Network Enforcer observes cluster traffic, proposes workload network policies, and enforces them in Kubernetes. It supports Istio ambient, Calico, and Cilium as providers.
| Component | Requirement | Notes |
|---|---|---|
Provider |
|
Chart enum in |
Architecture |
x86_64, aarch64 |
Fully supported. |
Kubernetes |
1.30+ |
The promote-label guard is a |
cert-manager |
Required for the default chart install |
Together with |
Linux distribution |
To be determined |
controller.provider.name is required and must be one of istio, cilium, calico. Defaults to istio.
| Provider | Minimum validated version | Transport and default endpoint | Policy backend |
|---|---|---|---|
Istio (ambient) |
1.30.3 |
OTLP gRPC to the controller. Default listen port |
|
Calico |
v3.32.1 |
gRPC to |
|
Cilium |
1.20.0 |
gRPC to |
|
Monitor and protect depend on ztunnel emitting JSON authorization logs that fluent-bit can parse:
-
istiod:
profile=ambientandpilot.env.AMBIENT_ENABLE_DRY_RUN_AUTHORIZATION_POLICY=true -
ztunnel:
env.AUTHZ_POLICY_INFO_LOGGING=trueandlogAsJson=true
The chart mounts the Secret net-enf-goldmane-client-certs when controller.provider.name=calico, but does not create it. Before installing, copy Goldmane’s CA bundle and key pair into the Network Enforcer release namespace under that exact name (see hack/setup-calico.sh).
| Provider | Learning | Monitor | Protect |
|---|---|---|---|
Istio (ambient) |
TCP, ingress only |
Yes |
Yes |
Calico |
TCP and UDP, ingress and egress |
Yes |
Yes |
Cilium |
TCP and UDP, ingress and egress |
Yes |
Yes |
| Rancher Version | Status | Notes |
|---|---|---|
2.6.x |
✓ Supported |
Minimum supported version |
2.7.x - 2.11.x |
✓ Supported |
Fully tested |
2.12.x |
✓ Supported |
Latest tested version (up to 2.12.100) |
2.13.x+ |
Expected |
Should work but not yet verified |
Hit a compatibility issue not covered here? Open an issue with your provider, versions, and cluster details.