Home / BeaverDeck / Docs / Insights Guide / Networking Insights

Networking Insights

Service reachability, ingress references and TLS, external address provisioning, and route ownership.

Permissions: viewing checks requires insights: view. Opening a linked object or logs requires the corresponding resource permission, and the BeaverDeck ServiceAccount must be allowed to read the Kubernetes resources used by the check. Suppressing a finding requires insights: edit and affects all users.

Data Evaluated

Services, EndpointSlices, Ingresses, referenced TLS Secrets, Deployments, and StatefulSets in selected namespaces.

Checks

Check	When it reports	Alert severity
LoadBalancer `loadbalancer-pending`	A Service has type `LoadBalancer` but its status contains no external ingress address.	Warning
Service Endpoints `service-endpoints`	A selector-backed Service has zero ready endpoints in its EndpointSlices.	Warning
Ingress TLS `ingress-tls`	An Ingress TLS entry has no `secretName`, references a missing Secret, references a Secret that is not type `kubernetes.io/tls`, or the Secret lacks `tls.crt` or `tls.key`.	Critical
Ingress Backend `ingress-backend`	An Ingress default backend or HTTP path references a Service name that does not exist in the Ingress namespace.	Critical
Service Coverage `service-coverage`	No Service selector matches the pod-template labels of a Deployment or StatefulSet.	Warning
Ingress Route Collision `ingress-route-collision`	Two or more Ingress resources claim the same ingress class, host, and path. Empty hosts are treated as `*` and empty paths as `/`.	Warning

Open an individual check for risk context, recommended response, and limitations. Passing checks are visible when Show all checks is enabled in BeaverDeck.