Go microservice (typical HTTP API)

Hand-authored illustration. The YAML on this page illustrates the shape of the policies kguardian generates for this workload — it is not captured generator output. Exact metadata, rule grouping, and selectors produced by kubectl kguardian gen will differ. Regeneration of this gallery from a live cluster is planned.

Workload

A golang:1.23 HTTP API in the app namespace. It serves JSON on TCP/8080 to upstream callers (an internal gateway), writes to Postgres in the data namespace, and makes outbound HTTPS calls to a single SaaS endpoint (api.stripe.com) for payment processing. It also exposes Prometheus metrics on TCP/9100.

Generated NetworkPolicy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: order-api
  namespace: app
  labels:
    kguardian.dev/managed-by: kguardian
    kguardian.dev/version: v1.0.0
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: order-api
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: edge
          podSelector:
            matchLabels:
              app.kubernetes.io/name: api-gateway
      ports:
        - protocol: TCP
          port: 8080
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
          podSelector:
            matchLabels:
              app.kubernetes.io/name: prometheus
      ports:
        - protocol: TCP
          port: 9100
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: data
          podSelector:
            matchLabels:
              app: postgres
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53

Kubernetes-native NetworkPolicy cannot express “egress to api.stripe.com” by hostname. In real generator output, that traffic appears as a /32 ipBlock egress rule for the observed IP (not shown above) — functional, but brittle for CDN-backed endpoints whose addresses rotate.

Generated CiliumNetworkPolicy

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: order-api
  namespace: app
  labels:
    kguardian.dev/managed-by: kguardian
    kguardian.dev/version: v1.0.0
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: order-api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app.kubernetes.io/name: api-gateway
            io.kubernetes.pod.namespace: edge
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            app.kubernetes.io/name: prometheus
            io.kubernetes.pod.namespace: monitoring
      toPorts:
        - ports:
            - port: "9100"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            app: postgres
            io.kubernetes.pod.namespace: data
      toPorts:
        - ports:
            - port: "5432"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s-app: kube-dns
            io.kubernetes.pod.namespace: kube-system
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP

Generated seccomp profile (excerpt)

Full profile contains 97 syscall names. Representative excerpt:

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64"],
  "syscalls": [
    {
      "names": [
        "accept4", "bind", "close", "connect", "epoll_create1",
        "epoll_ctl", "epoll_pwait", "futex", "getrandom",
        "getsockname", "listen", "openat", "read", "recvfrom",
        "sendto", "setsockopt", "socket", "write"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "clone", "execve", "exit_group", "mmap", "mprotect",
        "munmap", "rseq", "rt_sigaction", "rt_sigreturn",
        "sched_yield", "tgkill"
      ],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

What kguardian observed

The Go runtime makes this profile easy to recognise: heavy futex (goroutine scheduling), getrandom (TLS), rseq and sched_yield (scheduler hints), and a small file-I/O footprint. Network-wise, the controller saw three distinct egress destinations — Postgres in the data namespace, CoreDNS for DNS, and api.stripe.com resolved at runtime. The generator does not emit hostname-based rules, so the Stripe traffic is covered by a /32 ipBlock egress rule for the resolved IP. That works, but is brittle for CDN-backed endpoints like Stripe whose addresses rotate — expect to re-generate or hand-maintain that rule.

Getting Started

Core Concepts

User Guides

Policy Gallery

CLI Reference

CRD Reference

Configuration Reference

Advanced

Roadmap

Go microservice (typical HTTP API)

Workload

Generated NetworkPolicy

Generated CiliumNetworkPolicy

Generated seccomp profile (excerpt)

What kguardian observed

​Workload

​Generated NetworkPolicy

​Generated CiliumNetworkPolicy

​Generated seccomp profile (excerpt)

​What kguardian observed

Workload

Generated NetworkPolicy

Generated CiliumNetworkPolicy

Generated seccomp profile (excerpt)

What kguardian observed