> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Clusters Should Have Network Policies Or Dataplane V2 Enabled

### More Info:

GKE cluster should have Network Policies or Dataplane V2 enabled

### Risk Level

High

### Address

Performance Efficiency, Operational Excellence, Reliability, Security

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Clusters should have network policies or dataplane v2 enabled" in GCP using the GCP console, you can follow the below steps:

        1. Login to GCP console ([https://console.cloud.google.com/](https://console.cloud.google.com/)).

        2. Navigate to the Kubernetes Engine section in the left-hand menu.

        3. Select the cluster that needs to be remediated.

        4. Click on the Edit button at the top of the page.

        5. Scroll down to the Networking section and click on the checkbox next to "Enable Network Policy Enforcement".

        6. If you want to enable Dataplane V2, click on the checkbox next to "Enable Dataplane V2".

        7. Click on the Save button at the bottom of the page.

        8. Wait for the changes to take effect. It may take a few minutes for the changes to propagate across the cluster.

        Once the above steps are completed, the misconfiguration "Clusters should have network policies or dataplane v2 enabled" will be remediated in GCP.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" for GCP using GCP CLI, you can follow the below steps:

        1. Open the GCP Cloud Shell.

        2. Run the following command to enable the Dataplane V2 API:

        ```
        gcloud beta container clusters update CLUSTER_NAME --zone=ZONE --update-addons=NetworkPolicy=ENABLED --enable-dataplane-v2
        ```

        Replace CLUSTER\_NAME with the name of your GCP cluster and ZONE with the zone in which the cluster is located.

        3. After the command executes successfully, verify that the Dataplane V2 API is enabled by running the following command:

        ```
        gcloud beta container clusters describe CLUSTER_NAME --zone=ZONE | grep -i dataplane
        ```

        This command should return the output "dataplaneV2Enabled: true".

        4. To enable network policies for the cluster, run the following command:

        ```
        gcloud beta container clusters update CLUSTER_NAME --zone=ZONE --update-addons=NetworkPolicy=ENABLED
        ```

        5. Verify that network policies are enabled by running the following command:

        ```
        gcloud beta container clusters describe CLUSTER_NAME --zone=ZONE | grep -i networkpolicy
        ```

        This command should return the output "networkPolicyConfig: enabled: true".

        After following these steps, the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" should be remediated for your GCP cluster.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" in GCP using python, you can follow the below steps:

        1. First, you need to authenticate to GCP using a service account. You can create a service account and download the key file from the GCP console.

        ```python theme={null}
        from google.oauth2 import service_account
        from google.cloud import container_v1

        credentials = service_account.Credentials.from_service_account_file(
            'path/to/key.json')
        client = container_v1.ClusterManagerClient(credentials=credentials)
        ```

        2. Next, you need to get the list of clusters in the project.

        ```python theme={null}
        project_id = 'your-project-id'
        zone = 'us-central1-a' # replace with your desired zone
        clusters = client.list_clusters(project_id, zone)
        ```

        3. For each cluster, you need to check if network policies or dataplane v2 is enabled. If not, you need to enable it.

        ```python theme={null}
        for cluster in clusters:
            name = cluster.name
            network_policy = cluster.network_policy
            datapath_provider = cluster.datapath_provider
            
            if not network_policy or datapath_provider != 'DATAPLANE_V2':
                # update the cluster
                update = container_v1.types.ClusterUpdate()
                update.name = name
                update.network_policy = container_v1.types.NetworkPolicy(enabled=True)
                update.datapath_provider = 'DATAPLANE_V2'
                operation = client.update_cluster(project_id, zone, name, update)
                print(f"Updated cluster {name}. Operation: {operation.operation_id}")
        ```

        4. Finally, you can run the python script to remediate the misconfiguration.

        Note: You need to have the necessary permissions to update the clusters in the project.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>