> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kguardian.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Go microservice (typical HTTP API)

> Generated NetworkPolicy and seccomp profile for a typical Go HTTP service that talks to a database and a SaaS endpoint

<Warning>
  **Hand-authored illustration.** The YAML on this page illustrates the shape of the policies kguardian generates for this workload — it is not captured generator output. Exact metadata, rule grouping, and selectors produced by `kubectl kguardian gen` will differ. Regeneration of this gallery from a live cluster is planned.
</Warning>

## Workload

A `golang:1.23` HTTP API in the `app` namespace. It serves JSON on TCP/8080 to upstream callers (an internal gateway), writes to Postgres in the `data` namespace, and makes outbound HTTPS calls to a single SaaS endpoint (`api.stripe.com`) for payment processing. It also exposes Prometheus metrics on TCP/9100.

## Generated NetworkPolicy

```yaml theme={null}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: order-api
  namespace: app
  labels:
    kguardian.dev/managed-by: kguardian
    kguardian.dev/version: v1.0.0
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: order-api
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: edge
          podSelector:
            matchLabels:
              app.kubernetes.io/name: api-gateway
      ports:
        - protocol: TCP
          port: 8080
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
          podSelector:
            matchLabels:
              app.kubernetes.io/name: prometheus
      ports:
        - protocol: TCP
          port: 9100
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: data
          podSelector:
            matchLabels:
              app: postgres
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
```

Kubernetes-native NetworkPolicy cannot express "egress to `api.stripe.com`" by hostname. In real generator output, that traffic appears as a `/32` `ipBlock` egress rule for the observed IP (not shown above) — functional, but brittle for CDN-backed endpoints whose addresses rotate.

## Generated CiliumNetworkPolicy

```yaml theme={null}
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: order-api
  namespace: app
  labels:
    kguardian.dev/managed-by: kguardian
    kguardian.dev/version: v1.0.0
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: order-api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app.kubernetes.io/name: api-gateway
            io.kubernetes.pod.namespace: edge
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            app.kubernetes.io/name: prometheus
            io.kubernetes.pod.namespace: monitoring
      toPorts:
        - ports:
            - port: "9100"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            app: postgres
            io.kubernetes.pod.namespace: data
      toPorts:
        - ports:
            - port: "5432"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s-app: kube-dns
            io.kubernetes.pod.namespace: kube-system
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
```

## Generated seccomp profile (excerpt)

Full profile contains **97 syscall names**. Representative excerpt:

```json theme={null}
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64"],
  "syscalls": [
    {
      "names": [
        "accept4", "bind", "close", "connect", "epoll_create1",
        "epoll_ctl", "epoll_pwait", "futex", "getrandom",
        "getsockname", "listen", "openat", "read", "recvfrom",
        "sendto", "setsockopt", "socket", "write"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "clone", "execve", "exit_group", "mmap", "mprotect",
        "munmap", "rseq", "rt_sigaction", "rt_sigreturn",
        "sched_yield", "tgkill"
      ],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}
```

## What kguardian observed

The Go runtime makes this profile easy to recognise: heavy `futex` (goroutine scheduling), `getrandom` (TLS), `rseq` and `sched_yield` (scheduler hints), and a small file-I/O footprint. Network-wise, the controller saw three distinct egress destinations — Postgres in the `data` namespace, CoreDNS for DNS, and `api.stripe.com` resolved at runtime. The generator does not emit hostname-based rules, so the Stripe traffic is covered by a `/32` `ipBlock` egress rule for the resolved IP. That works, but is brittle for CDN-backed endpoints like Stripe whose addresses rotate — expect to re-generate or hand-maintain that rule.