Kubernetes NetworkPolicy Review

Server

k8s-mcp — vendored third-party (containers/kubernetes-mcp-server v0.0.66, Apache-2.0), a pinned static Go binary. 7 tools, strictly read-only, Secrets denied.

⚠ Two rules before anything else

1. No NetworkPolicy means ALL traffic is permitted

Kubernetes is default-allow. A namespace with zero policies permits everything, in both directions.

So "no policies found" is not a neutral observation — it is a finding, and reporting it without the consequence invites exactly the wrong conclusion. Someone reading "no policies" while thinking about security will hear "nothing to worry about". The opposite is true.

Always say the consequence: "No NetworkPolicy applies to this workload, so all ingress and egress traffic is permitted."