turbot/kubernetes
steampipe plugin install kubernetes

Table: kubernetes_network_policy - Query Kubernetes Network Policies using SQL

A Kubernetes Network Policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints. It provides a way to enforce rules on network traffic within a Kubernetes cluster, thereby enhancing the security of the cluster. Network Policies use labels to select pods and define rules which specify what traffic is allowed to the selected pods.

Table Usage Guide

The kubernetes_network_policy table provides insights into the network policies within a Kubernetes cluster. As a security analyst or a DevOps engineer, explore policy-specific details through this table, including pod selectors, policy types, and ingress and egress rules. Utilize it to uncover information about network traffic rules, such as those allowing or blocking specific types of traffic, thereby helping in assessing and enhancing the security posture of your Kubernetes clusters.

Examples

Basic Info

Explore which network policies are in place within your Kubernetes environment. This allows you to gain insights into the security settings and manage access controls more effectively.

select
name,
namespace,
policy_types,
ingress,
egress,
pod_selector,
labels,
annotations
from
kubernetes_network_policy;
select
name,
namespace,
policy_types,
ingress,
egress,
pod_selector,
labels,
annotations
from
kubernetes_network_policy;

List policies that allow all egress

Explore which network policies permit all outgoing traffic in a Kubernetes environment. This can be useful for identifying potential security risks and ensuring that your network configurations adhere to best practices.

select
name,
namespace,
policy_types,
pod_selector,
egress
from
kubernetes_network_policy
where
policy_types @> '["Egress"]'
and pod_selector = '{}'
and egress @> '[{}]';
Error: The corresponding SQLite query is unavailable.

List default deny egress policies

Analyze the settings to understand the network policies that default to denying egress. This is particularly useful for enhancing security by identifying policies that prevent outbound network traffic.

select
name,
namespace,
policy_types,
pod_selector,
egress
from
kubernetes_network_policy
where
policy_types @> '["Egress"]'
and pod_selector = '{}'
and egress is null;
Error: The corresponding SQLite query is unavailable.

List policies that allow all ingress

Analyze the settings to understand which policies permit all incoming traffic, useful for enhancing security by identifying potential vulnerabilities in your network.

select
name,
namespace,
policy_types,
pod_selector,
ingress
from
kubernetes_network_policy
where
policy_types @> '["Ingress"]'
and pod_selector = '{}'
and ingress @> '[{}]';
Error: The corresponding SQLite query is unavailable.

List default deny ingress policies

Discover the segments that have default deny ingress policies in place. This is useful in identifying potential security risks, as it highlights the policies that block all incoming traffic by default.

select
name,
namespace,
policy_types,
pod_selector,
ingress
from
kubernetes_network_policy
where
policy_types @> '["Ingress"]'
and pod_selector = '{}'
and ingress is null;
Error: The corresponding SQLite query is unavailable.

View rules for a specific network policy

Explore rules associated with a certain network policy to understand its ingress and egress configurations. This is useful for assessing security measures and traffic flow within a specific network environment.

select
name,
namespace,
policy_types,
jsonb_pretty(ingress),
jsonb_pretty(egress)
from
kubernetes_network_policy
where
name = 'test-network-policy'
and namespace = 'default';
select
name,
namespace,
policy_types,
ingress,
egress
from
kubernetes_network_policy
where
name = 'test-network-policy'
and namespace = 'default';

List manifest resources

Explore the network policies in your Kubernetes environment to understand their configurations and rules. This can be useful to ensure security standards are met and to identify any potential vulnerabilities or misconfigurations.

select
name,
namespace,
policy_types,
ingress,
egress,
pod_selector,
labels,
annotations,
path
from
kubernetes_network_policy
where
path is not null;
select
name,
namespace,
policy_types,
ingress,
egress,
pod_selector,
labels,
annotations,
path
from
kubernetes_network_policy
where
path is not null;

Schema for kubernetes_network_policy

NameTypeOperatorsDescription
_ctxjsonbSteampipe context in JSON form.
annotationsjsonbAnnotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata.
context_nametextKubectl config context name.
creation_timestamptimestamp with time zoneCreationTimestamp is a timestamp representing the server time when this object was created.
deletion_grace_period_secondsbigintNumber of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set.
deletion_timestamptimestamp with time zoneDeletionTimestamp is RFC 3339 date and time at which this resource will be deleted.
egressjsonbList of egress rules to be applied to the selected pods. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default).
end_linebigintThe path to the manifest file.
finalizersjsonbMust be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.
generate_nametextGenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided.
generationbigintA sequence number representing a specific generation of the desired state.
ingressjsonbList of ingress rules to be applied to the selected pods. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
labelsjsonbMap of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services.
nametextName of the object. Name must be unique within a namespace.
namespacetextNamespace defines the space within which each name must be unique.
owner_referencesjsonbList of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
pathtextThe path to the manifest file.
pod_selectorjsonbSelects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. An empty podSelector matches all pods in this namespace.
policy_typesjsonbList of rule types that the NetworkPolicy relates to. Valid options are "Ingress", "Egress", or "Ingress,Egress". If this field is not specified, it will default based on the existence of Ingress or Egress rules.
resource_versiontextAn opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed.
source_typetextThe source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest.
sp_connection_nametextSteampipe connection name.
sp_ctxjsonbSteampipe context in JSON form.
start_linebigintThe path to the manifest file.
tagsjsonbA map of tags for the resource. This includes both labels and annotations.
titletextTitle of the resource.
uidtextUID is the unique in time and space value for this object.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- kubernetes

You can pass the configuration to the command with the --config argument:

steampipe_export_kubernetes --config '<your_config>' kubernetes_network_policy