<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Container Network Policy — API Reference

## kubectl NetworkPolicy Commands

```bash
kubectl get networkpolicies -n NAMESPACE
kubectl get networkpolicies --all-namespaces
kubectl describe networkpolicy POLICY -n NAMESPACE
kubectl get networkpolicy POLICY -n NAMESPACE -o yaml
kubectl apply -f networkpolicy.yaml
```

## NetworkPolicy Spec Fields

| Field | Description |
|-------|-------------|
| `spec.podSelector` | Pods this policy applies to |
| `spec.policyTypes` | Ingress, Egress, or both |
| `spec.ingress[].from` | Allowed ingress sources |
| `spec.ingress[].ports` | Allowed ingress ports |
| `spec.egress[].to` | Allowed egress destinations |
| `spec.egress[].ports` | Allowed egress ports |

## Selector Types

```yaml
# Pod selector
- podSelector:
    matchLabels:
      app: frontend

# Namespace selector
- namespaceSelector:
    matchLabels:
      env: production

# IP block
- ipBlock:
    cidr: 10.0.0.0/8
    except:
      - 10.0.1.0/24
```

## Cilium CLI

```bash
cilium status
cilium connectivity test
cilium monitor --type drop
cilium endpoint list
```

## Calico CLI

```bash
calicoctl get networkpolicy -A -o yaml
calicoctl get globalnetworkpolicy -o yaml
calicoctl node status
```
