<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-container-network-policies
description: >-
  Audit Kubernetes NetworkPolicies for completeness, identify pods without
  network restrictions, detect overly permissive rules, and validate
  microsegmentation using kubectl, Cilium, and Calico tools.
domain: cybersecurity
subdomain: container-security
tags:
  - network-policy
  - kubernetes
  - microsegmentation
  - calico
  - cilium
  - zero-trust
  - network-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562.004"]
---

# Auditing Container Network Policies

## Overview

Network policies are the firewall layer for Kubernetes pods. Without them, all
pods can communicate freely — a lateral movement paradise. This skill covers
auditing policy coverage across namespaces, identifying pods without network
restrictions, detecting overly permissive allow-all rules, and validating
default-deny posture using kubectl, Cilium, and Calico tooling.

Mode: `[MODE: BLUE]` — Defensive network segmentation.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes >= 1.25 with CNI supporting NetworkPolicy (Calico, Cilium, Weave) | Required |
| kubectl configured with cluster access | Required |
| Cilium CLI or calicoctl for advanced analysis | Required |

## Key Concepts

### Identifying Unprotected Namespaces

```bash
# List namespaces without any NetworkPolicy
kubectl get namespaces -o json | jq -r '
  .items[].metadata.name' | while read ns; do
  count=$(kubectl get networkpolicies -n "$ns" --no-headers 2>/dev/null | wc -l)
  if [ "$count" -eq 0 ]; then echo "UNPROTECTED: $ns"; fi
done
```

### Default Deny Policies

```yaml
# Default deny all ingress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress

---
# Default deny egress with DNS exception
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
```

### Cilium Network Policy Analysis

```bash
cilium status --verbose | grep -A5 "Policy Enforcement"
cilium monitor --type drop
cilium endpoint list
```

## Workflow

### Step 1: Audit Network Policy Coverage

```bash
node scripts/agent.js --audit-coverage --output /tmp/netpol-audit.json
```

### Step 2: Check for Overly Permissive Rules

```bash
node scripts/agent.js --check-permissive --namespace production --output /tmp/permissive.json
```

### Step 3: Apply Default Deny Policies

```bash
kubectl apply -f default-deny-ingress.yaml -n production
```

## Detection

```yaml
title: Auditing Container Network Policies Detection
id: 9ef15183-bb65-41f9-a72f-69a5cfe474ed
status: experimental
description: Detects suspicious activity related to auditing container network policies techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1562.004
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Container Network Policies Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1562.004 |

## Verification

- [ ] All production namespaces have default deny ingress policies
- [ ] Default deny egress applied with DNS exception
- [ ] No pods exist without NetworkPolicy coverage
- [ ] Cross-namespace traffic explicitly allowed only where required
- [ ] No policies with empty podSelector and allow-all rules
- [ ] Egress restricted to required destinations only

## References

- [Kubernetes NetworkPolicy](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
- [Calico Network Policy](https://docs.tigera.io/calico/latest/network-policy/)
- [Cilium Network Policy](https://docs.cilium.io/en/stable/security/policy/)
- [CIS Kubernetes Benchmark 5.3 — Network Policies](https://www.cisecurity.org/benchmark/kubernetes)
- [NIST SP 800-190 §4.4 — Container Network Security](https://csrc.nist.gov/publications/detail/sp/800-190/final)
