review-security-k8s-gateway

Auditing Kubernetes Gateway API configurations involves analyzing Gateway, HTTPRoute, and ReferenceGrant resources to identify security vulnerabilities like route hijacking and improper namespace isolation. This skill evaluates listener TLS settings and route attachment policies against secure networking best practices.

ReferenceGrant enforces cross-namespace isolation by validating cross-namespace references to maintain strict boundaries. This skill checks your Gateway API resources to ensure proper use of ReferenceGrant, preventing unauthorized cross-namespace access and exposed internal services.

Route hijacking in Kubernetes HTTPRoute configurations is caused by overlapping hostnames and overly permissive wildcard hostnames that allow unauthorized traffic interception. This skill detects these overlapping paths to prevent unauthorized traffic interception.

Yes, you can check Gateway API manifests for multi-tenant governance compliance by evaluating listener TLS settings and route attachment policies. This skill ensures your Gateway and HTTPRoute configurations meet strict multi-tenant governance requirements before deployment.

Securing a public-facing Kubernetes Gateway before deployment requires analyzing HTTPRoute configurations to ensure they are restricted to the correct namespaces and do not contain overly permissive wildcard hostnames. This skill analyzes manifests in your directory for these security risks.

Improper namespace isolation exposes internal services because misconfigured cross-namespace references bypass intended network boundaries. This skill mitigates these security misconfigurations in Kubernetes Gateway API resources to prevent unauthorized access and exposed internal services.