Glossary

A violation that you mark as accepted, with a reason. You add the annotation networkenforcer.kubewarden.io/acknowledge-<id> to the WorkloadNetworkPolicy, with the reason as the value. The <id> is the id of the violation record. The controller moves the record to status.acknowledgedViolations, keeps the reason, and removes the annotation. It also emits a policy_violation_acknowledged event.

A violation record that is still in status.violations. It is not acknowledged. The field status.activeViolationCount holds the number of active violations. This is the number that needs a decision.

The set of peers, protocols, and ports that a workload can talk to, in one direction. It is the spec.kubernetes or spec.istio payload of a WorkloadNetworkPolicyProposal or a WorkloadNetworkPolicy. A flow that is not in the allow-list is a violation.

An Istio resource, security.istio.io/v1. The native policy object for the istio backend. The controller renders one per WorkloadNetworkPolicy, with action: ALLOW, the learned principals, and the learned ports. In monitor mode it carries the dry-run annotation.

The policy model that a proposal or policy carries. It is the field spec.backend. The values are istio and kubernetes. The provider decides the backend: the istio provider writes the istio backend, the calico and cilium providers write the kubernetes backend. The field cannot change after creation.

A property of monitor mode. The controller reports a violation only for a flow that the scraper sees. On Istio, ztunnel logs cover inbound TCP through the mesh only. On Calico and Cilium, the controller compares the same flows that drive learning. A flow that is not observed is not reported.

A CNI. A provider of Kubewarden Network Enforcer. The flow source is Goldmane. The backend is kubernetes. Learning covers TCP and UDP, in both directions.

A prerequisite. Together with the cert-manager CSI driver, it issues the TLS certificates for the OpenTelemetry collector and for the OTLP ingestion endpoint of the controller.

A CNI. A provider of Network Enforcer. The flow source is Hubble Relay. The backend is kubernetes. Learning covers TCP and UDP, in both directions.

Container Network Interface. The plugin that connects pods to the network and enforces Kubernetes NetworkPolicy resources. Network Enforcer supports Calico and Cilium as providers. Istio ambient keeps the CNI in place and adds its own data plane on top.

The only component that Network Enforcer installs, as a Deployment with one replica. It runs the scraper and four reconcilers. The learning reconciler writes proposals. The proposal reconciler handles promotion. The policy reconciler writes the native policy object. The status sync writes violations to the policy status. The controller also exports events to the OpenTelemetry collector.

The layer that forwards traffic between pods and enforces network policy. Network Enforcer does not observe traffic on its own. It reads flows from the data plane that already runs in the cluster, and it writes policy in the format of that data plane. See provider.

Ingress or egress. Ingress is traffic that a workload receives. Egress is traffic that a workload sends. Each proposal and policy covers one workload in one direction. The name ends in -ingress or -egress. With the kubernetes backend, one connection produces an egress proposal on the source and an ingress proposal on the destination. With the istio backend, learning produces ingress proposals only.

The monitor behavior on Istio ambient. The AuthorizationPolicy carries the annotation istio.io/dry-run: "true". ztunnel evaluates the policy and logs the decision, but does not deny the connection. In protect mode the controller removes the annotation. The feature needs the istiod flag AMBIENT_ENABLE_DRY_RUN_AUTHORIZATION_POLICY.

Traffic between workloads inside the cluster. Network Enforcer learns and enforces this traffic only. It does not learn traffic to or from destinations outside the cluster.

One observed connection between two workloads: source, destination, protocol, and port. The scraper turns each flow into a learning event or a violation observation. A flow with one end outside the cluster, or on a hostNetwork pod, is dropped.

An optional debug endpoint of the controller. The scraper writes each flow to a ring buffer. A GET /flow request drains the buffer and returns the flows as JSON lines. It is off by default. Enable it with the Helm value controller.flowDumper.enabled.

The service that the scraper reads flows from. It depends on the provider: ztunnel logs for Istio ambient, Goldmane for Calico, Hubble Relay for Cilium.

A log forwarder. With the istio provider, the Helm chart deploys it as the istio-fluent-bit DaemonSet. It reads the ztunnel log files on each node, parses the JSON, and sends the records to the controller as OTLP logs on port 4317.

The flow aggregation service of Calico. The flow source for the calico provider. The controller reads it over gRPC with mutual TLS. Enable it in the Tigera Installation resource with goldmane.enabled=true.

The observability service of Cilium. The flow source for the cilium provider. The controller follows the GetFlows stream over gRPC. Enable it with hubble.enabled=true and hubble.relay.enabled=true.

The sidecar-free mode of Istio. The default provider of Network Enforcer. The flow source is the log of ztunnel, forwarded by fluent-bit. The backend is istio. Enforcement happens at the destination ztunnel, inbound, for TCP only. A namespace joins the mesh with the label istio.io/dataplane-mode=ambient. The label must be present before the pods are created.

The first phase. The scraper observes flows. The controller writes them to a WorkloadNetworkPolicyProposal for each workload and direction. Nothing is blocked. Learning is cluster-wide and starts when the controller starts. It does not reconstruct flows from before that moment. Learning stops for a workload and direction when a WorkloadNetworkPolicy with the same name exists.

The field spec.mode of a WorkloadNetworkPolicy. The values are monitor and protect. The default is monitor. You change the mode with kubectl edit or kubectl patch.

A phase and a mode. The controller reports each flow that the policy does not allow as a violation, with action: monitor. Nothing is blocked. On Istio, the AuthorizationPolicy runs in dry-run. On Calico and Cilium, no native policy object exists in this mode. See best-effort monitor.

The resource that the data plane enforces. For the istio backend it is an AuthorizationPolicy. For the kubernetes backend it is a NetworkPolicy. The controller creates it with the same name and namespace as the WorkloadNetworkPolicy, and sets an owner reference to the policy.

A Kubernetes resource, networking.k8s.io/v1. The native policy object for the kubernetes backend. The CNI enforces it. The controller creates it in protect mode only, and deletes it when the mode returns to monitor.

The service that receives the violation events from the controller. The Helm value telemetry.collectorStrategy selects it: default deploys a collector, external points at your own, none turns the export off. The controller emits a policy_violation_observed event for each violation and a policy_violation_acknowledged event for each acknowledgement. The bundled collector exports the Prometheus counter network_enforcer_policy_denies. This export path is separate from the OTLP ingestion path that fluent-bit uses.

The other workload of a flow. In the kubernetes backend, a peer is a namespaceSelector and a podSelector. In the istio backend, a peer is a principal.

One of the three stages of the Network Enforcer workflow: learn, monitor, and protect. Monitor and protect are also the two values of the mode field. Learn has no mode. In the learn phase, the workload has a WorkloadNetworkPolicyProposal and no WorkloadNetworkPolicy.

The identity of a workload in Istio ambient, in SPIFFE form: cluster.local/ns/<namespace>/sa/<serviceaccount>. It comes from the ServiceAccount of the pod. Pods without an explicit ServiceAccount use default, so they share one principal. The istio backend names peers by principal.

The label networkenforcer.kubewarden.io/promote on a WorkloadNetworkPolicyProposal. The value is monitor or protect. It starts the promotion. A Validating Admission Policy rejects other values.

The label networkenforcer.kubewarden.io/promoted-from on a WorkloadNetworkPolicy. Its value is the name of the proposal that the policy came from. The controller sets it. The controller uses it to delete a proposal that the scraper creates again after promotion.

The step from a WorkloadNetworkPolicyProposal to a WorkloadNetworkPolicy. You set the promote label on the proposal. The controller creates the policy with the same name, namespace, and allow-list. It sets the mode from the label and the promoted-from label. Then it deletes the proposal. Promotion is explicit. Network Enforcer does not promote on its own.

A phase and a mode. The data plane blocks each flow that the policy does not allow. The connection fails with a timeout, a reset, or a refusal. The data plane decides which. The controller records a violation with action: protect. On Istio, the dry-run annotation is removed. On Calico and Cilium, the controller creates the NetworkPolicy.

The data plane that Network Enforcer reads from and writes to. You select it once, at installation, with the Helm value controller.provider.name. The values are istio (default), calico, and cilium. The provider selects the scraper, the flow source, and the backend.

The part of the controller that reads the flow source. One scraper runs, for the selected provider. It turns each flow into a learning event or a violation observation. It does not write Kubernetes objects.

The period at which the controller writes the buffered violation observations to the WorkloadNetworkPolicy status. The Helm value is controller.wnpStatusUpdateInterval. The default is 30 seconds. A violation can take up to one interval to appear in kubectl. The OpenTelemetry events arrive at once.

A Kubernetes admission rule written in CEL. Network Enforcer installs two. One rejects a promote label whose value is not monitor or protect. One rejects a change to the owner reference of a WorkloadNetworkPolicyProposal.

A flow that a WorkloadNetworkPolicy does not allow. In monitor mode the flow passes. In protect mode the data plane blocks it. In both modes the controller emits an event to the OpenTelemetry collector and keeps a violation record.

One entry in status.violations or status.acknowledgedViolations of a WorkloadNetworkPolicy. It holds the id, the source and destination workloads, the protocol, the destination port, and the mode. It also holds the time of the last occurrence and the policy that denied the flow. Each list holds the 100 most recent records. The field status.violationCount counts all the observations that the policy ever had. On Istio, the destination port is always 0.

A Deployment, StatefulSet, or DaemonSet. The learn phase creates one WorkloadNetworkPolicyProposal per workload and direction. Pods with other owners, and pods with hostNetwork: true, are not workloads for learning.

The resource that holds the enforced allow-list of one workload in one direction, plus its mode. Short name wnp. Namespaced. The controller creates it on promotion. You can also write one by hand. The controller renders it to a native policy object. Its status holds the violation records. If you delete it, learning starts again for that workload and direction.

The resource that holds the learned allow-list of one workload in one direction. Short name wnpp. Namespaced. The controller creates it during the learn phase. Its name is the kind, the name, and the direction of the workload, for example deployment-nginx-ingress. It is owned by the workload, so Kubernetes deletes it with the workload. Nothing is enforced while a workload has only a proposal. Promotion replaces it with a WorkloadNetworkPolicy.

The per-node proxy of Istio ambient. It handles the Layer 4 traffic of the pods on its node and enforces AuthorizationPolicy resources on inbound connections. Its JSON log is the flow source for the istio provider. UDP does not pass through ztunnel.