Task
SkillCloud & infraReviews Kubernetes network configurations (NetworkPolicies, Services, Ingress) for isolation and exposure risks.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Task skill
What this skill tells your AI
The instructions your AI receives, as published by gke-labs/kube-agents in .agents/skills/review-security-k8s-network/SKILL.md and read by ahel’s review.
Review Kubernetes network configurations (NetworkPolicies, Services, Ingresses, Service Mesh) for vulnerabilities.
Checks
1. Network Isolation
- Default-Deny: Verify every namespace has a "default-deny"
NetworkPolicyfor both Ingress and Egress. - Egress Neglect: Flag workloads lacking Egress restrictions (enables data exfiltration/C2).
- Overly Permissive Rules: Flag broad CIDRs (
0.0.0.0/0,::/0) or emptypodSelector/namespaceSelector.
2. Service Exposure
- Accidental Public Exposure: Flag
LoadBalancerservices lacking internal annotations if meant to be internal. - NodePort Usage: Flag
NodePortusage (bypasses standard protections). - Sensitive Ports: Flag exposure of admin/sensitive ports (22, 3389, 2379, 10250).
3. Traffic Routing
- Ingress TLS: Require
tlsblock on Ingresses. Flag missing HTTP->HTTPS redirects. - Endpoint Hijacking: Flag manual
Endpoints/EndpointSliceresources (risk of malicious external redirect). - HostNetwork Bypass: Flag
hostNetwork: true(bypasses pod network policies).
4. Service Mesh
- mTLS Enforcement: Require
STRICTmutual TLS viaPeerAuthentication. - Authorization Bypass: Ensure
AuthorizationPoliciesfollow default-deny and don't conflict with legacy policies.
Signals
- GitHub stars
- 54
- Forks
- 36
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
review-security-k8s-network- Source
- github.com/gke-labs/kube-agents