auditing-network-policy-segmentation-gapslisted

# Auditing network segmentation gaps: when every pod can reach every pod Kubernetes networking is open by default: without a policy, every pod can talk to every other pod, every service, and often the internet and the cloud metadata endpoint. Network policy is what closes that down, so segmentation is not a property the cluster has, it is a property each namespace earns by having policies that actually constrain reachability in both directions. The gaps are predictable: a namespace with no default-deny where the whole open default still applies, a missing egress rule that lets a compromised pod exfiltrate or reach the node metadata endpoint, a selector broad enough to admit sources it never meant to, and a policy that locks ingress while egress stays wide open. Lateral movement and egress are exactly what an attacker does after a foothold, and segmentation is what limits both. You audit this by checking, per namespace and per workload, what can actually reach what. ## When to use - Network policy is the control meant to limit pod-to-pod, pod-to-service, or pod-to-external reachability. - Namespaces may lack a default-deny, so the open-by-default reachability still applies. - Egress may be unconstrained, letting a compromised pod reach the internet or the cloud metadata endpoint. ## Scope check Test segmentation only on clusters you own or are authorized to assess, on non-production namespaces. Probing reachability sends traffic between real pods and possibly outbound, so