A refreshed Network Policy Editor website and two new VS Code extensions

We've refreshed the Network Policy Editor website, and we're launching two free VS Code extensions: Network Policy Tools and Network Policy Visualizer. The editor lets you build and explore policies visually in the browser. The extensions add schema feedback and an interactive policy map to VS Code, so you can keep working on the YAML in your IDE.

The refreshed Network Policy Editor website

Isovalent introduced the Network Policy Editor in 2021 to help people create and visualize both Kubernetes and Cilium network policies, and helpful tutorials to teach policy building skills. Over the past month, the site has seen daily unique views well into the thousands.

We've given the website a fresh look and updated its Cilium Network Policy support for additional policy features. You can build either Kubernetes NetworkPolicy or Cilium Network Policy visually, with selectors and ingress or egress rules shown on the map. Cilium policy authoring also includes new controls for FQDN destinations, ports, ICMP, HTTP rules and server names.

One of the areas of feedback we’ve heard over the years is that the Network Policy Editor website has helped you, the community with your studies for exams such as the Cilium Certified Associate (CCA), Certified Kubernetes Administrator (CKA) and we are sure it’ll still be a tool of choice for the new Certified Kubernetes Network Engineer (CKNE) as well, which uses Cilium as one of its core open source projects to test candidates.

New VS Code extensions for network policy

We're also launching two free VS Code plugins to bring policy editing and visualization into your IDE. Network Policy Tools provides YAML completion and schema feedback as you write. Network Policy Visualizer shows the policy as an interactive map alongside your YAML.

You can get started today by installing both plugins below from the VS Code Marketplace, either from our Isovalent page, or directly in VS Code itself.

Network Policy Tools: schema feedback as you write

Network Policy Tools, or NPT, adds completion, hover information, and schema diagnostics for network policy YAML in VS Code. It identifies recognized policies from their apiVersion and kind, then supplies the corresponding bundled JSON Schema to Red Hat's YAML extension. VS Code installs that YAML extension as a dependency.

Features

• Autocompletion: Suggests field names, values, and structures based on CRD schemas
• Validation: Highlights invalid fields and values directly in the editor
• Auto-detection: Automatically applies the correct schema based on apiVersion and kind in YAML files

Consider this illustrative CiliumNetworkPolicy. Its ingress rule allows pods labelled app=frontend in the demo namespace to contact pods labelled app=api there on TCP port 8080. The example is for local editing and inspection; it has not been deployed or tested in a cluster.

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: api-from-frontend
  namespace: demo
spec:
  endpointSelector:
    matchLabels:
      app: api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP

While editing a file like this, NPT suggests field names and values. Hover information explains field types, and diagnostics highlight fields or values that do not fit the bundled schema. That helps you catch structural mistakes while the relevant YAML is still in front of you.

You can see this in the GIF below, where the autocompletion feature shows the available entitles under egress, and the service map automatically updates.

Network Policy Visualizer: a map beside your YAML

Installing the Network Policy Visualizer, or NPV, displays your network policy as an interactive map beside its Policy YAML in VS Code. This is based on the same code as the Network Policy Editor website, so both display the latest features.

The map updates as you edit the YAML. Changes made through the visual editor also update the YAML buffer, so you can inspect how a visual change affects the manifest.

Features:

• Side-by-side visualization: Opens a panel next to your YAML editor showing the policy map
• Live updates: The map updates as you edit the YAML
• Automatic detection: Recognizes supported network policy YAML files by apiVersion and kind
• Real-time flow visibility: Connect to Hubble Timescape to see the flows of the workloads the policy selects

The below GIF shows this in action:

For existing Isovalent customers, NPV can also connect to Hubble Timescape, part of Isovalent Enterprise Platform, to display recorded flows alongside the policy map. This optional integration supports Timescape 1.20 and later.

When editing the policy selectors in your YAML, the flows retrieved from Hubble Timescape will update to reflect that selection.

Try it for yourself

Whether you're using Kubernetes Network Policies or have deployed Cilium or Isovalent Networking for Kubernetes, these tools are designed to reduce the burden of creating, configuring and managing network policies.

If you manage policies through GitOps, the IDE plugins can help before you commit to Git. Use Network Policy Tools for schema feedback as you write, then open Network Policy Visualizer to review the policy map alongside the YAML. From there, the manifest can follow your existing pull request and deployment process.

For teams using Isovalent Networking for Kubernetes, Isopolicy lets you check proposed Cilium policy changes and preview their effect on traffic before rollout. Hubble Timescape helps you investigate live and recorded traffic and review how policy changes affect connectivity.

For more on managing Cilium policies through Git, read From Tickets to Pull Requests: Running Cilium in a GitOps Platform. You can also explore these workflows in our hands-on labs:

• GitOps Platform Engineering with Cilium: take policy changes through Git and pull requests.
• Connectivity Visibility with Hubble Timescape: investigate traffic and policy changes.
• Isovalent Network Policy Governance: practise staged policy changes and separate platform guardrails from application access.

We'd love to hear your feedback on the refreshed website and both VS Code plugins. Join us in Cilium Slack to share your suggestions or report issues.

Dean Lewis, Senior Technical Marketing Engineer

Dean Lewis is a Senior Technical Marketing Engineer at Isovalent - the company behind the open-source cloud native solution Cilium. Dean had a varied background working in the technology fields, from support to operations to architectural design and delivery at IT Solutions Providers based in the UK, before moving to VMware and focusing on cloud management and cloud native, which remains as his primary focus. You can find Dean in the past and present speaking at various Technology User Groups and Industry Conferences, as well as his personal blog.