Clusters Should Have Network Policies Or Dataplane V2

More Info:

GKE cluster should have Network Policies or Dataplane V2 enabled

Risk Level

High

Address

Operational Excellence, Performance Efficiency, Reliability, Security

Compliance Standards

Cloudanix Best Practice

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Clusters should have network policies or dataplane v2 enabled" in GCP using the GCP console, you can follow the below steps:

Login to GCP console (https://console.cloud.google.com/).
Navigate to the Kubernetes Engine section in the left-hand menu.
Select the cluster that needs to be remediated.
Click on the Edit button at the top of the page.
Scroll down to the Networking section and click on the checkbox next to "Enable Network Policy Enforcement".
If you want to enable Dataplane V2, click on the checkbox next to "Enable Dataplane V2".
Click on the Save button at the bottom of the page.
Wait for the changes to take effect. It may take a few minutes for the changes to propagate across the cluster.

Once the above steps are completed, the misconfiguration "Clusters should have network policies or dataplane v2 enabled" will be remediated in GCP.

Using CLI

To remediate the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" for GCP using GCP CLI, you can follow the below steps:

Open the GCP Cloud Shell.
Run the following command to enable the Dataplane V2 API:

gcloud beta container clusters update CLUSTER_NAME --zone=ZONE --update-addons=NetworkPolicy=ENABLED --enable-dataplane-v2

Replace CLUSTER_NAME with the name of your GCP cluster and ZONE with the zone in which the cluster is located.

After the command executes successfully, verify that the Dataplane V2 API is enabled by running the following command:

gcloud beta container clusters describe CLUSTER_NAME --zone=ZONE | grep -i dataplane

This command should return the output "dataplaneV2Enabled: true".

To enable network policies for the cluster, run the following command:

gcloud beta container clusters update CLUSTER_NAME --zone=ZONE --update-addons=NetworkPolicy=ENABLED

Verify that network policies are enabled by running the following command:

gcloud beta container clusters describe CLUSTER_NAME --zone=ZONE | grep -i networkpolicy

This command should return the output "networkPolicyConfig: enabled: true".

After following these steps, the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" should be remediated for your GCP cluster.

Using Python

To remediate the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" in GCP using python, you can follow the below steps:

First, you need to authenticate to GCP using a service account. You can create a service account and download the key file from the GCP console.

from google.oauth2 import service_account
from google.cloud import container_v1

credentials = service_account.Credentials.from_service_account_file(
    'path/to/key.json')
client = container_v1.ClusterManagerClient(credentials=credentials)

Next, you need to get the list of clusters in the project.

project_id = 'your-project-id'
zone = 'us-central1-a' # replace with your desired zone
clusters = client.list_clusters(project_id, zone)

For each cluster, you need to check if network policies or dataplane v2 is enabled. If not, you need to enable it.

for cluster in clusters:
    name = cluster.name
    network_policy = cluster.network_policy
    datapath_provider = cluster.datapath_provider
    
    if not network_policy or datapath_provider != 'DATAPLANE_V2':
        # update the cluster
        update = container_v1.types.ClusterUpdate()
        update.name = name
        update.network_policy = container_v1.types.NetworkPolicy(enabled=True)
        update.datapath_provider = 'DATAPLANE_V2'
        operation = client.update_cluster(project_id, zone, name, update)
        print(f"Updated cluster {name}. Operation: {operation.operation_id}")

Finally, you can run the python script to remediate the misconfiguration.

Note: You need to have the necessary permissions to update the clusters in the project.

Using Terraform

resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
  location = "GCP_REGION_OR_ZONE"        # replace with your region or zone
  project  = "GCP_PROJECT_ID"            # replace with your project ID

  # OPTION 1: Enable Network Policy (Calico)
  addons_config {
    network_policy_config {
      disabled = false
    }
  }

  network_policy {
    enabled  = true
    provider = "CALICO"
  }

  # OPTION 2 (alternative to OPTION 1): Enable Dataplane V2 instead of network policy
  # Do NOT use this together with the network_policy block above for the same cluster.
  # datapath_provider = "ADVANCED_DATAPATH"

  # ...other required cluster arguments...
}

Enabling network policy or changing datapath_provider may force recreation of the cluster or its node pools; review the plan carefully to avoid an unintended outage.

terraform plan should show either:

updates to addons_config.network_policy_config and network_policy.enabled/provider, or
an update setting datapath_provider = "ADVANCED_DATAPATH",
with no other unexpected changes.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​