open source · local-first

Ship the policy.
Not the outage.

Test a CiliumNetworkPolicy against what's actually happening on your cluster — before it merges, not after it pages someone.

Try it → See it catch a real regression

Go CLI + embedded web UI. One binary.
Your kubeconfig, read-only RBAC. No new cluster footprint.

true story. sort of.

02:47

Your phone buzzes. PagerDuty: 14 pods restarting. Grafana: dashboards gone blank.

✓ Code review: approved
✓ CI: green
✓ Matched every flow anyone tested by hand

Then it shipped.

  • Liveness probes start failing — the kubelet can't reach the port anymore
  • Pods restart in a loop — nothing about that looks like a network problem
  • The Prometheus scrape target goes dark — dashboards just stop updating
  • "It only allowed less traffic. How could that break anything?"

40 minutes to find it. Zero minutes it would have taken to catch before merge.
A composite of the kind of incident every platform team has lived through.

If this sounds familiar, it's not bad luck.

Forgot the host entity

Kubelet and node-level health probes silently stop being reachable.

Forgot DNS egress

Everything resolves nothing. Timeouts everywhere — looks like a different outage entirely.

Scoped too narrow

Observability or a sidecar's traffic gets quietly dropped. Dashboards go dark, not red.

Right in isolation, wrong combined

The rule you wrote is correct. It just isn't the only rule that matters.

What if you could diff a candidate policy against real traffic — before it ships?

GuardBee Logo

introducing

GuardBee

A local-first tool that tests your policy against what's actually happening on the cluster — not against a test case someone imagined.

Your candidate policyCiliumNetworkPolicy YAML
Real recent flowsHubble Relay
↓
Cilium's own policy engineembedded pkg/policy — not a reimplementation
↓
Verdict: what would break, what's newly allowed

live demo

Watch it catch a real regression in 30 seconds.

A real scenario on a live Kubernetes cluster: author a policy, detect dropped kubelet probes before merge, patch with one click, and re-verify.

guardbee-demo · live cluster simulation
01 / INSPECT

Sample Real Traffic

Ground truth directly from Hubble Relay flows — never synthetic test cases.

02 / SIMULATE

Diff Against Baseline

Evaluates candidate policy twice using Cilium's embedded pkg/policy engine.

03 / CATCH

Flag Silent Regressions

Instantly detects NEWLY_DROPPED flows (like kubelet health probes) before merge.

04 / REMEDIATE

One-Click Fix & Re-verify

Appends missing rules in one click, re-runs simulator, and confirms 100% unchanged.

Same engine, if you live in a terminal

$ guardbee verdict \
  -n messaging allow-mqtt.yaml
NEWLY_DROPPED prometheus → :8883 NEWLY_DROPPED reserved:host → :8883 (×4) 131 flows sampled — 5 would BREAK if merged as-is
$ guardbee verdict \
  -n messaging allow-mqtt-merge-ready.yaml
0 newly dropped 0 newly allowed 159 flows sampled — safe to merge

This isn't a linter.

Real engine

Embeds Cilium's actual pkg/policy code — the same engine your cluster runs. Not a reimplementation that can drift.

Real traffic

Diffs against live Hubble flows from your cluster, not synthetic test cases someone imagined.

Local-first

Runs with your own kubeconfig. No new cluster footprint, no agent to deploy, nothing leaves your laptop.

Before / After

BeforeWith GuardBee
Confidence sourceCode review, hopeReal traffic, verified
When you find outAfter it ships, from pagesBefore you merge
Fixing a gapGuess, patch, redeploy, waitOne click, re-validate instantly
Blast radiusDiscovered in prodVisible in a diff