Network Enforcer
ExperimentalDiscover network activity and secure the communication between your workloads.
Observe real network traffic, learn the communication patterns your applications need, and turn them into enforceable network policies.
Why Network Enforcer?
Learn from real traffic
Observe the communication patterns of running workloads instead of manually guessing every allowed peer and port.
Roll out safely
Start in monitor mode. See unexpected communication before you decide to block it.
Use your existing network stack
Build on Istio Ambient, Calico, or Cilium instead of introducing another data plane.
Kubernetes-native enforcement
Turn learned behavior into an Istio AuthorizationPolicy or a Kubernetes NetworkPolicy.
Learn. Monitor. Protect.
A simple workflow to secure your network.
Learn
Observe network flows and automatically build workload-specific policy proposals.
Monitor
Find traffic outside the learned policy without breaking your applications.
Protect
Enforce the allow-list using the policy mechanism provided by your network stack.
Works with your network stack
Network Enforcer consumes flow information from your existing networking solution and generates native policies.
Calico
Observe ingress and egress TCP/UDP flows and enforce using Kubernetes NetworkPolicy.
Cilium
Observe ingress and egress TCP/UDP flows and enforce using Kubernetes NetworkPolicy.
Istio Ambient
Observe inbound TCP traffic and enforce using Istio's native authorization mechanism.
From traffic to policy
Network Enforcer observes real workload communication and turns it into a policy proposal you can review.
Observed traffic (example)
All workloads are in the store namespace. After review, API can reach Database (TCP 5432) and Redis (TCP 6379). Frontend → API (TCP 443) belongs to a separate proposal.
Generated policy proposal (API egress)
apiVersion: networkenforcer.kubewarden.io/v1alpha1
kind: WorkloadNetworkPolicyProposal
metadata:
name: deployment-api-egress
namespace: store
spec:
backend: kubernetes
kubernetes:
egress:
- ports:
- {port: 5432, protocol: TCP}
to:
- namespaceSelector:
matchLabels: {kubernetes.io/metadata.name: store}
podSelector:
matchLabels: {app: database}
- ports:
- {port: 6379, protocol: TCP}
to:
- namespaceSelector:
matchLabels: {kubernetes.io/metadata.name: store}
podSelector:
matchLabels: {app: redis}
podSelector:
matchLabels: {app: api}
policyTypes: [Egress]Monitor reports unexpected traffic without blocking it. Review and update the proposal before switching to Protect.
Ready to experiment?
This example installs Network Enforcer on a cluster with Istio Ambient. For Calico or Cilium, follow the provider-specific instructions in the quickstart.
# Requires cert-manager, cert-manager-csi-driver, and Istio Ambient
helm repo add kubewarden https://charts.kubewarden.io
helm install network-enforcer kubewarden/network-enforcer \
--namespace network-enforcer --create-namespace \
--set controller.provider.name=istio \
--waitExplore other Kubewarden components
Extend your security posture across the entire workload lifecycle.
Admission Controller
Stop unsafe workloads before they enter your cluster.
Stable Learn more about Admission ControllerRuntime Enforcer
Control what can run inside your Kubernetes pods.
Beta Learn more about Runtime EnforcerSBOM Scanner
Find vulnerabilities in the container images running inside your cluster.
Beta Learn more about SBOM ScannerOriginally developed by
Kubewarden is a CNCF Sandbox Project
