review-security-k8s-agents-firewall

name	review-security-k8s-agents-firewall
description	Reviews Kubernetes network and firewall configurations specifically for AI agent execution sandboxes.

Task

Review network policies and firewall configs for AI agent control loops and execution sandboxes.

Checks

1. Egress Restrictions

• Sandbox Network: Enforce default-deny egress. Allowlist absolute minimum required IPs/services.
• Internal APIs: Block agent/sandbox access to internal cluster APIs, K8s services, and cloud metadata (e.g., 169.254.169.254).
• Exfiltration Vectors: Flag broad egress (e.g., 0.0.0.0/0) on agent pods.

2. Ingress & Invocation

• Authorized Sources: Restrict agent API ingress to trusted upstream services (auth gateways, orchestrators).
• Bypass Prevention: Flag LoadBalancer or NodePort exposure on main agent containers lacking strict ingress NetworkPolicies.