# Kubernetes Service Path Analyzer

## Purpose and scope

This diagram describes the analyzer's ordered stages and the conditions each
stage can report. Example conditions are diagnostic categories, not current
incidents.

**Source:** `sources/service-path-analyzer.mmd`  
**Generated:** `generated/service-path-analyzer.svg`

![Kubernetes Service Path Analyzer](generated/service-path-analyzer.svg)

## Components and trust boundaries

Typed and dynamic discovery reads DNS-related Kubernetes resources, MetalLB and
ingress state, certificates, Services, EndpointSlices, Pods, and policy/CNI
metadata without reading Secret values. Metadata collection remains read-only.
Optional DNS, HTTP, or TLS probes cross into active network behavior and are
bounded, opt-in operations.

## Data flow and failure paths

Input hostname/service → DNS → load balancer/ingress → TLS → Service and
EndpointSlice → Pod readiness → NetworkPolicy/CNI → optional probe → result.
Each stage preserves unavailable access as a coverage gap and identifies the
first unsupported transition. DNS mismatch, missing ingress or endpoint,
selector/port mismatch, certificate error, unready Pod, policy block, and probe
failure remain distinct findings.

## Omissions and verification

Live hosts, addresses, certificates, credentials, Secret values, and private
security findings are omitted. Healthy and broken read-only cluster snapshots
are dated 13 July 2026. Active probing was disabled in the published snapshot;
probe behavior was exercised separately with loopback fixtures. No continuous
monitoring claim is made.

Related: [networking](networking.md) and
`projects/k8s-service-path-analyzer.html`.

**Validation:** `npm run diagrams:check` and `npm run check`.