review-security-k8s-agents-firewall git:20260903.799c7e3A

Immutable. This exact content is served forever at /api/v1/blob/c4fcd5a8f2518381.

---
name: review-security-k8s-agents-firewall
description: Reviews Kubernetes network and firewall configurations specifically for AI agent execution sandboxes.
---

# Task

Review network policies and firewall configs for AI agent control loops and execution sandboxes.

# Checks

## 1. Egress Restrictions

- **Sandbox Network**: Enforce default-deny egress. Allowlist absolute minimum required IPs/services.
- **Internal APIs**: Block agent/sandbox access to internal cluster APIs, K8s services, and cloud metadata (e.g., `169.254.169.254`) — on the credential ports (TCP `80` pre-NAT, `988` post-NAT), not on port `53`, which is the Pod's resolver under Cloud DNS for GKE and reaches no token.
- **Exfiltration Vectors**: Flag broad egress (e.g., `0.0.0.0/0`) on agent pods.

## 2. Ingress & Invocation

- **Authorized Sources**: Restrict agent API ingress to trusted upstream services (auth gateways, orchestrators).
- **Bypass Prevention**: Flag LoadBalancer or NodePort exposure on main agent containers lacking strict ingress NetworkPolicies.