shadcn.io is not affiliated with official shadcn/ui
Network Policies Dashboard Block for Svelte
A coverage audit of six Kubernetes namespaces with the share of pods selected by ingress and egress policies, the picked namespace's pods with lock marks, and a popover with the default-deny manifest and a copy button.
Installation
Overview
Find the pods that no network policy covers with this coverage audit for Svelte with Ark UI. A hairline frame with a plus mark on each corner lists six Podfence namespaces as rows: the pod and policy counts and two bars, the share of its pods selected by at least one ingress policy and by at least one egress policy, worked out from the typed pods and policies. The header sentence counts the unprotected pods, the ones neither selects. Picking a namespace fills an 18rem side cell with its pods: each name in mono, a lock for covered ingress and one for covered egress, and the word Uncovered when neither is. The foot's Shine Button opens a Popover with the default-deny manifest and a Copy Button; Add in this demo gives the namespace that policy, and its pods and bars read 100%. It's built from Popover, Copy Button, Shine Button and Guides. For platform teams and cluster reviews.
FAQ
How do I fill it with my cluster?
Edit NAMESPACES. A namespace has pods, each with an app label, and policies, each saying whether it covers ingress or egress and which app labels it selects (or * for every pod). The bars, the lock marks, the Uncovered words and the header count are all worked out from those, never typed.
How is coverage worked out?
A pod counts as covered for ingress when at least one ingress policy selects it, by its app label or by selecting every pod, and the same for egress. The bar is the covered pods divided by all pods, rounded to a whole percent. A namespace with no policies reads 0% on both bars, and a default-deny policy brings both to 100%.
What does the default-deny policy do?
The manifest selects every pod in the namespace and lists both Ingress and Egress as policy types, so nothing is allowed until another policy allows it. Adding it here appends it to the namespace's policies on the page. The copy button puts the same manifest on your clipboard, and a namespace that already has one says so instead of adding a second.
What stays local, and how do I wire it for real?
Everything: the pods and policies are typed and nothing is applied to a cluster. To make it real, list the pods and policies through your cluster's API, apply the manifest from your own pipeline, and keep in mind that a default-deny policy can break traffic that other policies do not yet allow.