feat: [Policy Assistant] walkthrough mode and a README (KubeCon demo PR 2/2)

[huntergregory]

• Finally adding a good README for the project.
• Walkthrough mode is as seen at KubeCon, but the code is no longer as hacky. Fixes [Policy Assistant] Predict Verdict and Flow of Decisions made by Policies #168.
• Probe mode is working too. Fixes [Policy Assistant] Probe Mode #210
• Remove unimplemented analyze modes (related to [Policy Assistant] Remove Cyclonus Code which isn't needed #151). Supported modes are now:
  • --mode strings analysis modes to run; allowed values are explain,probe,walkthrough (default [explain])
• Files used for the demo are included in examples/demos/.

Outputs

walkthrough

Fixes #168. NOTE: the traffic is hardcoded right now. Need to fix in a followup PR that leverages #227 to specify traffic for the walkthrough.

./cmd/cyclonus/cyclonus analyze --policy-path examples/demos/kubecon-eu-2024/policies --mode walkthrough
INFO[2024-10-25T15:14:01-07:00] log level set to 'info'                      
verdict walkthrough:
+---------------------------------------+---------+-------------------------------------------------------------+------------------------------+
|                TRAFFIC                | VERDICT |                     INGRESS WALKTHROUGH                     |      EGRESS WALKTHROUGH      |
+---------------------------------------+---------+-------------------------------------------------------------+------------------------------+
| demo/[pod=a] -> demo/[pod=b]:80 (TCP) | Allowed | [ANP] Allow (allow-80)                                      | no policies targeting egress |
+---------------------------------------+---------+-------------------------------------------------------------+                              +
| demo/[pod=a] -> demo/[pod=b]:81 (TCP) | Denied  | [ANP] Pass (pass-81) -> [BANP] Deny (baseline-deny)         |                              |
+---------------------------------------+---------+-------------------------------------------------------------+                              +
| demo/[pod=b] -> demo/[pod=a]:80 (TCP) | Allowed | [ANP] Allow (allow-80)                                      |                              |
+---------------------------------------+---------+-------------------------------------------------------------+                              +
| demo/[pod=b] -> demo/[pod=a]:81 (TCP) | Denied  | [ANP] Pass (pass-81) -> [NPv1] Dropped (demo/deny-to-pod-a) |                              |
+---------------------------------------+---------+-------------------------------------------------------------+------------------------------+

probe

Fixes #210

./cmd/cyclonus/cyclonus analyze --mode probe --policy-path examples/demos/kubecon-eu-2024/policies --probe-path examples/dem
os/kubecon-eu-2024/demo-probe.json
INFO[2024-10-25T15:12:22-07:00] log level set to 'info'                      
probe (simulated connectivity):
INFO[2024-10-25T15:12:22-07:00] probe on port 80, protocol TCP               
Ingress:
+--------+--------+--------+
|        | DEMO/A | DEMO/B |
+--------+--------+--------+
| demo/a | #      | .      |
| demo/b | X      | #      |
+--------+--------+--------+

Egress:
+--------+--------+--------+
|        | DEMO/A | DEMO/B |
+--------+--------+--------+
| demo/a | #      | .      |
| demo/b | .      | #      |
+--------+--------+--------+

Combined:
+--------+--------+--------+
|        | DEMO/A | DEMO/B |
+--------+--------+--------+
| demo/a | #      | .      |
| demo/b | X      | #      |
+--------+--------+--------+



INFO[2024-10-25T15:12:22-07:00] probe on port 81, protocol TCP               
Ingress:
+--------+--------+--------+
|        | DEMO/A | DEMO/B |
+--------+--------+--------+
| demo/a | #      | .      |
| demo/b | X      | #      |
+--------+--------+--------+

Egress:
+--------+--------+--------+
|        | DEMO/A | DEMO/B |
+--------+--------+--------+
| demo/a | #      | .      |
| demo/b | .      | #      |
+--------+--------+--------+

Combined:
+--------+--------+--------+
|        | DEMO/A | DEMO/B |
+--------+--------+--------+
| demo/a | #      | .      |
| demo/b | X      | #      |
+--------+--------+--------+

[netlify]

✅ Deploy Preview for kubernetes-sigs-network-policy-api ready!

Name	Link
🔨 Latest commit	c776b14
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-sigs-network-policy-api/deploys/67211f4cab52c60008abe1eb
😎 Deploy Preview	https://deploy-preview-245--kubernetes-sigs-network-policy-api.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[huntergregory]

Also, #239 will give us the power to read policies from file/cluster.

I have a local hack imitating #239 to produce outputs using --policy-path

[huntergregory]

Also, #239 will give us the power to read policies from file/cluster.

I have a local hack imitating #239 to produce outputs using --policy-path

removed the hack

[huntergregory]

/lgtm
/approve

[k8s-ci-robot]

@huntergregory: you cannot LGTM your own PR.

In response to this:

/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[huntergregory]

Tests are passing via policy-assistant GH action.

These commands work locally:

1. cyclonus analyze --mode probe --policy-path cmd/policy-assistant/examples/demos/kubecon-eu-2024/policies/ --probe-path cmd/policy-assistant/examples/demos/kubecon-eu-2024/demo-probe.json
2. cyclonus analyze --mode walkthrough --policy-path cmd/policy-assistant/examples/demos/kubecon-eu-2024/policies/

Want to add these to the GH action once we add walkthrough traffic support in a followup.

[huntergregory]

Hey @mattfenwick do you mind adding a lgtm? Thinking to iterate quickly on a few more PRs and cut the first release by ~11/5 for a KubeCon announcement 🎉

Release details: #255

[huntergregory]

Hey @danwinship could you approve the GH action change and add a lgtm? Thanks!

[danwinship]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danwinship, huntergregory

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [danwinship]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment