Scan your Kubernetes clusters to identifiy unprotected workloads and map your existing Network policies
![Netfetch](https://private-user-images.githubusercontent.com/17279882/298736337-64306f2f-abbf-462c-97d6-a326ca70c2ad.gif?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3MTU0NTUsIm5iZiI6MTcyNDcxNTE1NSwicGF0aCI6Ii8xNzI3OTg4Mi8yOTg3MzYzMzctNjQzMDZmMmYtYWJiZi00NjJjLTk3ZDYtYTMyNmNhNzBjMmFkLmdpZj9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjYlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI2VDIzMzIzNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWU0ZTQzN2YyNzBhYzY5NmM1ZTYzOGI0MWY5MDRlNzFkYmMwZTc3YWM2OWYxODZkMzU0ODI0OTZjYjMwMjc4OTUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.BUH9FBSzctCL_nr1qn9pxusV6M9UIfPjtW80Xx70nEs)
This project aims to demystify network policies in Kubernetes. It's a work in progress!
The netfetch
tool will scan your Kubernetes cluster and let you know if you have any pods running without being targeted by network policies.
Feature | CLI | Dashboard |
---|---|---|
Scan cluster identify pods without network policies | ✓ | ✓ |
Save scan output to a text file | ✓ | |
Visualize network policies and pods in a interactive network map | ✓ | |
Create default deny network policies where this is missing | ✓ | ✓ |
Get suggestions for network policies based on existing workloads | ✓ | |
Calculate a security score based on scan findings | ✓ | ✓ |
Scan a specific policy by name to see what pods it targets | ✓ |
Type | CLI | Dashboard |
---|---|---|
Kubernetes | ✓ | ✓ |
Cilium | ✓ |
Support for additional types of network policies is in the works. No support for the type you need? Check out issues for an existing request or create a new one if there is none.
You can install netfetch
using our Homebrew tap:
brew tap deggja/netfetch https://github.com/deggja/netfetch
brew install netfetch
For specific Linux distros, Windows and other install binaries, check the latest release.
You can deploy the netfetch
dashboard in your Kubernetes clusters using Helm.
helm repo add deggja https://deggja.github.io/netfetch/
helm repo update
helm install netfetch deggja/netfetch --namespace netfetch --create-namespace
Follow the instructions after deployment to access the dashboard.
- Installed
netfetch
via homebrew or a release binary. - Access to a Kubernetes cluster with
kubectl
configured. - Permissions to read and create network policies.
The primary command provided by netfetch
is scan
. This command scans all non-system Kubernetes namespaces for network policies.
You can also scan specific namespaces by specifying the name of that namespace.
You may add the --dryrun or -d flag to run a dryrun of the scan. The application will not prompt you about adding network policies, but still give you the output of the scan.
Run netfetch
in dryrun against a cluster.
netfetch scan --dryrun
Run netfetch
in dryrun against a namespace
netfetch scan crossplane-system --dryrun
Scan entire cluster.
netfetch scan
Scan a namespace called crossplane-system.
netfetch scan crossplane-system
Scan entire cluster for Cilium Network Policies and or Cluster Wide Cilium Network Policies.
netfetch scan --cilium
Scan a namespace called production for regular Cilium Network Policies.
netfetch scan production --cilium
Scan a specific network policy.
netfetch scan --target my-policy-name
Scan a specific Cilium Network Policy.
netfetch scan --cilium --target default-cilium-default-deny-all
Launch the dashboard:
netfetch dash
You may also specify a port for the dashboard to run on (default is 8080).
netfetch dash --port 8081
The Netfetch Dashboard offers an intuitive interface for interacting with your Kubernetes cluster's network policies. Below is a detailed overview of the functionalities available through the dashboard:
- Table View: Shows pods not targeted by network policies. It updates based on the cluster or namespace scans.
- Network Map Visualization: Rendered using D3 to show how pods and policies interact within the cluster.
- Policy Preview: Double-click network policy nodes within the network map to view policy YAML.
- Policy Editing: Edit suggested policies directly within the dashboard or copy the YAML for external use.
The netfetch
tool provides a basic score at the end of each scan. The score ranges from 1 to 42, with 1 being the lowest and 42 being the highest possible score.
Your score will decrease based on the amount of workloads in your cluster that are running without being targeted by a network policy.
The score reflects the security posture of your Kubernetes namespaces based on network policies and general policy coverage. If changes are made based on recommendations from the initial scan, rerunning netfetch
will likely result in a higher score.
If you want to uninstall the application - you can do so by running the following commands.
brew uninstall netfetch
brew cleanup -s netfetch
brew untap deggja/netfetch https://github.com/deggja/netfetch
To run tests for netfetch, follow these steps:
-
Navigate to the root directory of the project in your terminal.
-
Navigate to the backend directory within the project:
cd backend
- Run the following command to execute all tests in the project:
go test ./...
This command will recursively search for tests in all subdirectories (./...) and run them.
- After executing the command, you will see the test results in the terminal output.
Thank you to the following awesome people:
You are welcome to contribute!
See CONTRIBUTING for instructions on how to proceed.
Netfetch uses other tools for a plethora of different things. It would not be possible without the following:
Netfetch is distributed under the MIT License. See the LICENSE for more information.