Hedronite · Go Lesson · Polyglot-Dev / Go · Wed 2026-09-09

client-go NetworkPolicy informer — watch inventory and wide-peer WARN

List once for a report. Inform when the fleet must notice drift.

Lesson Class: Go companion (client-go NetworkPolicy)

Paired Dev: Python NetworkPolicy inventory

Watch

SharedInformer.

Type

networkingv1.

WARN

Wide From.

Same WARN semantics across Python and Go.

List once for a report. Inform when the fleet must notice drift.

§I — Frame

Build a small Go program that uses client-go to watch NetworkPolicy objects and print add/update/delete events with namespace/name and a wideness flag. This is the live twin of the Python census. It is not the IRSA ServiceAccount informer from 09-06.

§II — Informer sketch

factory := informers.NewSharedInformerFactory(clientset, 0)
npInformer := factory.Networking().V1().NetworkPolicies().Informer()
npInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
    AddFunc: func(obj interface{}) { report("ADD", obj) },
    UpdateFunc: func(_, newObj interface{}) { report("UPD", newObj) },
    DeleteFunc: func(obj interface{}) { report("DEL", obj) },
})
factory.Start(ctx.Done())
factory.WaitForCacheSync(ctx.Done())

Use typed networkingv1.NetworkPolicy assertions inside report. Handle cache.DeletedFinalStateUnknown.

§III — Wideness helper

Mirror Dev heuristics: empty From slice on an ingress rule means wide. Log WARN with namespace/name. Keep the helper pure for unit tests without a cluster.

§IV — Boundaries

Do not apply policies from the watcher.
Do not conflate NetworkPolicy with AdminNetworkPolicy (different API). Stay on networking.k8s.io/v1.
Resync period 0 is fine for a short inventory tool; production controllers pick an explicit period.

§V — Relation to Python

Python owns one-shot API list for tickets. Go owns continuous cache. Same WARN semantics so ops sees one language across tools.

§VI — Closing

Watch the object that Ops ships. Flag wide peers. Exit clean on context cancel.

Ops
Dev
Cert