Kubernetes Services NetworkPolicy API

openapi: 3.1.0
info:
  title: Kubernetes Services Kubernetes EndpointSlices NetworkPolicy API
  description: The Kubernetes EndpointSlices API tracks the IP addresses, ports, readiness, and topology information for Pods backing a Service. EndpointSlices replaced the older Endpoints API to improve scalability for large clusters with thousands of pods. A single Service may be backed by multiple EndpointSlices, and the EndpointSlice controller automatically manages their lifecycle in response to pod and Service changes.
  version: v1.32.0
  contact:
    name: Kubernetes Community
    url: https://kubernetes.io/community/
  termsOfService: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://kubernetes.default.svc
  description: In-cluster Kubernetes API Server
security:
- bearerAuth: []
- clientCertificate: []
tags:
- name: NetworkPolicy
  description: NetworkPolicy resources controlling Pod-level traffic ingress and egress based on label selectors, namespace selectors, and IP CIDR blocks.
paths:
  /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies:
    get:
      operationId: listNamespacedNetworkPolicies
      summary: Kubernetes Services List NetworkPolicies in a namespace
      description: Returns a list of all NetworkPolicy objects in the specified namespace. Network policies are enforced by the CNI plugin and define which pods can send or receive network traffic.
      tags:
      - NetworkPolicy
      parameters:
      - $ref: '#/components/parameters/NamespaceParam'
      - $ref: '#/components/parameters/LabelSelector'
      - $ref: '#/components/parameters/FieldSelector'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Continue'
      - $ref: '#/components/parameters/Watch'
      responses:
        '200':
          description: List of NetworkPolicy objects
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicyList'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      operationId: createNamespacedNetworkPolicy
      summary: Kubernetes Services Create a NetworkPolicy
      description: Creates a new NetworkPolicy in the specified namespace. Once created, the CNI plugin enforces the policy by allowing only the traffic explicitly permitted by ingress and egress rules.
      tags:
      - NetworkPolicy
      parameters:
      - $ref: '#/components/parameters/NamespaceParam'
      - $ref: '#/components/parameters/DryRun'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NetworkPolicy'
      responses:
        '201':
          description: NetworkPolicy created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicy'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name}:
    get:
      operationId: getNamespacedNetworkPolicy
      summary: Kubernetes Services Get a NetworkPolicy
      description: Returns the specified NetworkPolicy including its pod selector, ingress rules, egress rules, and policy types (Ingress, Egress, or both).
      tags:
      - NetworkPolicy
      parameters:
      - $ref: '#/components/parameters/NamespaceParam'
      - $ref: '#/components/parameters/NameParam'
      responses:
        '200':
          description: NetworkPolicy details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicy'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: replaceNamespacedNetworkPolicy
      summary: Kubernetes Services Replace a NetworkPolicy
      description: Replaces the full specification of the specified NetworkPolicy. The CNI plugin re-evaluates the updated rules immediately for all pods selected by the policy.
      tags:
      - NetworkPolicy
      parameters:
      - $ref: '#/components/parameters/NamespaceParam'
      - $ref: '#/components/parameters/NameParam'
      - $ref: '#/components/parameters/DryRun'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NetworkPolicy'
      responses:
        '200':
          description: NetworkPolicy updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicy'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: patchNamespacedNetworkPolicy
      summary: Kubernetes Services Patch a NetworkPolicy
      description: Applies a partial update to the specified NetworkPolicy using strategic merge patch. Useful for adding or removing individual ingress or egress rules.
      tags:
      - NetworkPolicy
      parameters:
      - $ref: '#/components/parameters/NamespaceParam'
      - $ref: '#/components/parameters/NameParam'
      requestBody:
        required: true
        content:
          application/merge-patch+json:
            schema:
              type: object
      responses:
        '200':
          description: NetworkPolicy patched
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicy'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: deleteNamespacedNetworkPolicy
      summary: Kubernetes Services Delete a NetworkPolicy
      description: Deletes the specified NetworkPolicy. Traffic previously restricted by this policy will no longer be affected once the policy is removed.
      tags:
      - NetworkPolicy
      parameters:
      - $ref: '#/components/parameters/NamespaceParam'
      - $ref: '#/components/parameters/NameParam'
      responses:
        '200':
          description: NetworkPolicy deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicy'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /apis/networking.k8s.io/v1/networkpolicies:
    get:
      operationId: listNetworkPoliciesAllNamespaces
      summary: Kubernetes Services List NetworkPolicies across all namespaces
      description: Returns all NetworkPolicy objects across every namespace in the cluster. Useful for auditing network segmentation, identifying gaps in policy coverage, and reviewing cross-namespace traffic restrictions.
      tags:
      - NetworkPolicy
      parameters:
      - $ref: '#/components/parameters/LabelSelector'
      - $ref: '#/components/parameters/FieldSelector'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Watch'
      responses:
        '200':
          description: List of NetworkPolicies across all namespaces
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkPolicyList'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  parameters:
    DryRun:
      name: dryRun
      in: query
      description: If 'All', validates without persisting the change.
      schema:
        type: string
        enum:
        - All
    Continue:
      name: continue
      in: query
      description: Pagination continuation token.
      schema:
        type: string
    Watch:
      name: watch
      in: query
      description: If true, stream watch events instead of returning a list.
      schema:
        type: boolean
    NameParam:
      name: name
      in: path
      required: true
      description: Name of the NetworkPolicy resource.
      schema:
        type: string
    LabelSelector:
      name: labelSelector
      in: query
      description: Label selector to filter resources.
      schema:
        type: string
    FieldSelector:
      name: fieldSelector
      in: query
      description: Field selector to filter resources by field values.
      schema:
        type: string
    NamespaceParam:
      name: namespace
      in: path
      required: true
      description: Namespace name to scope the request.
      schema:
        type: string
    Limit:
      name: limit
      in: query
      description: Maximum number of items to return.
      schema:
        type: integer
        minimum: 1
  responses:
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Status'
    NotFound:
      description: Not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Status'
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Status'
  schemas:
    NetworkPolicyList:
      type: object
      description: A list of NetworkPolicy objects.
      required:
      - items
      properties:
        apiVersion:
          type: string
        kind:
          type: string
          const: NetworkPolicyList
        metadata:
          $ref: '#/components/schemas/ListMeta'
        items:
          type: array
          items:
            $ref: '#/components/schemas/NetworkPolicy'
    NetworkPolicy:
      type: object
      description: A NetworkPolicy describes how groups of pods are allowed to communicate with each other and other network endpoints. Policies are additive — if multiple policies select a pod, all rules are combined. Requires a CNI plugin that supports NetworkPolicy enforcement.
      properties:
        apiVersion:
          type: string
          const: networking.k8s.io/v1
        kind:
          type: string
          const: NetworkPolicy
        metadata:
          $ref: '#/components/schemas/ObjectMeta'
        spec:
          $ref: '#/components/schemas/NetworkPolicySpec'
    LabelSelector:
      type: object
      description: A label selector filtering pods or namespaces by their labels. Combines matchLabels equality requirements with matchExpressions set-based requirements using AND logic.
      properties:
        matchLabels:
          type: object
          additionalProperties:
            type: string
          description: Key-value pairs that must all match on the target resource labels.
        matchExpressions:
          type: array
          description: Set-based requirements combined with AND logic.
          items:
            type: object
            required:
            - key
            - operator
            properties:
              key:
                type: string
                description: Label key the selector applies to.
              operator:
                type: string
                enum:
                - In
                - NotIn
                - Exists
                - DoesNotExist
                description: Relationship between the key and values.
              values:
                type: array
                items:
                  type: string
                description: Values for In/NotIn operators.
    NetworkPolicyPeer:
      type: object
      description: A network policy peer specifying a traffic source (in ingress rules) or destination (in egress rules). Uses AND logic when multiple selector types are combined.
      properties:
        podSelector:
          $ref: '#/components/schemas/LabelSelector'
        namespaceSelector:
          $ref: '#/components/schemas/LabelSelector'
        ipBlock:
          $ref: '#/components/schemas/IPBlock'
    NetworkPolicyEgressRule:
      type: object
      description: An egress rule allowing outbound traffic from selected pods to specified destinations on specified ports. An empty to list allows traffic to all destinations.
      properties:
        to:
          type: array
          description: Allowed traffic destinations.
          items:
            $ref: '#/components/schemas/NetworkPolicyPeer'
        ports:
          type: array
          description: Ports to which the egress traffic is allowed.
          items:
            $ref: '#/components/schemas/NetworkPolicyPort'
    NetworkPolicyIngressRule:
      type: object
      description: An ingress rule allowing inbound traffic to selected pods from specified sources on specified ports. An empty from list allows traffic from all sources. An empty ports list allows all ports.
      properties:
        from:
          type: array
          description: Allowed traffic sources. Items are OR'd together; within an item, podSelector and namespaceSelector are AND'd.
          items:
            $ref: '#/components/schemas/NetworkPolicyPeer'
        ports:
          type: array
          description: Ports on which the ingress traffic is allowed.
          items:
            $ref: '#/components/schemas/NetworkPolicyPort'
    NetworkPolicySpec:
      type: object
      description: Specification of a NetworkPolicy defining which pods are selected, what policy types apply, and the ingress and egress rules.
      required:
      - podSelector
      properties:
        podSelector:
          $ref: '#/components/schemas/LabelSelector'
        policyTypes:
          type: array
          description: Policy types that apply to this NetworkPolicy. If Ingress is specified, only explicitly allowed ingress traffic is permitted. If Egress is specified, only explicitly allowed egress traffic is permitted. Defaults based on presence of ingress/egress fields.
          items:
            type: string
            enum:
            - Ingress
            - Egress
        ingress:
          type: array
          description: Ingress rules. Each rule allows traffic matching all of its conditions. An empty ingress list denies all ingress traffic.
          items:
            $ref: '#/components/schemas/NetworkPolicyIngressRule'
        egress:
          type: array
          description: Egress rules. Each rule allows traffic matching all of its conditions. An empty egress list denies all egress traffic.
          items:
            $ref: '#/components/schemas/NetworkPolicyEgressRule'
    ObjectMeta:
      type: object
      description: Standard Kubernetes object metadata.
      properties:
        name:
          type: string
          description: Name of the object.
        namespace:
          type: string
          description: Namespace of the object.
        uid:
          type: string
          description: Unique server-assigned identifier.
        resourceVersion:
          type: string
          description: Internal version string.
        creationTimestamp:
          type: string
          format: date-time
          description: Creation timestamp.
        labels:
          type: object
          additionalProperties:
            type: string
          description: Label key-value pairs.
        annotations:
          type: object
          additionalProperties:
            type: string
          description: Non-identifying metadata.
    NetworkPolicyPort:
      type: object
      description: A port and protocol combination allowed by a network policy rule. Empty port/protocol fields match all ports and protocols.
      properties:
        protocol:
          type: string
          enum:
          - TCP
          - UDP
          - SCTP
          description: Network protocol. Defaults to TCP.
          default: TCP
        port:
          description: Port number or named port to match. If empty, all ports are matched.
          oneOf:
          - type: integer
            minimum: 1
            maximum: 65535
          - type: string
        endPort:
          type: integer
          minimum: 1
          maximum: 65535
          description: End of a port range. If specified with port, allows all ports from port to endPort inclusive.
    IPBlock:
      type: object
      description: An IP block defined by a CIDR range with optional exceptions, used to allow or restrict traffic to or from specific IP ranges.
      required:
      - cidr
      properties:
        cidr:
          type: string
          description: 'CIDR range to match. Examples: 192.168.1.0/24, 0.0.0.0/0, 2001:db8::/32.'
          pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$|^[0-9a-fA-F:]+/[0-9]{1,3}$
        except:
          type: array
          description: CIDR ranges to exclude from the ipBlock. Must be within the cidr range.
          items:
            type: string
    Status:
      type: object
      description: Error or result status.
      properties:
        code:
          type: integer
        message:
          type: string
        reason:
          type: string
        status:
          type: string
          enum:
          - Success
          - Failure
    ListMeta:
      type: object
      description: Metadata for list responses.
      properties:
        resourceVersion:
          type: string
        continue:
          type: string
        remainingItemCount:
          type: integer
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Kubernetes service account or user bearer token.
    clientCertificate:
      type: mutualTLS
      description: Client TLS certificate signed by the cluster CA.
externalDocs:
  description: Kubernetes EndpointSlice API Reference
  url: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1/