Analyze Kubernetes NetworkPolicy configurations for pods in a cluster. The npa crate provides an
Analyzer that resolves allowed ingress/egress traffic into CIDR/port/protocol rules. The
npa-cli binary wraps the same logic for quick inspection from the command line.
Implementation is not fully tested so bugs are to be expected.
cargo install --path npa-cli/
❯ npa pod prometheus --namespace=montoring
+-----------+------------------------+--------------------------------------+
| DIRECTION | TRAFFIC | POD |
+-----------+------------------------+--------------------------------------+
| INGRESS | 0.0.0.0/0:*/ANY | DEFAULT/IPBLOCK |
| | ::/0:*/ANY | DEFAULT/IPBLOCK |
+-----------+------------------------+--------------------------------------+
| EGRESS | 10.244.2.144/32:53/TCP | kube-system/coredns-6b4c956686-mmvwv |
| | 10.244.2.144/32:53/UDP | kube-system/coredns-6b4c956686-mmvwv |
| | 10.244.1.228/32:53/TCP | kube-system/coredns-6b4c956686-w9czp |
| | 10.244.1.228/32:53/UDP | kube-system/coredns-6b4c956686-w9czp |
+-----------+------------------------+--------------------------------------+ npa netpol selects metrics
+--------------------+
| POD |
+--------------------+
| ns-test/prometheus |
+--------------------+
❯ npa netpol ingress metrics
+-----------+------+---------------+
| NAMESPACE | PODS | PORT/PROTOCOL |
+-----------+------+---------------+
| NONE | NONE | NONE |
+-----------+------+---------------+
❯ npa netpol egress metrics
+-------------+--------------------------+----------------+
| NAMESPACE | PODS | PORT/PROTOCOL |
+-------------+--------------------------+----------------+
| kube-system | coredns-6b4c956686-mmvwv | 53/TCP, 53/UDP |
| | coredns-6b4c956686-w9czp | 53/TCP, 53/UDP |
+-------------+--------------------------+----------------+
| ns-test | backend | 9090/TCP |
| | frontend | 9091/TCP |
| | prometheus | 9092/TCP |
+-------------+--------------------------+----------------+