Task
SkillCloud & infraReviews Kubernetes namespace configurations for workload isolation, multi-tenancy, and boundary defense.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Task skill
What this skill tells your AI
The instructions your AI receives, as published by gke-labs/kube-agents in .agents/skills/review-security-k8s-namespaces/SKILL.md and read by ahel’s review.
Review Kubernetes namespace configs/resources for structural boundaries, workload isolation, and defense-in-depth security.
Checks
1. Structural Isolation
- Workload Density: Flag if most workloads (>80-90%) are dumped into a single namespace (
default,prod). Expect micro-segmentation. - Tenant Mixing: Flag mixing of different trust levels (dev/staging/prod) or tenants in the same namespace.
2. Abuse & Evasion
- System Namespace Abuse: Flag custom workloads in
default,kube-system,kube-public,kube-node-lease. - Rogue Namespaces: Flag names impersonating system components (e.g.,
kube-admin,k8s-infra). - Policy Bypass: Flag labels/annotations on non-system namespaces that bypass cluster policies (e.g., OPA exemptions,
pod-security.kubernetes.io/enforce=privileged). - Quota Evasion: Flag absurdly high
ResourceQuotas/LimitRanges. - Finalizer Abuse: Flag suspicious
finalizerson namespaces.
3. Cross-Namespace Risks
- Cross-References: Flag illegitimate cross-namespace resource references (e.g.,
GatewaylackingReferenceGrant,ExternalNameto internal namespaces). - Dangling Namespaces: Flag active
Secrets,ServiceAccounts, orRoleBindingsin namespaces with no active pods.
Signals
- GitHub stars
- 54
- Forks
- 36
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
review-security-k8s-namespaces- Source
- github.com/gke-labs/kube-agents