See whether pod-to-pod traffic is actually allowed
NetworkPolicies are hard to reason about - ingress, egress, selectors and namespaces all stacking up. Kubius simulates a connection between any two pods and tells you allowed or denied, and which policy made the call.
Works with Google GKE, Amazon EKS, Azure AKS, DigitalOcean, self-managed & more · macOS Sonoma (14) or later
Answer "can A talk to B?" with certainty
Simulate a connection
Pick a source and destination pod and a port, and Kubius evaluates the effective policy set - returning a clear allowed or denied, the way the cluster would.
See which policy decided
The result points at the exact NetworkPolicy (and rule) that allowed or blocked the traffic, so you fix the right one instead of guessing.
Ingress and egress together
Both directions are considered - a connection only succeeds if egress from the source and ingress to the destination both permit it.
Selectors made legible
Pod and namespace selectors are rendered in plain language, so you can see what each policy actually targets without decoding YAML label maths.
Live against the real cluster
Simulations run against the policies live in the cluster, so what you test is what's deployed - no stale copy, no separate tool to sync.
Catch gaps before they bite
Verify that a lockdown really blocks what it should - and that you haven't accidentally cut off traffic your app depends on.
Why Kubius for NetworkPolicies
Reason about network policy visually
Part of Kubius Pro - included in the free trial.
- Allowed / denied verdict for any source→destination pod + port
- Names the exact policy and rule that decided
- Evaluates ingress and egress together
- Selectors shown in plain language
- Runs live against the policies actually deployed
- 14-day free trial, no card required
Simple, one-time pricing
Pay once. No subscription.
One-time licence from €49 - no subscription. 14-day free trial, no card required.
Free 14-day trial · macOS Sonoma (14) or later · No agents, nothing to install in-cluster
Questions, answered
What does the Network Policy Simulator do?
You choose a source pod, a destination pod and a port, and Kubius evaluates the cluster's effective NetworkPolicies to tell you whether that traffic would be allowed or denied - and which policy made the decision.
Does it consider both ingress and egress?
Yes. A connection is only allowed when egress from the source and ingress to the destination both permit it, and Kubius evaluates both sides.
Does it change anything in my cluster?
No - simulation is read-only. It evaluates the policies that are already deployed; it doesn't create or modify any resources.
Is this a Standard or Pro feature?
The Network Policy Simulator is part of Kubius Pro, and the 14-day free trial includes every Pro feature so you can try it on your own clusters.