Kubernetes / networking.k8s.io/v1

Network Policies

Policies0saved locally
Namespaces0covered
Ingress0allow rules
Egress0allow rules
⌕
PolicyTargetTypesRulesLast modified
Quick start

NetworkPolicy templates

Pick a base, then adjust the selectors, peers and ports.

Local audit

Analyze and improve NetworkPolicies

Paste your NetworkPolicies — no kubeconfig or secrets needed. The analysis checks the structure, namespaces, selectors, CIDRs, ports and overly permissive rules, flags the OR-vs-AND trap and missing default-deny, and generates safe fixes without changing the intended behavior. A kubeconfig is optional, only to also audit your cluster's context and auth.

100% in the browser

1. NetworkPolicy YAML

Paste your policies (YAML or JSON). Multiple documents separated by --- are accepted, or reuse what you loaded in Cluster.

ℹA kubeconfig is not required. NetworkPolicy YAML is enough to audit your rules — no secrets needed.

2. Kubeconfig (optional)

Only to also audit your cluster context and auth (HTTPS, TLS, static tokens…). Skip it if you don't want to paste secrets.

🔒If you do paste it: the kubeconfig is never stored or sent anywhere. It holds tokens, certificates and private keys — avoid using it on a shared computer, or just leave this empty.
This HTML page makes no network connections.
Results

Errors and recommendations

Not analyzed yet
Add a kubeconfig and NetworkPolicies, then run the analysis.
Offline discovery

Pods, namespaces and existing rules

Import YAML output from kubectl. You can then open existing NetworkPolicies and click real Pod or namespace labels to build the right selectors.

Inventory kept in memory

Import the cluster inventory

Paste the YAML below, or open the files. Nothing is sent anywhere — no cluster connection, no token or kubeconfig needed.

1. Your rules — to view & edit
kubectl get networkpolicies -A -o yaml
2. Pods — for selectors & map
kubectl get pods -A -o yaml
3. Namespaces
kubectl get namespaces -o yaml
Command #1 is your existing rules — that's what you view on the Map and edit. No output there? Your cluster has no NetworkPolicies yet: create them in Templates / New policy using the imported Pods. (Calico/Cilium users: your rules live in their own CRDs, not networkpolicies.) YAML or JSON both work; command/args/volumeMounts/managedFields are stripped automatically. Lighter Pods with jq: kubectl get pods -A -o json | jq '{kind:"List",items:[.items[]|{kind:"Pod",metadata:{name:.metadata.name,namespace:.metadata.namespace,labels:.metadata.labels}}]}'
Namespaces0
Pods0
NetworkPolicies0

Cluster applications

Click a label to create a policy targeting that application.

Import the YAML files generated by kubectl.

Existing rules

No NetworkPolicy imported.
Traffic map

Who can talk to whom

A firewall-style view of your policies, grouped by namespace. Each rule shows the source, an arrow with the allowed ports, and the target Pods (by label). Load your policies in Cluster or create them in Policies; add Pods in Cluster to also see which real Pods match.

Read-only
How to use

Local app in your browser

  1. Open this index.html file in Chrome, Edge or Firefox.
  2. Create a policy, import YAML, or use the Analyze page.
  3. In Cluster, import kubectl YAML output to browse Pods, namespaces, labels and existing NetworkPolicies.
  4. Validate and save the policy to local storage.
  5. Export the YAML, then apply it with kubectl.
kubectl apply -f my-policy.yaml

To validate server-side before applying:

kubectl apply --dry-run=server -f my-policy.yaml
Security

Important notes

A local HTML file should never hold a permanent Kubernetes token. The app generates the YAML, but applying it to the cluster stays with kubectl, GitOps or your CI/CD pipeline.
  • Your CNI plugin must support NetworkPolicies (Calico, Cilium, etc.).
  • A policy selects Pods with spec.podSelector.
  • Ingress and egress rules describe allowed flows.
  • Test DNS, monitoring and dependency access before production.
  • The kubeconfig resolves the context and namespace; it does not describe the actual Pods and Services.
  • The inventory imported from kubectl stays in memory only and is cleared on page reload.
  • Version the exported YAML files in Git.