<p>I'm trying to figure out which the best approach to verify the network policy configuration for a given cluster.
<a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">According to the documentation</a></p>

<blockquote>
  <p>Network policies are implemented by the network plugin, so you must be
  using a networking solution which supports NetworkPolicy - simply
  creating the resource without a controller to implement it will have
  no effect.</p>
</blockquote>

<p>Assuming I have access only through kubectl to my cluster, what should I do to ensure the network policy resource deployed into the cluster will be honored?</p>

<p>I'm aware about the CNI available and the <a href="https://chrislovecnm.com/kubernetes/cni/choosing-a-cni-provider/" rel="nofollow noreferrer">related matrix capabilities</a>.<br>
I know you could check for the pod deployed under kube-system that are related to those CNI and verify the related capabilities using for ex. the matrix that I shared, but I wonder if there's a more structured approach to verify the current CNI installed and the related capabilities.</p>

<p>Regarding the "controller to implement it", is there a way to get the list of add-on/controller related to the network policy?</p>

Crixo
<blockquote>
  <p>Which the best approach to verify the network policy configuration for
  a given cluster?</p>
</blockquote>

<p>If you have access to the pods, you can run tests to make sure that your NetworkPolicies are effective or not. There are two ways for you to check it:</p>

<ul>
<li>Reading your NetworkPolicy using kubectl (<code>kubectl get networkpolicies</code>). </li>
<li>Testing your endpoints to check if NetworkPolicies are effective. </li>
</ul>

<blockquote>
  <p>I wonder if there's a more structured approach to verify the current
  CNI installed and the related capabilities.</p>
</blockquote>

<p>There is no structured way to check your CNI. You need to understand how your CNI works to be able to identify it on your cluster. For Calico for example, you can identify it by checking if calico pods are running. (<code>kubectl get pods --all-namespaces --selector=k8s-app=calico-node</code>)</p>

<blockquote>
  <p>Regarding the "controller to implement it", is there a way to get the
  list of add-on/controller related to the network policy?</p>
</blockquote>

<p>"controller to implement it" is a reference to the CNI you are using. </p>

<p>There is a tool called <a href="https://orca.tufin.io/netpol/?yaml=apiVersion:%20networking.k8s.io/v1%0Akind:%20NetworkPolicy%0Ametadata:%0A3name:%20test-network-policy%0A3namespace:%20default%0Aspec:%0A3podSelector:%0A5matchLabels:%0A7role:%20db%0A3policyTypes:%0A3-%20Ingress%0A3-%20Egress%0A3ingress:%0A3-%20from:%0A5-%20ipBlock:%0A9cidr:%20172.17.0.0/16%0A9except:%0A9-%20172.17.1.0/24%0A5-%20namespaceSelector:%0A9matchLabels:%0A11project:%20myproject%0A5-%20podSelector:%0A9matchLabels:%0A11role:%20frontend%0A5ports:%0A5-%20protocol:%20TCP%0A7port:%206379%0A3egress:%0A3-%20to:%0A5-%20ipBlock:%0A9cidr:%2010.0.0.0/24%0A5ports:%0A5-%20protocol:%20TCP%0A7port:%205978" rel="nofollow noreferrer">Kubernetes Network Policies Viewer</a> that allows your to see graphically your NetworkPolicy. This is not connected to your question but it might help you to visualize your NetworkPolicies and understand what they are doing. </p>
