Generate baseline Kubernetes NetworkPolicies from rendered manifests

Name: Generate baseline Kubernetes NetworkPolicies from rendered manifests
Availability: InStock
Author: dormstern

by dormstern·Feb 18, 2026·1 point·0 comments

Visit Project View on HN

AI Analysis

●●SolidNiche GemSolve My Problem

The Take

It statically parses rendered manifests and common config files (Helm, Docker Compose, Spring Boot, .env, build files) to emit per-service ingress+egress NetworkPolicies—no cluster access needed. That offline, config-driven approach is smart and practical for PR-based workflows, though it will still need runtime validation for dynamic cases (headless services, service mesh/DNS/egress quirks) before you slam policies into prod.

Post Description

A lot of clusters still run “allow-all” east/west because NetworkPolicies aren’t enforced everywhere. I built a small static analyzer that reads rendered manifests (Helm/Argo CD/Kustomize output) and emits baseline NetworkPolicy YAML you can commit + diff in PRs.

Workflow:

PR changes manifests

CI regenerates policies

reviewers see “newly allowed” connections as a normal permission diff

Curious how others handle this: would you rather review generated policy diffs, or a connectivity-graph diff? Any edge cases you’ve seen bite in real clusters (headless services, shared namespaces, DNS/egress, service meshes, etc.)?