Kubesonar resolves every NetworkPolicy in your cluster, observes the traffic that actually flows, and names the policy, the rule and the port that decide each connection. Native macOS, works with a read-only role, nothing installed in the cluster.
Free 14-day trialNo accountmacOS 15 or later, Apple siliconLatest release v1.0 · changelog
acme-prod boutique NET / topology / policy check
Works withKubernetes 1.28+IstioCalicoCiliumEKSAKSGKEkind
Built for platform teams
The question every on-call engineer asks, answered in seconds
Network policy failures are silent: the pod is healthy, the service exists, and the connection just times out. Kubesonar turns that into a verdict with a reason.
Platform engineering
Roll out default-deny with confidence. See which flows a policy will break before it is applied, and which rules select nothing.
Incident response
From "checkout is failing" to the rule with the typo in three clicks: the red edge, the verdict, the manifest.
Security reviews
Export the topology, observed flows and every policy with its rules as one PDF. Evidence a reviewer can read without cluster access.
How it works
From a failing connection to the line that blocks it
Kubesonar evaluates policies the way the CNI does, against the live labels, namespaces and ports in the cluster.
01
Connect with your kubeconfig
Pick a context and a namespace. Kubesonar reads policies, pods, services and workloads through the API server with a read-only role.
kubectl config current-context
02
Select a flow, get the verdict
Source, destination, port. The answer names every policy that isolates each side and the rule that allowed or denied the connection.
checkout → payments:50051 · BLOCKED
03
Open the rule and fix it
The manifest opens on the deciding rule. A selector that matches zero pods is marked as such, with the label it should have matched.
podSelector app=checkout → 0 pods
Try it in the browser
Ask the demo cluster
The same evaluation the app runs, here on the policies of the demo cluster. Pick two workloads and a port. Click a policy to see its rules; the deciding one is highlighted.
acme-prod boutique NET / WHY / demo cluster
—
VERDICT
TCP/any
TRAFFIC
choose two workloads
FLOW
Resolver
Verdicts you can act on
Every answer is the policy, the rule index, the port and the protocol, with the reasoning in one sentence.
Full NetworkPolicy semantics. Ingress and egress isolation, ipBlock, namespace and pod selectors combined.
Resolved against live labels, not the labels in the manifest.
Simulate before you apply. Edit a policy and see which flows change.
acme-prod payments NET / WHY
Rules
The manifest, on the rule that matters
Open a policy from a verdict and it is scrolled to the rule that matched, or should have. Rules that select nothing are called out in place.
Rule by rule. What each rule selects today: namespaces, pods, ports.
YAML with diff. Edit the manifest and review the diff before you apply.
Export for review. Graph, flows and policies in one PDF.
acme-prod payments POL / payments-allow-checkout
Traffic
Observed traffic, checked against policy
With Istio, Kubesonar reads request rates, latency, errors and TCP connections straight from the Envoy sidecars through the API server. No Prometheus needed. Without a mesh you keep the resolver, the simulator and the topology; there is no observed traffic.
Red edges are real. Traffic that is happening and is not permitted.
One hour of history per edge, in memory, on your Mac.
Istio for L7 and L4 traffic. Any CNI for policy resolution.
acme-prod boutique NET / L7 / 42 rps
One app, not one more
And everything you expect from a Kubernetes console
Kubesonar is a full macOS client. The network views are why you will open it; the rest is why you will keep it open.
acme-prod boutique WRK / deployments
Capture pending · Workloads
The cluster at a glance: health score, node load, namespace health, recent warnings and a 60-minute CPU/memory signal.
Security
Your credentials. Local. Auditable.
A desktop app that talks to the API server with the kubeconfig you already have. No agent, no CRD, no webhook. Every network feature works with a read-only role; nothing is written to the cluster unless you ask for it.
Nothing leaves your machine. The only outbound request is the license check: key, instance id, hostname.
Signed and notarized by Apple. Verify with codesign --verify --deep --strict.
Read-only by default. Apply, scale, exec and port-forward exist only if your role allows them; a missing permission disables that action and says why.
Permissions Kubesonar usesread verbs unless noted
Resource
Verbs
Used for
networkpolicies
get list watch
Verdicts, rules and simulation
pods, namespaces, nodes
get list watch
Labels, IPs, node placement
services, endpointslices
get list watch
Pods behind a service
deployments, statefulsets, daemonsets
get list watch
Workload grouping on the graph
events
list watch
Event timeline
pods/proxy
get
Envoy sidecar metrics: L7 and L4 traffic (Istio). Optional.
Prices in USD, plus applicable tax. Invoices from our merchant of record.
After the trial, these stay free: Overview, workloads (logs, shell, port-forward, scale, restart, delete, YAML apply and edit), Services, Ingress and NetworkPolicies as resources, Helm, usage metrics, events and timeline, RBAC roles, bindings and accounts, CRDs, templates, themes and settings. NetworkPolicy reachability, rules and WHY, the policy simulator, L7/L4 traffic, PNG/PDF export and reports, right-sizing, the RBAC matrix and cluster compare need a license.
No. It is a desktop app that uses your kubeconfig, like kubectl. No agent, no CRD, no webhook.
Which policy engines does it understand?
Kubernetes NetworkPolicy (networking.k8s.io/v1) on any CNI that enforces it. Cilium and Calico policy CRDs show up in the CRD browser but are not evaluated.
Do I need a service mesh?
Not for the resolver, the simulator or the topology. Observed traffic, L7 requests and L4 connections, comes from Istio's Envoy sidecars; without Istio there is no live traffic view.
What happens when my trial ends?
Kubesonar keeps working as a free cluster console. Free forever: Overview; workloads with logs, shell/exec, port-forward, scale, restart, delete and YAML apply/edit; Services, Ingress and NetworkPolicies as resources; Helm; usage metrics; events and timeline; RBAC roles, bindings and accounts; CRDs; templates; themes and settings. A license unlocks the network policy tools: the NetworkPolicy topology with reachability, rules and WHY; the policy simulator; L7/L4 traffic with one hour of history; PNG/PDF export and PDF reports; right-sizing; the RBAC matrix; and cluster compare. Activate a license at any time to turn them back on.
What leaves my machine?
Only the license check: key, instance id and hostname. No cluster names, manifests or traffic data.
Can I move a seat to another Mac?
Yes. Deactivate it in the app and activate the new machine. Each seat allows two.
Which Macs does it run on?
macOS 15 or later on Apple silicon. The app is signed and notarized by Apple; a universal build is not planned for 1.0.
Kubesonar exists because I spent too many incidents reading NetworkPolicies by hand. It does one thing well: tell you which rule decides a connection, with the evidence. It runs on your Mac, uses your own credentials, and never sends your cluster data anywhere.
Víctor Álvarez—Founder, Kubesonar
See your cluster the way the CNI sees it
Download Kubesonar and resolve your first policy in under a minute.
