Kubernetes NetworkPolicy

Import Kubernetes NetworkPolicy resources exported as YAML or JSON. netbobr parses ingress and egress rules, extracting ipBlock CIDRs and port specifications for compliance analysis.

Export command

Export NetworkPolicy resources using kubectl:

# Export all NetworkPolicies in a namespace
kubectl get networkpolicy -n default -o yaml > netpol.yaml

# Export all NetworkPolicies across all namespaces
kubectl get networkpolicy --all-namespaces -o yaml > all-netpol.yaml

# Export a specific policy
kubectl get networkpolicy my-policy -n default -o yaml > policy.yaml

Use -o yaml or -o json. Both are detected automatically.

Supported structures

netbobr accepts these shapes, in YAML or JSON:

• Single document -- one NetworkPolicy resource
• Multi-document YAML -- multiple policies separated by ---. A separator line may carry trailing spaces or a comment (--- # second policy), and Windows (CRLF) line endings work. A document that is not valid YAML is skipped with a warning; the other documents are still read.
• List wrapper -- kind: List (what kubectl get networkpolicy -o yaml returns) or kind: NetworkPolicyList, with an items array
• JSON array of NetworkPolicy objects

Resources of other kinds in the same file are ignored. A NetworkPolicy whose apiVersion is not networking.k8s.io/* (for example Calico's projectcalico.org/v3) is skipped with a warning.

Minimal example

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-https-ingress
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: web-server
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 10.0.0.0/8
      ports:
        - protocol: TCP
          port: 443

Parser behavior

• policyTypes decides which sections apply. Without policyTypes, a policy covers ingress, plus egress when it has egress rules (the Kubernetes API default). Rules in a section that policyTypes does not list are ignored with a warning, as Kubernetes ignores them.
• Default deny. A listed policy type with no rules allows nothing; netbobr reports it, e.g. Kubernetes NetworkPolicy prod/default-deny-all: allows no ingress traffic to its selected pods (default deny). A file with only default-deny policies says that there are no allowed flows to analyse instead of reporting a format error.
• Peers. Missing or empty from/to means all sources/destinations: 0.0.0.0/0, without a warning. An ipBlock gives its CIDR.
• Ports. Each ports[] entry gives a protocol and a port; endPort gives a range (port: 30000, endPort: 32767 becomes 30000-32767). Missing ports means all ports (ANY 1-65535); a missing protocol means TCP, as in Kubernetes.
• Every combination of peer and port creates a separate flow for analysis.
• except CIDRs in ipBlock are noted but not used for exclusion (see Limitations).
• In the browser, the js-yaml library is loaded from CDN for YAML parsing. JSON files are parsed natively and need no CDN download. The CLI uses the npm js-yaml package, so it works offline.

Selectors and selected pods

Pod IPs are dynamic, so label selectors cannot be resolved to CIDRs:

• Selector peers (podSelector, namespaceSelector, or both in one peer, meaning "these pods in these namespaces") become the 0.0.0.0/0 placeholder with one warning per peer, e.g. Kubernetes NetworkPolicy prod/mon-scrape: source pod selector "app In (prometheus)" in namespaces matching "team=monitoring" cannot be resolved to CIDR -- substituted 0.0.0.0/0. matchLabels are shown as key=value and matchExpressions as key In (a,b), key NotIn (a) or key Exists.
• The policy's own selected pods (the destination of ingress, the source of egress) are always the placeholder. This is reported once per file, with counts and up to 5 policy names: 349 Kubernetes NetworkPolicies: selected pods cannot be resolved to CIDR -- substituted 0.0.0.0/0 as the destination of 217 inbound flows and the source of 132 outbound flows (…).

Limitations and warnings

Accuracy

Accuracy measured against a 400-rule CSV baseline (360 Tier 1 + 40 Tier 2).

The lower match rate is primarily due to:

• ICMP gap: 15 rules that use ICMP cannot be expressed in NetworkPolicy format.
• Tier 2 gap: 40 rules requiring both specific source and destination CIDRs cannot be expressed.
• 24 other Tier 1 rows have no exact counterpart in the generated policies (see the divergences in the accuracy report).

Troubleshooting

"No flows parsed" Verify the file is valid YAML or JSON containing kind: NetworkPolicy resources (directly, in a List/NetworkPolicyList, or in a JSON array), and that apiVersion is networking.k8s.io/v1. The import names the kinds it found when there is no NetworkPolicy, and says when every policy is a default deny.

"ICMP rules missing" This is expected. Kubernetes NetworkPolicy has no ICMP port specification. ICMP-based rules cannot be represented and are skipped during parsing.

"Pod selector warning" Rules that match pods by label selector instead of IP blocks generate warnings. Pod IPs are dynamic and change when pods restart, so they cannot be resolved to static CIDRs; the rule is analysed with 0.0.0.0/0 in their place.

"Missing egress rules" Check policyTypes. If it lists only Ingress, the egress section is ignored (with a warning), exactly as in Kubernetes. Add Egress to policyTypes if the egress rules are meant to apply.

CLI usage:

npx @netbobr/cli analyze netpol.yaml --cloud-format k8s-netpol

Browser: Drag and drop the .yaml file onto the import area. Kubernetes NetworkPolicy format is auto-detected.