Try Kubius
⌘K

Optimisation & nodes

Network Policy Simulator

The Network Policy Simulator (a Kubius Pro feature) answers “can pod A reach pod B?” by evaluating the cluster’s NetworkPolicies - so you can check connectivity before shipping a policy, or work out why traffic is being dropped. Open it from the FEATURES band in the sidebar.

It computes entirely from the watched NetworkPolicy, Pod and Namespace objects - no traffic is sent.

Using it

  1. Pick a source pod and a target pod.
  2. Optionally enter a port to check a specific one (leave blank for any).

Kubius shows a clear Reachable or Blocked verdict, then breaks it down by direction:

  • Egress - A → whether the source pod is allowed to send to the target.
  • Ingress - → B whether the target pod is allowed to receive from the source.

Each card explains the outcome and names the policies responsible - the policy that admits the traffic when allowed, or the policies isolating the pod when blocked. Traffic is reachable only when egress and ingress both allow it.

How it evaluates

Kubius implements native NetworkPolicy semantics:

  • A policy selects pods via its podSelector (an empty selector selects every pod in its namespace).
  • A pod is isolated for a direction only once a policy that applies to that direction selects it - until then, all traffic in that direction is allowed (default-allow).
  • Once isolated, traffic is permitted only if a rule’s peers admit it - matched by pod selector, namespace selector, ipBlock (CIDR with exceptions) and ports. Both matchLabels and matchExpressions are supported.

Caveats

  • Only native Kubernetes NetworkPolicies are evaluated. CNI-specific policies (Cilium, Calico CRDs), service meshes, admission webhooks and L7 rules are not considered - the real path may be more restricted than shown.
  • Named ports aren’t resolved (they’d need the target’s container spec); check by number.
  • ipBlock matching needs the source pod to have an assigned IP.