netpol-audit

name	netpol-audit
description	Inventory and audit Kubernetes NetworkPolicy coverage stored in ConfigHub across the fleet, using the cub-netpol CLI. Use for "what NetworkPolicies do we have?", "which namespaces have no default-deny?", "which workloads are uncovered?", "per-cluster NetworkPolicy/namespace/workload counts", "list the policies in apptique-prod", "audit our network segmentation". Not for "who can reach X" connectivity (use netpol-connectivity) or hygiene/anti-pattern checks (use netpol-findings); not for live cluster state (use kubectl); coverage is over ConfigHub-managed Units only.
phase	verify
allowed-tools	Bash(cub-netpol --help) Bash(cub-netpol * --help) Bash(cub auth status) Bash(cub-netpol preflight) Bash(cub-netpol snapshot) Bash(cub-netpol snapshot *) Bash(cub-netpol list) Bash(cub-netpol list *) Bash(cub-netpol coverage) Bash(cub-netpol coverage *)

netpol-audit

Inventory the NetworkPolicy-relevant config ConfigHub holds across the fleet, and report coverage — which namespaces have a default-deny and which workloads no policy selects. This is the "what do we have / where are the gaps" surface; it never mutates.

Why this matters

A per-resource validator only ever sees one object, so it can't answer the questions that matter for segmentation — does every namespace have a default-deny? is any workload uncovered? Those are properties of the whole set. cub-netpol loads a fleet snapshot (NetworkPolicies + Namespaces + workloads + Services, joined with Space/Target metadata) and reasons over it together. Clusters are ConfigHub Targets (the Space slug stands in for unbound Units). Coverage is computed over ConfigHub-managed Units only. Output is JSON by default; add -o table for humans.

When to use

• "What NetworkPolicies do we have across the fleet?" / "audit our network segmentation."
• "Which namespaces have no default-deny ingress?" / "which workloads are uncovered?" → coverage.
• "Per-cluster counts of policies / namespaces / workloads / services" → snapshot.
• "List the NetworkPolicies (or namespaces/workloads) in cluster/namespace X" → list.

Do not load for

• "Who can reach X?" / "what can X reach?" — connectivity (use netpol-connectivity).
• "Any allow-all / metadata-egress / asymmetry / anti-patterns?" — hygiene (use netpol-findings).
• Live cluster NetworkPolicy not in ConfigHub — kubectl get netpol.

Preflight gates

1. cub-netpol preflight succeeds (the ConfigHub session is valid against the server). If it fails, ask the user to run cub auth login (an interactive browser sign-in an agent cannot complete), then retry.

The toolkit

Fleet inventory — cub-netpol snapshot

Per-cluster counts of NetworkPolicy / Namespace / workload / Service, plus Units, gated, and unapplied. Canonical base/policy Spaces are excluded.

cub-netpol snapshot -o table

Coverage gaps — cub-netpol coverage

Per namespace: is a default-deny ingress/egress present, how many workloads, how many uncovered. This is the headline audit.

cub-netpol coverage -o table
cub-netpol coverage --namespace payments
cub-netpol coverage --direction ingress    # only namespaces with an ingress gap

Explorer — cub-netpol list

Every NetworkPolicy-relevant resource (NetworkPolicy, Namespace, workloads, Service) with its cluster, Space, and Unit.

cub-netpol list --kind NetworkPolicy -o table
cub-netpol list --cluster prod-cluster --namespace apptique

Scoping the fleet

Scope server-side with a single Unit --where predicate — one Unit-level filter can reference Unit, Space, and Target metadata, so prefer it over post-filtering large JSON. Example: --where "Target.ProviderType = 'OCI'" (Units bound to an OCI Target) or --where "Space.Slug LIKE 'prod-%'".

For the standard Space labels, use the shorthands --component, --environment, --region, --owner, --layer, --variant (each compiles to Space.Labels.<Key> = '<value>'), AND-joined with any raw --where. ConfigHub where is flat AND-only — no parentheses, no OR (a parenthesized clause fails with invalid attribute name); express alternatives as separate runs.

--cluster / --namespace are client-side display filters over the fetched snapshot, not server-side scope. Tip: bind base/template Units to a Noop-ProviderType dummy Target (a no-apply, server-hosted bridge) so every Unit is targeted and Target.Slug is a consistent grouping key.

Stop conditions

• Snapshot empty (no Kubernetes/YAML Units in scope) — report it; suggest widening scope or checking cub auth status / org context.
• The question is about effective reachability or anti-patterns — hand off to netpol-connectivity / netpol-findings.

Tool boundary

Read-only inventory + coverage. Mutations live in netpol-fix / netpol-fleet. Never use kubectl to answer a ConfigHub-state question.

References

• cub-netpol snapshot --help, cub-netpol coverage --help, cub-netpol list --help.
• Companion skills: netpol-connectivity, netpol-findings, netpol-fix.