// Module included in the following assemblies:
//
// * installing/install_config/configuring-firewall.adoc

:_mod-docs-content-type: CONCEPT
[id="network-commatrix-plugin-intro_{context}"]
= Ingress network flow management with the commatrix plugin

[role="_abstract"]
Use the `commatrix` plugin for the `oc` command to analyze ingress network traffic and generate firewall rules for live clusters.

For ingress network analysis, the plugin reads the services deployed in a target cluster and generates a communication matrix of expected ingress flows. You can export the data in formats such as CSV, JSON, or YAML for audits, documentation, or configuring external firewalls.

For firewall configuration, the plugin generates `nftables` rules in Butane format that restrict ingress traffic to only the flows required by your cluster. The plugin also generates a `NodeDisruptionPolicy` patch to apply updates without triggering node reboots.

The communication matrix uses `EndpointSlice` objects to discover exposed ports. Kubernetes automatically creates `EndpointSlice` objects for each `Service` object. Starting with {product-title} {product-version}, the matrix fully covers all core {product-title} ports. However, non-core Operators or other software that expose ports without a corresponding `Service` object do not appear in the matrix, such as host-level services, monitoring agents, or third-party software.

To discover all listening ports on cluster nodes, use the `--host-open-ports` flag. This flag captures ports that are open on the hosts but are not defined through `Service` or `EndpointSlice` objects. You can compare this output with the declared ports by using the diff file generated by the plugin, which shows the differences between the intended and actual state.
