review-security-k8s-network git:20260521.27b4bc9A

Immutable. This exact content is served forever at /api/v1/blob/b4412eb224ecf2f4.

---
name: review-security-k8s-network
description: Reviews Kubernetes network configurations, access controls, and routing boundaries for security vulnerabilities.
---
# Task
Review Kubernetes network configurations (`NetworkPolicies`, `Services`, `Ingresses`, Service Mesh) for vulnerabilities.

# Checks
## 1. Network Isolation
- **Default-Deny**: Verify every namespace has a "default-deny" `NetworkPolicy` for *both* Ingress and Egress.
- **Egress Neglect**: Flag workloads lacking Egress restrictions (enables data exfiltration/C2).
- **Overly Permissive Rules**: Flag broad CIDRs (`0.0.0.0/0`, `::/0`) or empty `podSelector`/`namespaceSelector`.

## 2. Service Exposure
- **Accidental Public Exposure**: Flag `LoadBalancer` services lacking internal annotations if meant to be internal.
- **NodePort Usage**: Flag `NodePort` usage (bypasses standard protections).
- **Sensitive Ports**: Flag exposure of admin/sensitive ports (22, 3389, 2379, 10250).

## 3. Traffic Routing
- **Ingress TLS**: Require `tls` block on Ingresses. Flag missing HTTP->HTTPS redirects.
- **Endpoint Hijacking**: Flag manual `Endpoints`/`EndpointSlice` resources (risk of malicious external redirect).
- **HostNetwork Bypass**: Flag `hostNetwork: true` (bypasses pod network policies).

## 4. Service Mesh
- **mTLS Enforcement**: Require `STRICT` mutual TLS via `PeerAuthentication`.
- **Authorization Bypass**: Ensure `AuthorizationPolicies` follow default-deny and don't conflict with legacy policies.