `/cve-recon` (look up CVE details) → `/container-cve-validator` or `/coreos-cve-validator` (validate against specific image or OCP version)
 - **CoreOS security check**: `/coreos-cve-validator` (validate CVE against OCP release) — uses `oc` and `podman` for CoreOS RPM extraction
+- **Network security hardening**: `/network-policy-architect` (design and verify NetworkPolicies) → `/cluster-report` (verify cluster health post-policy)
 
 After completing a skill, suggest relevant next-step skills to the user.
 
@@ -42,7 +44,7 @@ Three MCP servers may be available in local runtimes. Skills manage these automa
 
 - **openshift-self-managed** (Required for cluster-creator, cluster-inventory) — Assisted Installer API for self-managed cluster lifecycle (OCP, SNO). Requires OFFLINE_TOKEN from https://cloud.redhat.com/openshift/token.
 - **openshift-ocm-managed** (Required for cluster-inventory) — OpenShift Cluster Manager API for managed service clusters (ROSA, ARO, OSD). Requires OFFLINE_TOKEN.
-- **openshift-administration** (Required for cluster-report) — Kubernetes/OpenShift cluster operations for multi-cluster management. Requires KUBECONFIG with cluster access. Read-only mode enforced.
+- **openshift-administration** (Required for cluster-report, network-policy-architect) — Kubernetes/OpenShift cluster operations for multi-cluster management. Requires KUBECONFIG with cluster access. Read-only for cluster-report; read-write for network-policy-architect (temporary policy application during verification).
 
 ## Helper Scripts (Security Validation)
 

ocp-admin/README.md

@@ -14,6 +14,7 @@ The ocp-admin collection provides specialized tools for managing OpenShift clust
 - **Complete cluster lifecycle**: Creation, configuration, monitoring, and operations
 - **Multi-cluster management**: Consolidated reporting across multiple clusters
 - **Assisted Installer integration**: Automated cluster deployment with validation
+- **Network security**: Zero Trust NetworkPolicy design with live cluster verification
 - **Comprehensive documentation**: 17 reference documents covering all aspects of OpenShift administration
 
 ---
@@ -416,6 +417,24 @@ Fetch container image labels, validate registry ownership, resolve tag/digest vi
 - Reports SBOM artifact OCI reference and fetch command
 - Output formats: markdown, JSON, CSV
 
+### 8. **network-policy-architect** - Zero Trust NetworkPolicy Design
+
+Design and validate Kubernetes NetworkPolicies following Zero Trust principles (NIST SP 800-207). Two-tier analysis — architecture review then live cluster verification — produces a verified implementation plan with dry-run results.
+
+**Use when**:
+- "Create NetworkPolicies for my namespace"
+- "Audit network isolation for this workload"
+- "Design network segmentation for a new application"
+- "Verify NetworkPolicies implement Zero Trust"
+
+**MCP Server**: `openshift-administration` (OpenShift MCP Server)
+
+**What it does**:
+- **Tier 1 (Architecture Analysis)**: Maps all pod types, services, communication flows, and special networking cases (hostNetwork, OVN-K, DNS on 5353) from source code and manifests
+- **Tier 2 (Live Cluster Verification)**: Validates draft rules against a running cluster using MCP tools — verifies pod labels, services, existing policies, and performs temporary apply-and-verify with health checks
+- Produces implementation plan with default-deny, per-pod rules, exceptions, verification results, and NIST SP 800-207 alignment
+- Requires human confirmation before applying or removing verification policies
+
 ---
 
 ## Multi-Cluster Authentication
@@ -627,7 +646,21 @@ User: "Does CVE-2025-61726 affect CoreOS in OCP 4.20.16?"
 Result: CoreOS-specific vulnerability assessment with RHEL EUS stream awareness
 ```
 
-### Workflow 6: Check Cluster Installation Progress
+### Workflow 6: Network Policy Design for Zero Trust
+
+```
+User: "Create NetworkPolicies for the qtodo namespace following Zero Trust"
+→ network-policy-architect skill:
+  - Tier 1: Analyzes source code and Helm charts for pod types, services, flows
+  - Drafts per-pod ingress/egress rules with justifications
+  - Tier 2: Verifies pod labels, services, existing policies via MCP
+  - Applies policies as dry-run, verifies health, cleans up
+  - Produces implementation plan with NIST SP 800-207 alignment
+
+Result: Verified NetworkPolicy set with default-deny and per-pod rules
+```
+
+### Workflow 7: Check Cluster Installation Progress
 
 ```
 User: "What's the status of my cluster installation?"
@@ -770,7 +803,8 @@ ocp-admin/
 │   │       └── 02-report-template.md
 │   ├── coreos-cve-validator/SKILL.md # CoreOS CVE validation
 │   ├── cve-recon/SKILL.md            # CVE reconnaissance
-│   └── image-inspect/SKILL.md        # Container image metadata inspection
+│   ├── image-inspect/SKILL.md        # Container image metadata inspection
+│   └── network-policy-architect/SKILL.md  # Zero Trust NetworkPolicy design
 └── scripts/
     ├── cluster-report/
     │   ├── build-kubeconfig.py       # Multi-cluster authentication