prplanit/polysieve repository overview

⁠PolySieve

Derive Kubernetes network authorization policy from a GitOps repository's own manifests — the source of truth — rather than from a live cluster.

Given a repo of Gateway API HTTPRoutes and Services, PolySieve resolves the least-privilege ingress each namespace actually needs and emits the corresponding policy objects (Cilium CiliumClusterwideNetworkPolicy, Istio AuthorizationPolicy, …).

A sieve is a filter that decides what passes; a network policy is a sieve over traffic (the allow-list is what gets through). "Poly" ⇒ policy and poly-backend.

⁠Why repo-driven

Deriving policy from the live cluster inverts GitOps layering — the committed policy becomes a function of the running cluster. That is non-deterministic, needs cluster access, and can't generate policy for an app that isn't deployed yet (a deploy-then-catch-up gap). Reading the repo instead is deterministic, reproducible, CI-runnable with no cluster, and lets a new app and its policy land in one commit, no gap.

⁠Usage

polysieve generate --repo <gitops-repo>   # write derived policy files
polysieve check    --repo <gitops-repo>   # diff vs committed (nonzero on drift)

Everything is derived from the repo by default:

Settings can also come from a file: --config <path>, or .polysieve.yml at the repo root when present. Flags override the file.

roots: []
labels:
  ingress: example.com/ingress
  probe: example.com/probe
gateways:
  selector: { example.com/client-class: ingress-gateway }
  instanceLabel: example.com/ingress-instance
  podSelector: { example.com/client-class: ingress-gateway }
outputs:
  contract:       { enabled: true, name: contract-ingress-backend, path: "" }
  healthcheck:
    enabled: true
    name: allow-gatus-healthcheck
    path: ""
    prober: { matchLabels: { app.kubernetes.io/name: gatus } }
    serviceAnnotations:
      enabled: gatus.home-operations.com/enabled
      endpoint: gatus.home-operations.com/endpoint
  gatewayIngress: { enabled: true, name: allow-gateway-ingress, dir: "" }

--kustomize, --kubectl and --helm-bin set the binaries.

⁠Architecture

repo → Discovery (generic route-graph) → Render (policy emitters) → policy files

Discovery renders the repo and walks the Gateway API graph (HTTPRoute.backendRefs → Service → targetPort) into a typed RouteGraph. The emitters map that graph to a cluster's concrete policy. See docs/DESIGN.md⁠.

⁠License

AGPL-3.0-only.