Networking API

The networking backend exposes a JSON HTTP API consumed by the UI extension via ArgoCD’s proxy at /extensions/networking/.

Authorization

Every data endpoint requires the Argocd-Application-Name header (namespace:name format, set automatically by ArgoCD’s proxy). The backend returns 403 if the header is missing or if the requested namespace is not managed by that Application (its destination namespace plus namespaces in status.resources). The backend needs get on applications.argoproj.io for this lookup; the Helm chart grants it by default.

Endpoints

Policies with ownership

POST /api/v1/policies-with-ownership

Returns all Cilium network policies affecting a namespace (namespace-scoped and clusterwide), each tagged with ownership: app if the policy belongs to the calling Application’s resource tree, platform otherwise.

Request body:

{
  "namespace": "default",
  "resources": [
    { "group": "cilium.io", "kind": "CiliumNetworkPolicy", "namespace": "default", "name": "allow-guestbook-ingress" }
  ]
}

Response:

[
  {
    "name": "allow-guestbook-ingress",
    "namespace": "default",
    "description": "Allow ingress to guestbook",
    "endpointSelector": { "app": "guestbook-ui" },
    "hasIngress": true,
    "hasEgress": false,
    "ingressRuleCount": 2,
    "egressRuleCount": 0,
    "ingressRules": [
      { "peers": ["app=frontend"], "ports": ["TCP:80"] }
    ],
    "creationTimestamp": "2026-03-15T10:30:00Z",
    "ownership": "app",
    "scope": "namespace"
  },
  {
    "name": "platform-default-deny",
    "hasIngress": false,
    "hasEgress": true,
    "ingressRuleCount": 0,
    "egressRuleCount": 1,
    "egressRules": [
      { "peers": ["kube-dns"], "ports": ["UDP:53"] }
    ],
    "creationTimestamp": "2026-03-10T08:00:00Z",
    "ownership": "platform",
    "scope": "clusterwide"
  }
]

scope is namespace (CiliumNetworkPolicy) or clusterwide (CiliumClusterwideNetworkPolicy). Rule peers cover endpoint selectors, CIDRs, entities, and FQDNs; "any" means unrestricted.

List endpoints

GET /api/v1/endpoints?namespace={ns}&pods={pods}

Returns CiliumEndpoints for a namespace, including identity, IPs, and policy enforcement state.

Parameters:

Response:

[
  {
    "name": "guestbook-ui-abc123",
    "namespace": "default",
    "endpointId": 1234,
    "identityId": 56789,
    "ipv4": "10.0.1.5",
    "ingressEnforcement": "true",
    "egressEnforcement": "false",
    "state": "ready",
    "labels": { "k8s:app": "guestbook-ui" },
    "namedPorts": [
      { "name": "http", "port": 80, "protocol": "TCP" }
    ]
  }
]

Query flows

GET /api/v1/flows?namespace={ns}&since={duration}&limit={n}&verdict={verdict}&direction={direction}&pods={pods}

Returns recent Hubble flows for a namespace from the backend’s flow buffer.

Parameters:

Response:

{
  "flows": [
    {
      "time": "2026-03-15T10:30:00Z",
      "verdict": "FORWARDED",
      "direction": "EGRESS",
      "sourceNamespace": "default",
      "sourcePod": "guestbook-ui-abc123",
      "sourceIP": "10.0.1.5",
      "destNamespace": "default",
      "destPod": "redis-master-def456",
      "destIP": "10.0.1.10",
      "protocol": "TCP",
      "destPort": 6379,
      "summary": "TCP Flags: SYN",
      "isReply": false
    }
  ],
  "hubble": true,
  "summary": { "total": 42, "forwarded": 40, "dropped": 2, "error": 0 }
}

If Hubble Relay is not configured, the response is { "flows": [], "hubble": false, "message": "Hubble Relay is not configured" }.

Error responses

{
  "error": "namespace is required"
}