NetworkPolicy YAML Generator

A NetworkPolicy describes how groups of pods are allowed to communicate with each other and with the network. The NetworkPolicy YAML Generator writes that manifest from a form so you do not have to recall the networking.k8s.io/v1 schema.

You set the policy name and namespace, then the pod selector (matchLabels) that picks the pods the policy governs. You choose policy types - Ingress, Egress or both - and then define rules. Each ingress or egress rule can list TCP ports and peers to allow: pods with a label, namespaces with a label, or CIDR ranges. If a direction has no rules it denies all traffic in that direction. The resulting YAML is valid networking.k8s.io/v1.

The name is validated as an RFC 1123 label, the pod selector needs at least one label, and at least one policy type must apply. Problems are reported in a clear panel. Everything runs locally and nothing is uploaded.

• podSelector - matchLabels (key=value, comma separated).
• policyTypes - Ingress, Egress (comma separated).
• Ingress rules - ports plus pod, namespace or CIDR peers.
• Egress rules - ports plus pod, namespace or CIDR peers.
• networking.k8s.io/v1 - correct schema.
• Validation - RFC 1123 name, selector and policy types.
• Copy / Download / Print - get networkpolicy.yaml wherever you need it.

1. Name the policy. Type a valid RFC 1123 name.
2. Set the pod selector. e.g. app=web.
3. Pick policy types. Ingress and/or Egress.
4. Add ingress/egress rules. ports and peers to allow.
5. Watch the preview and export.

Example 1 - allow web ingress. podSelector app=web, Ingress, ports 80, from app=frontend.

Example 2 - egress to CIDR. Egress, to 10.0.0.0/24 on 443.

Example 3 - deny all ingress. Ingress with no rules.

Example 4 - namespace peer. from namespace team=payments.

Example 5 - both directions. Ingress and Egress.

• Correct schema - valid networking.k8s.io/v1 NetworkPolicy.
• Flexible peers - pod, namespace and CIDR sources.
• Validated - names and required fields checked.
• Clean output - empty fields omitted.
• Private - everything runs in the browser.
• Copy, download or print - get the manifest where you need it.