review-security-k8s-gateway git:20260521.27b4bc9A

Immutable. This exact content is served forever at /api/v1/blob/10719980fed43372.

---
name: review-security-k8s-gateway
description: Reviews Kubernetes Gateway API configurations for security issues.
---
# Task
Review Kubernetes Gateway API configurations (`Gateway`, `HTTPRoute`, `TCPRoute`, `TLSRoute`, `ReferenceGrant`) for vulnerabilities.

# Checks
- **Route Hijacking**: Flag overlapping hostnames/paths in routes that allow hijacking critical traffic.
- **Cross-Namespace**: Flag routing or secret references across namespaces without narrow `ReferenceGrant`.
- **Listeners & TLS**: Verify TLS `mode` (`Terminate`/`Passthrough`) and secure certificate references.
- **Allowed Routes**: Require `allowedRoutes` to restrict attachment by namespace (e.g., `namespaces.from: Same` or `Selector`).
- **Permissive Hostnames**: Flag unnecessary wildcards (`*`) or overly broad hostnames in listeners/routes.