CKV2_K8S_6 passes pods that do not satisfy NetworkPolicy matchExpressions

Describe the issue

CKV2_K8S_6 reports a pod as passed when the only NetworkPolicy uses a matchExpressions selector that the pod does not satisfy.

Kubernetes requires every matchLabels and matchExpressions requirement in a label selector to match. In this example, a pod labeled tier: api does not satisfy tier In [worker]. Checkov currently treats the policy as associated with the pod anyway.

This reproduces with Checkov 3.3.16 and current main at d8aec9dba01c173dac52ebe1dece1ef0c1026eed.

Example

Save the following as manifests.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: default
spec:
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      labels:
        app: demo
        tier: api
    spec:
      containers:
        - name: demo
          image: nginx:1.27
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: workers-only
  namespace: default
spec:
  podSelector:
    matchExpressions:
      - key: tier
        operator: In
        values:
          - worker
  policyTypes:
    - Ingress

Run:

$ checkov -f manifests.yaml --framework kubernetes --check CKV2_K8S_6 --skip-download

Actual result:

Check: CKV2_K8S_6: "Minimize the admission of pods which lack an associated NetworkPolicy"
    PASSED for resource: Pod.default.demo.app-demo.tier-api

Expected result:

The pod should fail CKV2_K8S_6 because the available NetworkPolicy selects tier In [worker], while the pod has tier: api.

The matching control, with the expression changed to tier In [api], passes as expected. A non-matching matchLabels control also fails as expected, so the mismatch appears specific to matchExpressions handling.

Kubernetes documents that matchLabels and matchExpressions requirements are ANDed and that all requirements must be satisfied: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#resources-that-support-set-based-requirements

As an independent same-predicate cross-check, public IaC-Guard-V 0.1.0b1 returns VIOLATED for this fixture and records that the In expression observed api while requiring worker.

A small Checkov-native regression against NetworkPolicyEdgeBuilder also fails on current main. I can prepare a focused fix and regression PR if this behavior is confirmed.

Desktop

• OS: macOS 26.5.1, arm64
• Checkov: 3.3.16
• Python: 3.12