Task

SkillCloud & infra

Reviews Kubernetes network configurations (NetworkPolicies, Services, Ingress) for isolation and exposure risks.

Available today. Use it from your connected AI after setup.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the Task skill

What this skill tells your AI

The instructions your AI receives, as published by gke-labs/kube-agents in .agents/skills/review-security-k8s-network/SKILL.md and read by ahel’s review.

Review Kubernetes network configurations (NetworkPolicies, Services, Ingresses, Service Mesh) for vulnerabilities.

Checks

1. Network Isolation

  • Default-Deny: Verify every namespace has a "default-deny" NetworkPolicy for both Ingress and Egress.
  • Egress Neglect: Flag workloads lacking Egress restrictions (enables data exfiltration/C2).
  • Overly Permissive Rules: Flag broad CIDRs (0.0.0.0/0, ::/0) or empty podSelector/namespaceSelector.

2. Service Exposure

  • Accidental Public Exposure: Flag LoadBalancer services lacking internal annotations if meant to be internal.
  • NodePort Usage: Flag NodePort usage (bypasses standard protections).
  • Sensitive Ports: Flag exposure of admin/sensitive ports (22, 3389, 2379, 10250).

3. Traffic Routing

  • Ingress TLS: Require tls block on Ingresses. Flag missing HTTP->HTTPS redirects.
  • Endpoint Hijacking: Flag manual Endpoints/EndpointSlice resources (risk of malicious external redirect).
  • HostNetwork Bypass: Flag hostNetwork: true (bypasses pod network policies).

4. Service Mesh

  • mTLS Enforcement: Require STRICT mutual TLS via PeerAuthentication.
  • Authorization Bypass: Ensure AuthorizationPolicies follow default-deny and don't conflict with legacy policies.

Signals

GitHub stars
54
Forks
36
Last commit
Sep 2026
Advanced
Catalog kind
skill
Gateway key
review-security-k8s-network
Source
github.com/gke-labs/kube-agents