Package: illuminatio
illuminatio - The kubernetes network policy validatorilluminatio is a tool for automatically testing kubernetes network policies.
Simply executeilluminatio clean runand illuminatio will scan your kubernetes cluster for network policies, build test cases accordingly and execute them
to determine if the policies are in effect.An overview of the concept is visualized inthe concept doc.DemoWatch it on asciinema withNetworkPolicy enabledor withNetworkPolicy disabled.Getting startedFollow these instructions to get illuminatio up and running.PrerequisitesPython 3.6 or greaterPip 3Installationwith pip:pip3installilluminatioor directly from the repository:pip3installgit+https://github.com/inovex/illuminatioKubectl pluginIn order to useilluminatioas akubectl pluginrun the following command:ln-s$(whichilluminatio)/usr/local/bin/kubectl-illuminatioAnd now cross check that the plugin exists:kubectlpluginlist--name-only|grepilluminatio
Thefollowingcompatiblepluginsareavailable:

kubectl-illuminatioExample UsageCreate a Deployment to test with:kubectlcreatedeploymentweb--image=nginx
kubectlexposedeploymentweb--port80--target-port80Define and create a NetworkPolicy for your Deployment:cat<<EOF | kubectl create -f -kind: NetworkPolicyapiVersion: networking.k8s.io/v1metadata:name: web-deny-allspec:podSelector:matchLabels:app: webingress: []EOFTest your newly created NetworkPolicy:illuminatiocleanrun
Startingcleaningresourceswithpolicies['on-request','always']Deletingnamespaces[]withcleanuppolicyon-request
Deletingnamespaces[]withcleanuppolicyalways
DeletingDSsindefaultwithcleanuppolicyon-request
Deletingpodsindefaultwithcleanuppolicyon-request
Deletingsvcsindefaultwithcleanuppolicyon-request
DeletingCfgMapsindefaultwithcleanuppolicyon-request
DeletingCRBswithcleanuppolicyon-requestglobally
DeletingSAsindefaultwithcleanuppolicyon-request
DeletingDSsindefaultwithcleanuppolicyalways
Deletingpodsindefaultwithcleanuppolicyalways
Deletingsvcsindefaultwithcleanuppolicyalways
DeletingCfgMapsindefaultwithcleanuppolicyalways
DeletingCRBswithcleanuppolicyalwaysglobally
DeletingSAsindefaultwithcleanuppolicyalways
FinishedcleanUp

Startingtestgenerationandrun.
Gotcases:[NetworkTestCase(from=ClusterHost(namespace=default,podLabels={'app':'web'}),to=ClusterHost(namespace=default,podLabels={'app':'web'}),port=-*)]Generated1casesin0.0701seconds
FROMTOPORT
default:app=webdefault:app=web-*

Usingexistingclusterrole
Creatingclusterrolebinding
TestResults:{'default:app=web':{'default:app=web':{'-*':{'success':True}}}}Finishedrunning1testsin18.7413seconds
FROMTOPORTRESULT
default:app=webdefault:app=web-*successThecleankeyword assures that illuminatio clears all potentially existing resources created in past illuminatio runs to prevent potential issues, however no user generated resources are affected.PLEASE NOTEthat currently each new run requires a clean, as the runners do not continuously look for new cases.For the case that you really want to keep the generated resources you are free to omit thecleankeyword.If you are done testing you might want to easily delete all resources created by illuminatio:illuminatiocleanTo preview generated test cases without running tests useilluminatio run's--dryoption:illuminatiorun--dry
Startingtestgenerationandrun.
Gotcases:[NetworkTestCase(from=ClusterHost(namespace=default,podLabels={'app':'web'}),to=ClusterHost(namespace=default,podLabels={'app':'web'}),port=-*)]Generated1casesin0.0902seconds
FROMTOPORT
default:app=webdefault:app=web-*

Skippingtestexecutionas--drywassetAll options and further information can be found using the--helpflag on any level:illuminatio--helpUsage:illuminatio[OPTIONS]COMMAND1[ARGS]...[COMMAND2[ARGS]...]...

Options:-v,--verbosityLVLEitherCRITICAL,ERROR,WARNING,INFOorDEBUG--incluster--helpShowthismessageandexit.

Commands:cleanrunDocker UsageInstead of installing theillumnatiocli on your machine you can also use our Docker image.
You will need to provide thekubeconfigto the container and probably some certificates:dockerrun-ti-v~/.kube:/home/illuminatio/.kube:roinovex/illuminatioilluminatiocleanrunMinikubeMinikube will store the certificates in the users home so we need to pass these to the container:dockerrun-ti-v"${HOME}/.minikube":"${HOME}/.minikube"-v"${HOME}/.kube:"/home/illuminatio/.kube:roinovex/illuminatioilluminatiocleanrunIf the minikube VM is not reachable from your container try to pass the--net=hostflag to the docker run command.Compatibilityilluminatio 1.1 was tested using:python 3.5.2pip 19.2.1illuminatio 1.1 is confirmed to be working properly with the following kubernetes environments:minikube v0.34.1, kubernetes v1.13.3Google Kubernetes Engine, v1.12.8-gke.10kubeadm 1.15.0-00, kubernetes v1.15.2PodSecurityPolicyIf your cluster has thePodSecurityPolicyAdmission Controller you must ensure that the illuminatio runner has the following rights to be created:Wants to run as rootNeeds theSYS_ADMINcapabilityNeedsallowPrivilegeEscalation: trueNeeds access to thehostPathfor the network namespaces and the cri socketAPodSecurityPolicygranting these privileges needs to be bound to theilluminatio-runnerServiceAccountin theilluminationamespace.
For more details look at theilluminatio DaemonSetReferencesThe logo was created by Pia Blum.Example Network Policies are inspired bykubernetes-network-policy-recipesPresentation fromContainerDays 2019,slidesThere is also a blog post about the background of illuminatio:illuminatio-kubernetes-network-policy-validatorContributingWe are happy to read yourissuesand accept yourPull Requests.This project uses thestandard github flow.
For more information on developing illuminatio refer tothe development docs.LicenseThis project excluding the logo is licensed under the terms of the Apache 2.0 license.
The logo is licensed under the terms of the CC BY-NC-ND 4.0 license.