• Scans all namespaces for NetworkPolicy coverage
• Smart namespace filtering with 3 strategies:
  • Pattern-based: auto-skips kube-, istio-, calico-,
    tigera-, cert-manager, ingress-nginx, flux-system,
    argocd, velero, longhorn-, cattle-, openshift-,
    gke-, azure-, karpenter, crossplane-
  • Label-based: pod-security.kubernetes.io/enforce=privileged
  • User flag: --skip-namespaces ns1,ns2
• Risk levels: HIGH (prod/staging/system), LOW (dev)
• Coverage percentage bar
• Sorted by risk then pod count
• kubectl default-deny template in recommendations
• Multi-cluster support (--all-clusters, --cluster-group)
• Namespace filter support (--namespace)