Skip to main content
Network Policies control pod-to-pod and pod-to-external traffic at the network level. Radar supports standard Kubernetes NetworkPolicy, Cilium policies, and Calico policies, providing visibility into what traffic is allowed, denied, and which workloads are unprotected.

​
What Radar Shows

Topology: Kubernetes, Cilium, and Calico policy nodes appear in the topology graph with edges connecting them to the Deployments, StatefulSets, and DaemonSets they protect. Calico matching evaluates workload, namespace, and service-account selectors. Staged Calico policies use dashed edges and preview styling so they are not mistaken for enforced protection; a staged policy whose stagedAction is Delete or Ignore draws no edge at all, because promoting it would remove protection rather than add it.
Calico policy topology

Calico policy topology - enforced relationships use solid edges; staged previews use dashed edges

Policy Flow Diagram: Each NetworkPolicy detail drawer includes a visual flow diagram showing ingress and egress rules as a directional graph - sources on the left, targets on the right, with ports and protocols labeled. Quickly understand what a policy allows without reading YAML.
Policy Flow Diagram

Policy Flow Diagram - visual representation of ingress and egress rules

Dashboard Coverage Card: The home dashboard includes a Network Policy Coverage card showing total policy count, the percentage of workloads covered by at least one enforced policy, and a count of uncovered workloads. When staged Calico policies exist, it separately shows projected coverage if those policies were applied. That projection can be lower than today’s coverage - a staged deletion removes the protection of the policy it names - and the bar marks the part that would be lost.
Network Policy Coverage Card with staged Calico coverage

Dashboard coverage separates enforced protection from the projected result of applying staged policies

Cilium Policy Detail View:
  • Endpoint selector targeting
  • Ingress/egress rules with allow and deny semantics
  • Cilium-specific entity selectors (world, cluster, host)
  • CIDR rules, port/protocol specifications
  • Related workloads with clickable links
CiliumNetworkPolicy Detail

CiliumNetworkPolicy Detail - endpoint selector, ingress deny from world, egress allow to cluster

Calico Policy Detail View:
  • Flow diagram for ordered ingress and egress rules, including Allow, Deny, Log, and Pass actions
  • Workload, namespace, and service-account selectors
  • Tier, order, policy types, pre-DNAT, apply-on-forward, and do-not-track settings
  • Calico entities, CIDRs, ports, protocols, HTTP matches, and ICMP matches
  • Staged action and preview styling for staged policy variants
Calico NetworkPolicy detailCalico staged NetworkPolicy detail

Enforced and staged policy flows - staged rules are explicitly marked as evaluated but not enforced

Calico Infrastructure Detail Views: IPPool details show CIDR, encapsulation, NAT, block size, assignment mode, and node selectors. HostEndpoints show interface, expected IP addresses, profiles, and a link to the owning Node. Tier details show order and default action, and policies link back to their Tier. Radar recognizes both projectcalico.org and crd.projectcalico.org. A cluster running the Calico API server serves the same stored policies under both, so each policy appears once, identified by kind, namespace and name. The API group stays part of resource navigation and authorization - it is what keeps Calico NetworkPolicy distinct from Kubernetes networking.k8s.io NetworkPolicy - and a policy is shown to anyone authorized to list it under either group, since either grant is enough to read it. Standard NetworkPolicy Detail View:
  • Pod selector and namespace selector rules
  • Ingress and egress rules with CIDR blocks, ports, and protocols
  • Policy type indicators (Ingress, Egress, or both)
  • Related resources showing protected workloads
Traffic View Integration: When Hubble is available, dropped flows are correlated with the network policies that caused them, showing which policy denied specific traffic in real time.
Traffic Drop Correlation

Traffic View - dropped flow with POLICY_DENIED reason and selecting policy correlation

​
Supported Resources

​
Calico Coverage Limits

Radar statically evaluates Calico selectors against workload pod templates and the Namespace and ServiceAccount objects it can read. The result describes declared policy coverage, not live CNI enforcement or packet-level behavior. Missing labels or RBAC-restricted resources can prevent a relationship from being inferred, and staged policies are never included in enforced coverage. The projected “if staged” figure assumes every staged policy is promoted at once; it is a projection of the declared rules, not a simulation of what the data plane would do.