Chapter 8. Build-time network policy tools Build-time network policy tools let you automate the creation and validation of Kubernetes network policies in your development and operations workflows using the roxctl CLI. These tools work with a specified file directory containing your project's workload and network policy manifests and do not require RHACS authentication. Table 8.1. Network policy tools Command Description roxctl netpol generate Generates Kubernetes network policies by analyzing your project's YAML manifests in a specified directory. For more information, see Using the build-time network policy generator . roxctl netpol connectivity map Lists the allowed connections between workloads in your project directory by examining the workload and Kubernetes network policy manifests. You can generate the output in various text formats or in a graphical .dot format. For more information, see Connectivity mapping using the roxctl netpol connectivity map command . roxctl netpol connectivity diff Creates a list of variations in the allowed connections between two project versions. This is determined by the workload and Kubernetes network policy manifests in each version's directory. This feature shows the semantic differences which are not obvious when performing a source code (syntactic) diff . For more information, see Identifying the differences in allowed connections between project versions . 8.1. Build-time network policy generator The build-time network policy generator can automatically generate Kubernetes network policies based on application YAML manifests. You can use it to develop network policies as part of the continuous integration/continuous deployment (CI/CD) pipeline before deploying applications on your cluster. Red Hat developed this feature in partnership with the developers of the NP-Guard project . First, the build-time network policy generator analyzes Kubernetes manifests in a local folder, including service manifests, config maps, and workload manifests such as Pod , Deployment , ReplicaSet , Job , DaemonSet , and StatefulSet . Then, it discovers the required connectivity and creates the Kubernetes network policies to achieve pod isolation. These policies allow no more and no less than the needed ingress and egress traffic. 8.1.1. Using the build-time network policy generator The build-time network policy generator is included in the roxctl CLI. For the build-time network policy generation feature, roxctl CLI does not need to communicate with RHACS Central so you can use it in any development environment. Prerequisites The build-time network policy generator recursively scans the directory you specify when you run the command. Therefore, before you run the command, you must already have service manifests, config maps, and workload manifests such as Pod , Deployment , ReplicaSet , Job , DaemonSet , and StatefulSet as YAML files in the specified directory. Verify that you can apply these YAML files by using the kubectl apply -f command. The build-time network policy generator does not work with files that use Helm style templating. Verify that the service network addresses are not hard-coded. Every workload that needs to connect to a service must specify the service network address as a variable. You can specify this variable by using the workload's resource environment variable or in a config map. Example 1: Using an environment variable Example 2: Using a config map Example 3: Using a config map Service network addresses must match the following official regular expression pattern: 1 In this pattern, <svc> is the service name. <ns> is the namespace where you defined the service. <portNum> is the exposed service port number. Following are some examples that match the pattern: wordpress-mysql:3306 redis-follower.redis.svc.cluster.local:6379 redis-leader.redis http://rating-service. Procedure Verify that the build-time network policy generation feature is available by running the help command: USD roxctl netpol generate -h Generate the policies by using the netpol generate command: USD roxctl netpol generate <folder_path> [flags] 1 1 Specify the path to the folder, which can include sub-folders that contain YAML resources for analysis. The command scans the entire sub-folder tree. Optionally, you can also specify parameters to change the behavior of the command. Additional resources roxctl netpol generate command options . steps After generating the policies, you must inspect them for completeness and accuracy, in case any relevant network address was not specified as expected in the YAML files. Most importantly, verify that required connections are not blocked by the isolating policies. To help with this inspection you can use the roxctl netpol connectivity map tool. Note Applying network policies to the cluster as part of the workload deployment using automation saves time and ensures accuracy. You can follow a GitOps approach by submitting the generated policies using pull requests, providing the team an opportunity to review the policies before deploying them as part of the pipeline. 8.2. Connectivity mapping using the roxctl netpol connectivity map command Connectivity mapping provides details on the allowed connections between different workloads based on network policies defined in Kubernetes manifests. You can visualize and understand how different workloads in your Kubernetes environment are allowed to communicate with each other according to the network policies you set up. To retrieve connectivity mapping information, the roxctl netpol connectivity map command requires a directory path that contains Kubernetes workloads and network policy manifests. The output provides details about connectivity details within the Kubernetes resources analyzed. 8.2.1. Retrieving connectivity mapping information from a Kubernetes manifest directory Retrieve connectivity mapping information from a Kubernetes manifest directory by using the roxctl netpol connectivity map command. Procedure To retrieve the connectivity mapping information, run the following command: roxctl netpol connectivity map <folder_path> [flags] 1 1 Specify the path to the folder, which can include sub-folders that contain YAML resources and network policies for analysis, for example, netpol-analysis-example-minimal/ . The command scans the entire sub-folder tree. Optionally, you can also specify parameters to modify the behavior of the command. Table 8.2. Example output src dst conn 0.0.0.0-255.255.255.255 default/frontend[Deployment] TCP 8080 default/frontend[Deployment] 0.0.0.0-255.255.255.255 UDP 53 default/frontend[Deployment] default/backend[Deployment] TCP 9090 The output displays a table listing the allowed connectivity lines. Each line is composed of the following elements: src :: Represents the source endpoint. dst :: Represents the destination endpoint. conn :: Represents the permissible connectivity attributes. An endpoint follows the format namespace/name[Kind] . For example, default/backend[Deployment] . Additional resources roxctl netpol connectivity map command options . 8.2.2. Connectivity map output formats and visualizations You can use various output formats, including txt , md , csv , json , and dot . The dot format is ideal for visualizing the output as a connectivity graph. It can be viewed using graph visualization software such as Graphviz tool , and extensions to VSCode . You can convert the dot output to formats such as svg , jpeg , or png using Graphviz, whether it is installed locally or through an online viewer. 8.2.3. Generating svg graphs from the dot output using Graphviz Follow these steps to create a graph in svg format from the dot output. Prerequisites Graphviz is installed on your local system. Procedure Run the following command to create the graph in svg format: USD dot -Tsvg connlist_output.dot > connlist_output_graph.svg The following are examples of the dot output and the resulting graph generated by Graphviz: Example 1: dot output Example 2: Graph generated by Graphviz 8.3. Identifying the differences in allowed connections between project versions This command helps you understand the differences in allowed connections between two project versions. It analyses the workload and Kubernetes network policy manifests located in each version's directory and creates a representation of the differences in text format. You can view connectivity difference reports in a variety of output formats, including text , md , dot , and csv . 8.3.1. Generating connectivity difference reports by using the roxctl netpol connectivity diff command Generate a report on connectivity differences between two sets of Kubernetes manifests, including network policies by using the roxctl netpol connectivity diff command . Prerequisites You have two folders, dir1 and dir2 , each containing Kubernetes manifests, including network policies. Procedure To find the connectivity differences between the Kubernetes manifests in the specified directories, run the following command: USD roxctl netpol connectivity diff --dir1=<folder_path_1> --dir2=<folder_path_2> [flags] 1 1 Specify the path to the folders, which can include sub-folders that contain YAML resources and network policies for analysis. The command scans the entire sub-folder trees for both the directories. For example, <folder_path_1> is netpol-analysis-example-minimal/ and <folder_path_2> is netpol-diff-example-minimal/ . Optionally, you can also specify parameters to change the behavior of the command. Note The command considers all YAML files that you can accept by using kubectl apply -f , and the YAML files then become valid inputs for your roxctl netpol connectivity diff command. Table 8.3. Example output diff-type source destination dir 1 dir 2 workloads-diff-info changed default/frontend[Deployment] default/backend[Deployment] TCP 9090 TCP 9090,UDP 53 added 0.0.0.0-255.255.255.255 default/backend[Deployment] No Connections TCP 9090 The semantic difference report gives you an overview of the connections that were changed, added, or removed in dir2 compared to the connections allowed in dir1 . When you review the output, each line represents one allowed connection that was added, removed, or changed in dir2 compared to dir1 . If applicable, the workloads-diff-info provides additional details about added or removed workloads related to the added or removed connection. For example, if a connection from workload A to workload B is removed because workload B was deleted, the workloads-diff-info indicates that workload B was removed. However, if such a connection was removed only because of network policy changes and neither workload A nor B was deleted, the workloads-diff-info is empty. Additional resources roxctl netpol connectivity diff command options . Output generated by the roxctl netpol connectivity diff command. Example 1: text format Output generated by the roxctl netpol connectivity diff command. Example 2: md format Output generated by the roxctl netpol connectivity diff command. Example 3: svg graph generated from dot format Output generated by the roxctl netpol connectivity diff command. Example 4: csv format 8.3.2. Distinguishing between syntactic and semantic difference outputs In the following example, dir1 is netpol-analysis-example-minimal/ , and dir2 is netpol-diff-example-minimal/ . The difference between the directories is a small change in the network policy backend-netpol . Example policy from dir1 : apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: creationTimestamp: null name: backend-netpol spec: ingress: - from: - podSelector: matchLabels: app: frontend ports: - port: 9090 protocol: TCP podSelector: matchLabels: app: backendservice policyTypes: - Ingress - Egress status: {} The change in dir2 is an added - before the ports attribute, which produces a difference output. 8.3.2.1. Syntactic difference output Procedure Run the following command to compare the contents of the netpols.yaml files in the two specified directories: Example output 12c12 < - ports: --- > ports: 8.3.2.2. Semantic difference output Procedure Run the following command to analyze the connectivity differences between the Kubernetes manifests and network policies in the two specified directories: USD roxctl netpol connectivity diff --dir1=roxctl/netpol/connectivity/diff/testdata/netpol-analysis-example-minimal/ --dir2=roxctl/netpol/connectivity/diff/testdata/netpol-diff-example-minimal Example output Connectivity diff: diff-type: changed, source: default/frontend[Deployment], destination: default/backend[Deployment], dir1: TCP 9090, dir2: TCP 9090,UDP 53 diff-type: added, source: 0.0.0.0-255.255.255.255, destination: default/backend[Deployment], dir1: No Connections, dir2: TCP 9090

Commands:
(http(s)?://)?<svc>(.<ns>(.svc.cluster.local)?)?(:<portNum>)? 1
roxctl netpol generate -h
roxctl netpol generate <folder_path> [flags] 1
roxctl netpol connectivity map <folder_path> [flags] 1
dot -Tsvg connlist_output.dot > connlist_output_graph.svg
roxctl netpol connectivity diff --dir1=<folder_path_1> --dir2=<folder_path_2> [flags] 1
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: creationTimestamp: null name: backend-netpol spec: ingress: - from: - podSelector: matchLabels: app: frontend ports: - port: 9090 protocol: TCP podSelector: matchLabels: app: backendservice policyTypes: - Ingress - Egress status: {}
diff netpol-diff-example-minimal/netpols.yaml netpol-analysis-example-minimal/netpols.yaml
12c12 < - ports: --- > ports:
roxctl netpol connectivity diff --dir1=roxctl/netpol/connectivity/diff/testdata/netpol-analysis-example-minimal/ --dir2=roxctl/netpol/connectivity/diff/testdata/netpol-diff-example-minimal
Connectivity diff: diff-type: changed, source: default/frontend[Deployment], destination: default/backend[Deployment], dir1: TCP 9090, dir2: TCP 9090,UDP 53 diff-type: added, source: 0.0.0.0-255.255.255.255, destination: default/backend[Deployment], dir1: No Connections, dir2: TCP 9090