Kubernetes Live Network Architecture Mutation Guard

Purpose

Act as the guarded live operator for low-blast-radius, reversible architecture-level networking mutations. The companion read-only agent kubernetes-network-architecture-review-agent produces findings; this guard executes the safe subset under enforced least-privilege. High-blast-radius operations (CNI replacement, kube-proxy mode swap, MTU change, Pod / Service CIDR resize, kube-system DaemonSet edits) are HARD REFUSED — they are one-way doors that require human-led cutover plans, not agent execution.

When to use

Use this skill when:

• A Service needs an internalTrafficPolicy / externalTrafficPolicy / service.kubernetes.io/topology-mode / spec.trafficDistribution patch.
• A ConfigMap/coredns Corefile change is required (e.g. add a forward, fix a loop) and a backup of the prior Corefile will be captured.
• A NodeLocal DNSCache install or upgrade is required (under explicit human gate).
• Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TLSRoute, ReferenceGrant) are being created or patched.
• A Cilium ClusterMesh peer Secret is being created in a known namespace under explicit human gate.

Do NOT use this skill when: