git:20260521.27b4bc9 to git:20260521.2bcbdef

1 added, 1 removed. Audit A to A.

---

name: review-security-k8s-network

- description: Reviews Kubernetes network configurations, access controls, and routing boundaries for security vulnerabilities.

+ description: Reviews Kubernetes network configurations (NetworkPolicies, Services, Ingress) for isolation and exposure risks.

---

# Task

Review Kubernetes network configurations (`NetworkPolicies`, `Services`, `Ingresses`, Service Mesh) for vulnerabilities.

# Checks

## 1. Network Isolation

- **Default-Deny**: Verify every namespace has a "default-deny" `NetworkPolicy` for *both* Ingress and Egress.

- **Egress Neglect**: Flag workloads lacking Egress restrictions (enables data exfiltration/C2).

- **Overly Permissive Rules**: Flag broad CIDRs (`0.0.0.0/0`, `::/0`) or empty `podSelector`/`namespaceSelector`.

## 2. Service Exposure

- **Accidental Public Exposure**: Flag `LoadBalancer` services lacking internal annotations if meant to be internal.

- **NodePort Usage**: Flag `NodePort` usage (bypasses standard protections).

- **Sensitive Ports**: Flag exposure of admin/sensitive ports (22, 3389, 2379, 10250).

## 3. Traffic Routing

- **Ingress TLS**: Require `tls` block on Ingresses. Flag missing HTTP->HTTPS redirects.

- **Endpoint Hijacking**: Flag manual `Endpoints`/`EndpointSlice` resources (risk of malicious external redirect).

- **HostNetwork Bypass**: Flag `hostNetwork: true` (bypasses pod network policies).

## 4. Service Mesh

- **mTLS Enforcement**: Require `STRICT` mutual TLS via `PeerAuthentication`.

- **Authorization Bypass**: Ensure `AuthorizationPolicies` follow default-deny and don't conflict with legacy policies.