deggja / netfetch

Kubernetes tool for scanning clusters for network policies and identifying unprotected workloads.

Netfetch

Scan your Kubernetes clusters to identifiy unprotected workloads and map your existing Network policies

Contents

• What is this project?
  • Support
• Installation
  • Install with brew
  • Install in Kubernetes
• Usage
  • Get started
  • Dashboard
  • Score
  • Uninstalling
• Contribute

⭐ What is this project ⭐

This project aims to demystify network policies in Kubernetes. It's a work in progress!

The netfetch tool is designed to scan Kubernetes namespaces for network policies, checking if your workloads are targeted by a network policy or not.

What can I use netfetch for? 🤔

CLI:

• Scan your Kubernetes cluster or namespace to identify pods running with no ingress and egress restrictions.
• Save the output of your scans in a text file to analyze.
• Create implicit default deny network policies in namespaces that do not have one.
• Get a score calculated for your cluster or namespace based on the findings of the scans.

Dashboard:

• Scan your cluster or namespace and list pods running without network restrictions in a table.
• Visualise all existing network policies and pods in your cluster or namespace in a network map you can interact with.
• Double click a network policy in a network map to preview the YAML of that policy.
• Create implicit default deny network policies in namespaces that do not have one.
• Get suggestions for network policies that you can edit & apply to your namespaces by analysing existing pods.
• Get a score calculated for your cluster or namespace based on the findings of the scans.

NetworkPolicy type support in Netfetch

Dashboard:

• Kubernetes

CLI:

• Kubernetes
• Cilium

Support for additional types of network policies is in the works. No support for the type you need? Check out issues for an existing request or create a new one if there is none.

Installation

Installation via Homebrew for Mac 💻

You can install netfetch using our Homebrew tap:

brew tap deggja/netfetch https://github.com/deggja/netfetch
brew install netfetch

For specific Linux distros, Windows and other install binaries, check the latest release.

Installation via Helm 🎩

You can deploy the netfetch dashboard in your Kubernetes clusters using Helm.

helm repo add deggja https://deggja.github.io/netfetch/
helm repo update
helm install netfetch deggja/netfetch --namespace netfetch --create-namespace

Follow the instructions after deployment to access the dashboard.

Prerequisites 🌌

• Installed netfetch via homebrew or a release binary.
• Access to a Kubernetes cluster with kubectl configured.
• Permissions to read and create network policies.

Usage

Get started

The primary command provided by netfetch is scan. This command scans all non-system Kubernetes namespaces for network policies.

You can also scan specific namespaces by specifying the name of that namespace.

You may add the --dryrun or -d flag to run a dryrun of the scan. The application will not prompt you about adding network policies, but still give you the output of the scan.

Run netfetch in dryrun against a cluster.

netfetch scan --dryrun

Run netfetch in dryrun against a namespace

netfetch scan production --dryrun

Scan entire cluster.

netfetch scan

Scan a namespace called production.

netfetch scan production

Scan entire cluster for Cilium Network Policies.

netfetch scan --cilium

Scan a namespace called production.

netfetch scan production --cilium

Using the dashboard 📟

Launch the dashboard:

netfetch dash

While in the dashboard, you have a couple of options.

You can use the Scan cluster button, which is the equivalent to the CLI netfetch scan command. This will populate the table view with all pods not targeted by a network policy.

Scanning a specific namespace is done by selecting the namespace of choice from the Select a namespace dropdown and using the Scan namespace button. This is the equivalent to the CLI netfetch scan namespace command.

This will populate the table view with all pods not targeted by a network policy in that specific namespace. In addition to this, if there are any pods in the cluster already targeted by a network policy - it will create a visualisation of this in a network map rendered using D3 below the table view.

You can click the Create cluster map button to do exactly that. This will render a network map with D3, fetching all pods and policies in all the namespaces you have access to in the cluster.

Inside the network map visualisations, you can double click the network policy nodes to preview the YAML of that policy.

When scanning a specific namespace using the Select namespace dropdown, you may click Suggest policy to get network policy suggestions based on your existing workloads.

You may also edit the suggestions inline by using the "Edit" button or copy the YAML of the policy and use it outside of netfetch.

Netfetch score 🥇

The netfetch tool provides a basic score at the end of each scan. The score ranges from 1 to 42, with 1 being the lowest and 42 being the highest possible score.

Your score will decrease based on the amount of workloads in your cluster that are running without being targeted by a network policy.

The score reflects the security posture of your Kubernetes namespaces based on network policies and general policy coverage. If changes are made based on recommendations from the initial scan, rerunning netfetch will likely result in a higher score.

Uninstalling netfetch

If you want to uninstall the application - you can do so by running the following commands.

brew uninstall netfetch
brew cleanup -s netfetch
brew untap deggja/netfetch https://github.com/deggja/netfetch

Running Tests

To run tests for this project, follow these steps:

1. Navigate to the root directory of the project in your terminal.

2. Navigate to the backend directory within the project:

cd backend

3. Run the following command to execute all tests in the project:

go test ./...

This command will recursively search for tests in all subdirectories (./...) and run them.

4. After executing the command, you will see the test results in the terminal output.

Contribute 🔨

Thank you to the following awesome people:

• s-rd - logo
• JJGadgets - testing
• Home Operations Discord - testing

You are welcome to contribute!

See CONTRIBUTING for instructions on how to proceed.

Tools 🧰

Netfetch uses other tools for a plethora of different things. It would not be possible without the following:

• statik
• D3
• Helm
• Brew
• lipgloss

License

Netfetch is distributed under the MIT License. See the LICENSE for more information.

netfetch's Issues

FR: Better package manager support (Linuxbrew + `asdf`)

• Support for installing on Linux via brew (current tap installs the macOS binary onto an amd64 Linux machine instead of failing)
• Add support for installing as an asdf plugin for use with either asdf or mise (formerly rtx)

Feature: implement tests

theres currently no tests in place for the code, this should be implemented.

Feature: prometheus endpoint

we should look into adding a prometheus endpoint for netfetch

Feature: update remediate

The remediate action should in addition to applying a default deny network policy, also give the user a suggestion on a network policy that will allow traffic for the pods in a namespace.

Bug: error suggesting policies when "default" namespace is chosen

Application throws an error when selecting the default namespace and clicking the Suggest policies button,

App.vue:525 Error suggesting policies: TypeError: Cannot read properties of null (reading 'app.kubernetes.io/name')
    at App.vue:541:29
    at Array.forEach (<anonymous>)
    at Proxy.suggestNetworkPolicy (App.vue:540:17)
    at Proxy.suggestPolicy (App.vue:513:40)

Integration with K9s as plugin

A wild idea, how about integrate this scanner with K9s, as a K9s plugin perhaps, to allow running it and viewing the report in K9s directly, instead of a web page?

IMHO, I'd make the HTML, Markdown, etc. a secondary output and by default output to terminal in textual form, human-friendly form and machine-friendly (e.g. JSON).

There should be a default answer then running scan

When I run a scan against a local cluster it will prompt to add a default deny all policy to every namespace that has unprotected pods.
For example:

netfetch scan                                   

Unprotected Pods found in namespace hello-world:
hello-world hello-world-manager-6564bd6bcf-8hfqg 10.232.4.217
? Do you want to add a default deny all network policy to the namespace hello-world? No

This should allow a default answer to be set from the CLI for unattended mode.
For example:

netfetch scan --add-default-deny=no

Unprotected Pods found in namespace hello-world:
hello-world hello-world-manager-6564bd6bcf-8hfqg 10.232.4.217
  Not adding a default deny all network policy to the namespace hello-world

bug: scan non-existing namespace

running netfetch scan namespace-name where the namespace does not exist will return a perfect score as there are no missing policies, but thats because the namespace does not exist.

scanning non-existant namespaces should return a message to the user saying the namespace does not exist.

Feature: port

The dashboard is served on localhost:8080 which is a quite frequently used port. We should implement logic to the backend, so that if 8080 is busy, select the next port available.

Bug: netpol suggestions get unknown name

Will be updated with more information later. Network policy suggestions end up setting the name to unknown on certain occassions.

The suggestNetworkPolicy function expects the recommended kubernetes.io/name label on applications, if this is missing, no name will be set for the netpol.

Feature Request: Add Support to Scan Ingress Resources

Can you please consider adding support for scanning Ingress resources in the netfetchtool.

This will help users identify potential security gaps related to external access and traffic routing in their Kubernetes clusters.

Thank you !!

Bug: no error message when cluster connection is not made

We should implement proper error handling for scenarios where the user is not yet properly connected to the cluster they are trying to scan (e.g set context for cluster but not authenticated).

Feature: implement cronjob in helm chart

We should implement the ability to create cronjobs directly in the helm chart.

Bug: check both ingress and egress for default deny all policies

Description:

The app should be checking whether a default deny all policy applies to both ingress and egress rules within the network policy - and not just if one of these are true.

Feature request: exclude a policy from a scan

Description:

if there is a cluster wide default deny policy in place - the scan will stop, and all pods in the cluster are deemed covered by that policy. It would be cool if it was possible to exclude a single policy with e.g:

netfetch scan --exclude cluster-wide-default-deny-all

It would then be possible to scan the rest of the cluster, even when a default deny all is in place.

Feature request: ability to scan specific policy

Description:

It would be very cool if the user could specify a singular policy to scan.

e.g: netfetch scan --target grafana-egress-network-policy

This would then list the pods that this policy targets. It could also list some more information about what the policy actually does and how it applies to the pod.

Feature: improve policy scanning logic

Description:

Currently, a pod will be marked as covered if it is targeted by a policy. We dont do much as far as analysing the ingress and egress rules inside the policy goes. We simply check if it has rules or not to determine what type of policy it is.

Goal:

We should improve the scanning logic so that once it has detected a policy, this poilicy should be scanned to determine what the policy is actually doing for the pod as far as cover go.

bug: remediate when scanning namespace

Description:

If you use the remediate function when scanning a specific namespace, a cluster wide scan will be initiated afterwards. This should invoke a namespace specific scan to fetch new viz data. Not a cluster scan.

How to reproduce:

1. Scan a cluster with untargeted and targeted pods.
2. Remediate untargeted pods.

Result:

The table will refresh with the results of a cluster wide scan.

Bug: network map visualized in cluster scan

When doing a cluster scan in the dashboard, no visualization should be shown after using the remediate function.

Prerequisites:

1. Namespace with pods protected by network policies (which will trigger visualization)
2. Unprotected pods in the same namespace.
3. Some other namespace with unprotected pods.

How to reproduce:

1. Click "Scan cluster"
2. Click "Remediate" on the other namespaces unprotected pods

Result:

Visualisation will render for the namespace left in the list, because the namespace is being scanned after the remediate function is used and the namespace has both unprotected pods (in the table) and protected pods (in the network map visualisation).

Feature: add support for calico

Currently, the implementation fetches policies from namespaces, and some logic is based on there being a namespace field in the structure of the kubernetes resource.

At some point it would be nice to add support for global network policies from e.g Calico and others. These policies do not have a namespace field and wont be included currently.

type PolicyVisualization struct {
	Name       string   `json:"name"`
	Namespace  string   `json:"namespace"`
	TargetPods []string `json:"targetPods"`
}

Bug: scanning dead pods

Description:

Currently, all pods in a non-system namespace will be scanned. That includes pods in a completed or a failing state. I cant think of any scenarios where this would be useful, so we should opt to exclude pods with this status from the scans.

Bug: caching issue in Chrome

After running the dashboard multiple times (10+), caching issues will appear and the dashboard will stop working until you clear the cache

Dashboard: refreshing table content

Component:

Netfetch Dashboard

How to reproduce:

1. User selects a namespace in the scan namespace dropdown.
2. User clicks scan cluster
3. User selects to remediate a missing policy

Result:

Table content is refreshed based on namespace selection. The table should be refreshed on a cluster level, as the cluster scan function was used.

Bug: Network policies with same name are displayed incorrectly

When you create a multiple network policies with the same name but in different namespaces they should be limited to the namespace but they are shown incorrectly in the cluster map.

Example policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-unknown-app-5000-tcp-nfpol
  namespace: test
spec:
  podSelector:
    matchLabels: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from: []
      ports:
        - protocol: TCP
          port: 5000
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0

If there is another policy with the same name for example in namespace test2 all of the pods across the two namespaces that are withing the policy scope will be linked in the cluster map to only one of these policies.

Feature: use deployments instead of pods

We should use deployments instead of pods where applicable. Naked pods should still be included, but if pods are part of a deployment, use the deployment in the network map instead.

netfetch linux binary. Below 22.04 seems to not be supported.

General info

First of, totally fair if this project do NOT want to support below 22.04. Then it would be great if this is mentioned in the docs. ( I can create a PR containing such a mention if this is a great idea ).

So e.g. executing netfetch dash gives:

netfetch: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by netfetch)
netfetch: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by netfetch)

Looking into the issue I found:

• https://github.com/deggja/netfetch/blob/main/.github/workflows/release.yml#L14 < is pointing to Ubuntu latest. Which is certainly not 20.04 that I'm on
• At https://packages.ubuntu.com/search?keywords=libc6 we can see that v2.35 of libc is available on v22.04. So being above v2.34 we should be good - correct?
• I can't just upgrade to a later version on Ubuntu 20.04. Getting info that I'm already on latest of libc when trying

---

Consequences

Because of this challenge I can't try out: #48 (comment) ... aka running the netfetch cli to try out the Cilium Network Policies scanning and generation.

---

Sounding of

• Would below 22.04 Ubuntu versions be supported? ... or asked in another way, is libc at v2.34 a hard requirement for netfetch?

Thank you very much. This project and the idea of it is really great. Much needed.

Feature: update suggestions API

we should add a network sniffer to the suggestions api, this should create a tcp dump that we base the suggestions off in terms of where communication should go when defining the netpol

this can be done with ksniff

Feature: preview yaml of policy

Feature for previewing the yaml of a given network policy in network viz map when double clicking on node.

Feature: netpols with namespaceSelector

Currently, we are checking network policies and their podSelectors + pods and their labels to match pods against the policies targeting them.

However, a networkPolicy in kubernetes can use a namespaceSelector which would apply to all pods within a specific namespace. We should implement logic to uncover these as well.

This would include changes to the ScanNetworkPolicies function.

Bug: duplicate visualisations

Description:
its possible to get a duplicate of network maps when you are scanning specific namespaces and using the suggest policy function.

How to reproduce:

Scan a namespace with "Scan namespace" that has existing policies and generate a network visualisation.
Change the dropdown to another namespace and get policy suggestions using the suggest policy button.
Create one of the suggested policies, this will update the visualisation of that namespace.

Result:

The create of the suggested policy will update the network map for that namespace, while the first namespace you scanned is still being visualised, giving you two network maps.

Potential fix:

When create is used on a suggested policy, we could remove all visualisations and refetch the visualisation for that specific namespace, cleaning up the view.

Feature: improve network map instructions

Currently, the network map instructions are all put on top of the svg where the network map is generated.

we should implement some way of showing the user how to interact with the network map without having to put it inside the svg like this, but not sure how.

App ignores KUBECONFIG env var and expects $HOME/.kube/config to exist instead

netfetch scan
It appears you are not connected to a Kubernetes cluster. Please check your kubeconfig.
Error during scan: stat /home/username/.kube/config: no such file or directory

echo $KUBECONFIG
/home/username/.kube/myclustername.config

# A workaround:
cp ~/.kube/myclustername.config ~/.kube/config

Bug: score container disappears

Description:
When clicking suggest policy once you have scanned a namespace -> the score container will disappear.

How to reproduce:

1. Scan a specific namespace using scan namespace.
2. Click suggest policy

Result:

The score container dissappears.

How to fix:
We should make sure that the score container is represented for the current namespace, even if suggestions are triggered.

Feature: proper semantic versioning

Currently, we have a script that handles updates to the version of the application, however this is quite simple and as of now, only handles patch updates. We need to implement proper semantic versioning. As a sidenote, we should also implement some dynamic update to the version of the application, specified as a const in the backend at the moment.

Version is a constant so the same version is reported no matter the actual version.

Here in the code: https://github.com/deggja/netfetch/blob/88a7580393fd0317f7709e76c48cf48797433f8e/backend/cmd/root.go#L10C1-L10C24 the version is a constant. So the same version will always be reported when using netfetch version. I don't know how to fix this in go.

Now "we" know.

Thank you for this great tool.

Feature: add support for Cilium

Good idea behind your tool. Consider looking at Cilium as well as Cilium Network Policies are becoming very commonly used.

https://docs.cilium.io/en/stable/security/policy/

Feature: update scoring logic

Currently, when using the CLI, denying the application of default deny policies in a namespace will be weighted on your total score. This is not reflected in the dashboard.

Fix:

We should not weight this into the score.

if !hasDenyAll {
		score -= 15
}

Edit:
Score reduction for answering no to default deny all policy application has been patched. This issue is partially solved.

Todos:
We should implement a more complex scoring logic.