{"id":22854949,"url":"https://github.com/np-guard/netpol-analyzer","last_synced_at":"2025-07-22T13:32:43.306Z","repository":{"id":63711400,"uuid":"523660484","full_name":"np-guard/netpol-analyzer","owner":"np-guard","description":"A Golang library for analyzing k8s connectivity-configuration resources (a.k.a. network policies)","archived":false,"fork":false,"pushed_at":"2025-07-21T11:48:29.000Z","size":49938,"stargazers_count":14,"open_issues_count":38,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-07-21T13:25:28.580Z","etag":null,"topics":["connectivity","kubernetes","network-analysis","network-visualization","networkpolicy"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/np-guard.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-08-11T09:24:03.000Z","updated_at":"2025-07-21T11:01:51.000Z","dependencies_parsed_at":"2023-12-20T07:27:56.085Z","dependency_job_id":"bcd68ab1-886a-4a47-a6cc-6315fbb5526f","html_url":"https://github.com/np-guard/netpol-analyzer","commit_stats":{"total_commits":204,"total_committers":7,"mean_commits":"29.142857142857142","dds":0.6862745098039216,"last_synced_commit":"d6ae3b2ee78125ff26a3e74fdca68e15c08bae79"},"previous_names":[],"tags_count":26,"template":false,"template_full_name":null,"purl":"pkg:github/np-guard/netpol-analyzer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/np-guard%2Fnetpol-analyzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/np-guard%2Fnetpol-analyzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/np-guard%2Fnetpol-analyzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/np-guard%2Fnetpol-analyzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/np-guard","download_url":"https://codeload.github.com/np-guard/netpol-analyzer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/np-guard%2Fnetpol-analyzer/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266505825,"owners_count":23940019,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-22T02:00:09.085Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["connectivity","kubernetes","network-analysis","network-visualization","networkpolicy"],"created_at":"2024-12-13T07:09:16.238Z","updated_at":"2025-07-22T13:32:43.300Z","avatar_url":"https://github.com/np-guard.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# netpol-analyzer\n\n## About netpol-analyzer\nThis repo contains a Golang library and CLI for analyzing k8s connectivity-configuration resources (a.k.a. network policies).\n\n\n## CLI usage \n\n### Evaluate command\n```\nEvaluate if a specific connection allowed\n\nUsage:\n  netpol-analyzer evaluate [flags]\n\nAliases:\n  evaluate, eval, check, allow\n\nExamples:\n  # Evaluate if a specific connection is allowed on given resources from dir path\n  netpol-analyzer eval --dirpath ./resources_dir/ -s pod-1 -d pod-2 -p 80\n\n  # Evaluate if a specific connection is allowed on a live k8s cluster\n  netpol-analyzer eval -k ./kube/config -s pod-1 -d pod-2 -p 80\n\nFlags:\n      --destination-ip string          Destination (external) IP address\n      --destination-namespace string   Destination pod namespace (default \"default\")\n  -d, --destination-pod string         Destination pod name\n  -p, --destination-port string        Destination port (name or number)\n  -h, --help                           help for evaluate\n      --protocol string                Protocol in use (tcp, udp, sctp) (default \"tcp\")\n      --source-ip string               Source (external) IP address\n  -n, --source-namespace string        Source pod namespace (default \"default\")\n  -s, --source-pod string              Source pod name, required\n\nGlobal Flags:\n  -c, --context string      Kubernetes context to use when evaluating connections in a live cluster\n      --dirpath string      Resources dir path when evaluating connections from a dir\n      --fail                fail on the first encountered error\n      --include-json        consider JSON manifests (in addition to YAML) when analyzing from dir\n  -k, --kubeconfig string   Path and file to use for kubeconfig when evaluating connections in a live cluster\n  -q, --quiet               Runs quietly, reports only severe errors and results\n  -v, --verbose             Runs with more informative messages printed to log\n```\n\n### List command\n```\nLists all allowed connections based on the workloads, network policies, and Ingress/Route resources defined.\n\nConnections between workload to itself are excluded from the output.\n\nUsage:\n  netpol-analyzer list [flags]\n\nExamples:\n  # Get list of allowed connections from resources dir path\n  netpol-analyzer list --dirpath ./resources_dir/\n\n  # Get list of allowed connections from live k8s cluster\n  netpol-analyzer list -k ./kube/config\n\nFlags:\n      --explain                       Enhance the analysis of permitted connectivity with explainability information \n      --exposure                      Enhance the analysis of permitted connectivity with exposure analysis\n  -f, --file string                   Write output to specified file\n      --focusworkload       string    Focus connections of specified workload(s) in the output, supports comma-separated names (workload name format: \u003cworkload-name\u003e or \u003cworkload-namespace/workload-name\u003e)\n      --focusworkload-peer  string    Focus connections of specified workload(s) with this peer(s), applies only when focusworkload is used; supports comma-separated names (focusworkload-peer name format is same as focusworkload)\n      --focus-direction     string    Focus connections of specified workload(s) on one direction, applies only when focusworkload is used; must be one of ingress,egress\n      --explain-only        string    Filter explain output to show only allowed or denied connections, applies only when explain is used; must be one of allow,deny\n      --focus-conn          string    Filter output to show results for a specific connection (connection format \u003cprotocolName-portNumber\u003e)\n  -h, --help                          help for list\n  -o, --output string                 Required output format; must be one of txt,json,dot,svg,csv,md (default \"txt\")\n\nGlobal Flags:\n  -c, --context     string    Kubernetes context to use when evaluating connections in a live cluster\n      --dirpath     string    Resources dir path when evaluating connections from a dir\n      --fail                  fail on the first encountered error\n  -k, --kubeconfig  string    Path and file to use for kubeconfig when evaluating connections in a live cluster\n  -q, --quiet                 runs quietly, reports only severe errors and results\n  -v, --verbose               runs with more informative messages printed to log\n```\n\n### Diff command\n```\nReports all differences in allowed connections between two different directories of YAML manifests.\n\nUsage:\n  netpol-analyzer diff [flags]\n\nExamples:\n  # Get list of different allowed connections between two resources dir paths\n  netpol-analyzer diff --dir1 ./resources_dir/ --dir2 ./other_resources_dir/\n\nFlags:\n      --dir1    string  First resources dir path\n      --dir2    string  Second resources dir path to be compared with the first dir path\n  -f, --file    string  Write output to specified file\n  -o, --output  string  Required output format; must be one of txt,csv,md,dot,svg (default \"txt\")  \n  -h, --help            help for diff\n\nGlobal Flags:\n  -c, --context string      Kubernetes context to use when evaluating connections in a live cluster\n      --dirpath string      Resources dir path when evaluating connections from a dir\n      --fail                fail on the first encountered error\n      --include-json        consider JSON manifests (in addition to YAML) when analyzing from dir\n  -k, --kubeconfig string   Path and file to use for kubeconfig when evaluating connections in a live cluster\n  -q, --quiet               Runs quietly, reports only severe errors and results\n  -v, --verbose             Runs with more informative messages printed to log  \n```\n\n### Example outputs:\n\n```\n$ netpol-analyzer eval --dirpath tests/onlineboutique -s adservice-77d5cd745d-t8mx4 -d emailservice-54c7c5d9d-vp27n -p 80\n\ndefault/adservice-77d5cd745d-t8mx4 =\u003e default/emailservice-54c7c5d9d-vp27n over tcp/80: false\n\n\n\n$ netpol-analyzer list --dirpath tests/onlineboutique_workloads\n\n0.0.0.0-255.255.255.255 =\u003e default/redis-cart[Deployment] : All Connections\ndefault/checkoutservice[Deployment] =\u003e default/cartservice[Deployment] : TCP 7070\ndefault/checkoutservice[Deployment] =\u003e default/currencyservice[Deployment] : TCP 7000\ndefault/checkoutservice[Deployment] =\u003e default/emailservice[Deployment] : TCP 8080\ndefault/checkoutservice[Deployment] =\u003e default/paymentservice[Deployment] : TCP 50051\ndefault/checkoutservice[Deployment] =\u003e default/productcatalogservice[Deployment] : TCP 3550\ndefault/checkoutservice[Deployment] =\u003e default/shippingservice[Deployment] : TCP 50051\ndefault/frontend[Deployment] =\u003e default/adservice[Deployment] : TCP 9555\ndefault/frontend[Deployment] =\u003e default/cartservice[Deployment] : TCP 7070\ndefault/frontend[Deployment] =\u003e default/checkoutservice[Deployment] : TCP 5050\ndefault/frontend[Deployment] =\u003e default/currencyservice[Deployment] : TCP 7000\ndefault/frontend[Deployment] =\u003e default/productcatalogservice[Deployment] : TCP 3550\ndefault/frontend[Deployment] =\u003e default/recommendationservice[Deployment] : TCP 8080\ndefault/frontend[Deployment] =\u003e default/shippingservice[Deployment] : TCP 50051\ndefault/loadgenerator[Deployment] =\u003e default/frontend[Deployment] : TCP 8080\ndefault/recommendationservice[Deployment] =\u003e default/productcatalogservice[Deployment] : TCP 3550\ndefault/redis-cart[Deployment] =\u003e 0.0.0.0-255.255.255.255 : All Connections\n\n\n\n$ ./bin/netpol-analyzer diff --dir1 tests/onlineboutique_workloads --dir2 tests/onlineboutique_workloads_changed_netpols\nConnectivity diff:\nsource: default/checkoutservice[Deployment], destination: default/cartservice[Deployment], dir1:  TCP 7070, dir2: TCP 8000, diff-type: changed\nsource: default/checkoutservice[Deployment], destination: default/emailservice[Deployment], dir1:  TCP 8080, dir2: TCP 8080,9555, diff-type: changed\nsource: default/cartservice[Deployment], destination: default/emailservice[Deployment], dir1:  No Connections, dir2: TCP 9555, diff-type: added\nsource: default/checkoutservice[Deployment], destination: default/adservice[Deployment], dir1:  No Connections, dir2: TCP 9555, diff-type: added\nsource: 128.0.0.0-255.255.255.255, destination: default/redis-cart[Deployment], dir1:  All Connections, dir2: No Connections, diff-type: removed\nsource: default/checkoutservice[Deployment], destination: default/currencyservice[Deployment], dir1:  TCP 7000, dir2: No Connections, diff-type: removed\nsource: default/frontend[Deployment], destination: default/adservice[Deployment], dir1:  TCP 9555, dir2: No Connections, diff-type: removed\nsource: default/redis-cart[Deployment], destination: 0.0.0.0-255.255.255.255, dir1:  All Connections, dir2: No Connections, diff-type: removed\n\n\n```\n\nAdditional details about the connectivity analysis and its output is specified [here](docs/connlist_output.md).\n\nAdditional details about explainability analysis (`--explain` flag for the `list` command) is specified [here](docs/explain_analysis.md).\n\nAdditional details about exposure analysis (`--exposure` flag for the `list` command) is specified [here](docs/exposure_analysis.md).\n\nAdditional details about the connectivity diff command and its output is specified [here](docs/diff_output.md).\n\n## Build the project\n\nMake sure you have golang 1.23+ on your platform\n\n```commandline\ngit clone git@github.com:np-guard/netpol-analyzer.git\ncd netpol-analyzer\nmake mod \nmake build\n```\n\nTest your build by running `./bin/netpol-analyzer -h`.\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnp-guard%2Fnetpol-analyzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnp-guard%2Fnetpol-analyzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnp-guard%2Fnetpol-analyzer/lists"}