{"id":13627377,"url":"https://github.com/otterize/network-mapper","last_synced_at":"2026-01-14T20:53:35.387Z","repository":{"id":61692386,"uuid":"505498076","full_name":"otterize/network-mapper","owner":"otterize","description":"Map Kubernetes traffic: in-cluster, to the Internet, and to AWS IAM and export as text, intents, or an image","archived":false,"fork":false,"pushed_at":"2025-06-10T08:28:36.000Z","size":4080,"stargazers_count":662,"open_issues_count":6,"forks_count":28,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-10-22T16:02:38.559Z","etag":null,"topics":["cloud-native","devops-tools","go","golang","hacktoberfest","intents","kubernetes","mapping","microservices","monitoring","network","network-discovery","network-visualization","observability","service-discovery","traffic-viewer","visibility"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/otterize.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-06-20T15:31:35.000Z","updated_at":"2025-10-15T15:07:07.000Z","dependencies_parsed_at":"2023-02-17T06:46:09.190Z","dependency_job_id":"e778acf9-df46-45c1-a124-7deebad5797c","html_url":"https://github.com/otterize/network-mapper","commit_stats":{"total_commits":347,"total_committers":22,"mean_commits":"15.772727272727273","dds":0.6397694524495677,"last_synced_commit":"b719dbb2696dc2f1e2acdfb1dd3b0b8ea2cb0c89"},"previous_names":[],"tags_count":100,"template":false,"template_full_name":null,"purl":"pkg:github/otterize/network-mapper","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/otterize%2Fnetwork-mapper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/otterize%2Fnetwork-mapper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/otterize%2Fnetwork-mapper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/otterize%2Fnetwork-mapper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/otterize","download_url":"https://codeload.github.com/otterize/network-mapper/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/otterize%2Fnetwork-mapper/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28434500,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T18:57:19.464Z","status":"ssl_error","status_checked_at":"2026-01-14T18:52:48.501Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloud-native","devops-tools","go","golang","hacktoberfest","intents","kubernetes","mapping","microservices","monitoring","network","network-discovery","network-visualization","observability","service-discovery","traffic-viewer","visibility"],"created_at":"2024-08-01T22:00:33.428Z","updated_at":"2026-01-14T20:53:35.377Z","avatar_url":"https://github.com/otterize.png","language":"Go","funding_links":[],"categories":["Projects by main language","Tools and Libraries","Go"],"sub_categories":["go","Monitoring, Alerts, and Visualization"],"readme":"# Otterize network mapper\n\n\u003cimg title=\"Otter Manning Helm\" src=\"./otterhelm.png\" width=200 alt=\"logo\" /\u003e\n\n![build](https://github.com/otterize/network-mapper/actions/workflows/build.yaml/badge.svg)\n[![Go Report Card](https://goreportcard.com/badge/github.com/otterize/network-mapper/src)](https://goreportcard.com/report/github.com/otterize/network-mapper/src)\n[![community](https://img.shields.io/badge/slack-Otterize_Slack-purple.svg?logo=slack)](https://joinslack.otterize.com)\n\nMaps pod-to-pod traffic, pod-to-Internet traffic, and even AWS IAM traffic, with zero-config.\n\n* [About](#about)\n* [Try the network mapper](#try-the-network-mapper)\n* [Installation instructions](#installation-instructions)\n* How does the network mapper work?\n  * [Components](#components)\n  * [Service name resolution](#service-name-resolution)\n* [Exporting a network map](#exporting-a-network-map)\n* [Learn more](#learn-more)\n* [Contributing](#contributing)\n* [Slack](#slack)\n\n\u003chttps://user-images.githubusercontent.com/20886410/205926414-a5fb6755-b5fa-45f3-9b15-d4f867547836.mp4\u003e\n\n## About\n\nThe Otterize network mapper is a zero-config tool that aims to be lightweight and doesn't require you to adapt anything in your cluster. Its goal is to give you insights about traffic in your cluster without a complete overhaul or the need to adapt anything to it, unlike other solutions, which may require deploying a new CNI, a service mesh, and so on.\n\nYou can use the [Otterize CLI](https://github.com/otterize/otterize-cli) to list the traffic by client, visualize the traffic, export the results as JSON or YAML, or reset the traffic the mapper remembers.\n\nExample output after running `otterize network-mapper visualize` on the [Google Cloud microservices demo](https://github.com/GoogleCloudPlatform/microservices-demo):\n![graph](visualize-example.png)\n\nThe same microservices demo in the [Otterize Cloud](https://otterize.com/cloud-beta) access graph, as it appears when you choose to connect the network mapper to Otterize Cloud:\n![image](cloud-example.png)\n\nExample output after running `otterize network-mapper list` on the Google Cloud microservices demo:\n\n```bash\ncartservice in namespace otterize-ecom-demo calls:\n  - redis-cart\ncheckoutservice in namespace otterize-ecom-demo calls:\n  - cartservice\n  - currencyservice\n  - emailservice\n  - paymentservice\n  - productcatalogservice\n  - shippingservice\nfrontend in namespace otterize-ecom-demo calls:\n  - adservice\n  - cartservice\n  - checkoutservice\n  - currencyservice\n  - productcatalogservice\n  - recommendationservice\n  - shippingservice\nloadgenerator in namespace otterize-ecom-demo calls:\n  - frontend\nrecommendationservice in namespace otterize-ecom-demo calls:\n  - productcatalogservice\n```\n\n## Try the network mapper\n\nTry the [quickstart](https://docs.otterize.com/quick-tutorials/k8s-network-mapper) to get a hands-on experience in 5 minutes.\n\nLooking to map AWS traffic? Check out the [AWS visibility tutorial](https://docs.otterize.com/features/aws-iam/tutorials/aws-visibility).\n\n## Installation instructions\n\n### Install and run the network mapper using Helm\n\n```bash\nhelm repo add otterize https://helm.otterize.com\nhelm repo update\nhelm install network-mapper otterize/network-mapper -n otterize-system --create-namespace --wait\n```\n\n### Install Otterize CLI to query data from the network mapper\n\nMac\n\n```bash\nbrew install otterize/otterize/otterize-cli\n```\n\nLinux 64-bit\n\n```bash\nwget https://get.otterize.com/otterize-cli/v2.0.3/otterize_linux_x86_64.tar.gz\ntar xf otterize_linux_x86_64.tar.gz\nsudo cp otterize /usr/local/bin\n```\n\nWindows\n\n```bash\nscoop bucket add otterize-cli https://github.com/otterize/scoop-otterize-cli\nscoop update\nscoop install otterize-cli\n```\n\nFor more platforms, see [the installation guide](https://docs.otterize.com/installation#install-the-otterize-cli).\n\n### Components\n\n* Mapper - the mapper is deployed once per cluster, and receives traffic information from the sniffer and watchers, and resolves the information to communications between [service identities](https://docs.otterize.com/reference/service-identities).\n* Sniffer - the sniffer is deployed to each node using a DaemonSet, and is responsible for capturing node-local DNS traffic and inspecting open connections.\n* Kafka watcher - the Kafka watcher is deployed once per cluster and is responsible for detecting accesses to Kafka topics, which services perform those accesses and which operations they use.\n* Istio watcher - the Istio watcher is part of the Mapper and queries Istio Envoy sidecars for HTTP traffic statistics, which are used to detect HTTP traffic with paths. Currently, the Istio watcher has a limitation where it reports all HTTP traffic seen by the sidecar since it was started, regardless of when it was seen.\n\n### DNS responses\n\nDNS is a common network protocol used for service discovery. When a pod (`checkoutservice`) tries to connect to a Kubernetes service\n(`orderservice`) or another pod, a DNS query is sent out. The network mapper watches DNS responses and extracts the IP addresses, which are used for the [service identity resolving process](https://docs.otterize.com/reference/service-identities).\n\n### Active TCP connections\n\nDNS responses will only appear when new connections are opened. To handle long-lived connections, the network mapper also queries open TCP connections in a manner similar to `netstat` or `ss`. The IP addresses are used for the [service identity resolving process](https://docs.otterize.com/reference/service-identities), as above.\n\n### Kafka logs\n\nThe Kafka watcher periodically examines logs of Kafka servers provided by the user through configuration, parses them and deduces topic-level access to Kafka from pods in the cluster.\nThe watcher is only able to parse Kafka logs when Kafka servers' Authorizer logger is configured to output logs to `stdout` with `DEBUG` level.\n\n### Istio sidecar metrics\n\nThe Istio watcher, part of the Network mapper periodically queries for all pods with the `security.istio.io/tlsMode` label, queries each pod's Istio sidecar for metrics about connections, and deduces connections with HTTP paths between pods covered by the Istio service mesh.\n\n### Service name resolution\n\nService names are resolved in one of two ways:\n\n1. If an `otterize/service-name` label is present, that name is used.\n2. If not, a recursive look-up is performed for the Kubernetes resource owner for a pod until the root is reached.\nFor example, if you have a `Deployment` named `client`, which then creates and owns a `ReplicaSet`,\nwhich then creates and owns a `Pod`, then the service name for that pod is `client` - same as the name of the `Deployment`.\nThe goal is to generate a mapping that speaks in the same language that dev teams use.\n\n## Exporting a network map\n\nThe network mapper continuously builds a map of pod to pod communication in the cluster. The map can be exported at any time in either JSON or YAML formats with the Otterize CLI.\n\nThe YAML export is formatted as `ClientIntents` Kubernetes resource files. Client intents files can be consumed by the [Otterize intents operator](https://github.com/otterize/intents-operator) to configure pod-to-pod access with network policies, or Kafka client access with Kafka ACLs and mTLS.\n\n## Learn more\n\nExplore our [documentation](https://docs.otterize.com/) site to learn how to:\n\n* [Map pod-to-pod communication](https://docs.otterize.com/quick-tutorials/k8s-network-mapper).\n* [Automate network policies](https://docs.otterize.com/quick-tutorials/k8s-network-policies).\n* And more...\n\n## Contributing\n\n1. Feel free to fork and open a pull request! Include tests and document your code in [Godoc style](https://go.dev/blog/godoc)\n2. In your pull request, please refer to an existing issue or open a new one.\n3. See our [Contributor License Agreement](https://github.com/otterize/cla/).\n\n## Slack\n\nTo join the conversation, ask questions, and engage with other users, join the Otterize Slack!\n\n[![button](https://i.ibb.co/vwRP6xK/Group-3090-2.png)](https://joinslack.otterize.com)\n\n## Usage telemetry\n\nThe mapper reports anonymous usage information back to the Otterize team, to help the team understand how the software is used in the community and what aspects users find useful. No personal or organizational identifying information is transmitted in these metrics: they only reflect patterns of usage. You may opt out at any time through a single configuration flag.\n\nTo **disable** sending usage information:\n\n* Via the Otterize OSS Helm chart: `--set global.telemetry.enabled=false`.\n* Via an environment variable: `OTTERIZE_TELEMETRY_ENABLED=false`.\n* If running a mapper directly: `--telemetry-enabled=false`.\n\nIf the `telemetry` flag is omitted or set to `true`, telemetry will be enabled: usage information will be reported.\n\nRead more about it in the [Usage telemetry Documentation](https://docs.otterize.com/otterize-oss/usage-telemetry)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fotterize%2Fnetwork-mapper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fotterize%2Fnetwork-mapper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fotterize%2Fnetwork-mapper/lists"}