K8s NetworkPolicy compliance audit engine - 8-rule security catalogue (NP-001-008)
7.8K
Part of the NetworkPolicy Intelligence System (NPI) — a six-layer security observability platform for OpenShift/Kubernetes built on OVN-Kubernetes.
Watches live NetworkPolicy resources via the Kubernetes API (watch stream) and evaluates every
policy change against an 8-rule security catalogue:
| Rule | Check |
|---|---|
| NP-001 | Default-deny ingress present per namespace |
| NP-002 | Overly permissive ingress ({} selector) |
| NP-003 | Missing egress restriction |
| NP-004 | Missing DNS egress rule (ports 53 and 5353) |
| NP-005 | Namespace label selector best practices |
| NP-006 | Policy naming/documentation conventions |
| NP-007 | Cross-namespace traffic without explicit allow |
| NP-008 | Router ingress path missing dual namespace selector |
Findings are written to a TimescaleDB hypertable and feed a per-namespace compliance score
(100 − CRITICAL×20 − HIGH×10 − MEDIUM×5 − LOW×2, graded A–F). A 5-minute per-namespace
cooldown prevents duplicate findings during policy-controller reconciliation bursts.
Python 3.11 · kubernetes client v29 · psycopg2 · TimescaleDB
docker pull nassimsai/audit-engine:v1.0-pfe2026
Requires: DATABASE_URL env var (TimescaleDB DSN) and a ServiceAccount with get/list/watch
on networkpolicies, pods, namespaces.
Content type
Image
Digest
sha256:7352e3917…
Size
78 MB
Last updated
4 months ago
docker pull nassimsai/audit-engine