> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# K8s network policies engine remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Clusters should have network policies or dataplane v2 enabled" in GCP using the GCP console, you can follow the below steps:

        1. Login to GCP console ([https://console.cloud.google.com/](https://console.cloud.google.com/)).

        2. Navigate to the Kubernetes Engine section in the left-hand menu.

        3. Select the cluster that needs to be remediated.

        4. Click on the Edit button at the top of the page.

        5. Scroll down to the Networking section and click on the checkbox next to "Enable Network Policy Enforcement".

        6. If you want to enable Dataplane V2, click on the checkbox next to "Enable Dataplane V2".

        7. Click on the Save button at the bottom of the page.

        8. Wait for the changes to take effect. It may take a few minutes for the changes to propagate across the cluster.

        Once the above steps are completed, the misconfiguration "Clusters should have network policies or dataplane v2 enabled" will be remediated in GCP.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" for GCP using GCP CLI, you can follow the below steps:

        1. Open the GCP Cloud Shell.

        2. Run the following command to enable the Dataplane V2 API:

        ```
        gcloud beta container clusters update CLUSTER_NAME --zone=ZONE --update-addons=NetworkPolicy=ENABLED --enable-dataplane-v2
        ```

        Replace CLUSTER\_NAME with the name of your GCP cluster and ZONE with the zone in which the cluster is located.

        3. After the command executes successfully, verify that the Dataplane V2 API is enabled by running the following command:

        ```
        gcloud beta container clusters describe CLUSTER_NAME --zone=ZONE | grep -i dataplane
        ```

        This command should return the output "dataplaneV2Enabled: true".

        4. To enable network policies for the cluster, run the following command:

        ```
        gcloud beta container clusters update CLUSTER_NAME --zone=ZONE --update-addons=NetworkPolicy=ENABLED
        ```

        5. Verify that network policies are enabled by running the following command:

        ```
        gcloud beta container clusters describe CLUSTER_NAME --zone=ZONE | grep -i networkpolicy
        ```

        This command should return the output "networkPolicyConfig: enabled: true".

        After following these steps, the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" should be remediated for your GCP cluster.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Clusters Should Have Network Policies Or Dataplane V2 Enabled" in GCP using python, you can follow the below steps:

        1. First, you need to authenticate to GCP using a service account. You can create a service account and download the key file from the GCP console.

        ```python theme={null}
        from google.oauth2 import service_account
        from google.cloud import container_v1

        credentials = service_account.Credentials.from_service_account_file(
            'path/to/key.json')
        client = container_v1.ClusterManagerClient(credentials=credentials)
        ```

        2. Next, you need to get the list of clusters in the project.

        ```python theme={null}
        project_id = 'your-project-id'
        zone = 'us-central1-a' # replace with your desired zone
        clusters = client.list_clusters(project_id, zone)
        ```

        3. For each cluster, you need to check if network policies or dataplane v2 is enabled. If not, you need to enable it.

        ```python theme={null}
        for cluster in clusters:
            name = cluster.name
            network_policy = cluster.network_policy
            datapath_provider = cluster.datapath_provider
            
            if not network_policy or datapath_provider != 'DATAPLANE_V2':
                # update the cluster
                update = container_v1.types.ClusterUpdate()
                update.name = name
                update.network_policy = container_v1.types.NetworkPolicy(enabled=True)
                update.datapath_provider = 'DATAPLANE_V2'
                operation = client.update_cluster(project_id, zone, name, update)
                print(f"Updated cluster {name}. Operation: {operation.operation_id}")
        ```

        4. Finally, you can run the python script to remediate the misconfiguration.

        Note: You need to have the necessary permissions to update the clusters in the project.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_container_cluster" "GKE_CLUSTER" {
          name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
          location = "GCP_REGION_OR_ZONE"        # replace with your region or zone
          project  = "GCP_PROJECT_ID"            # replace with your project ID

          # OPTION 1: Enable Network Policy (Calico)
          addons_config {
            network_policy_config {
              disabled = false
            }
          }

          network_policy {
            enabled  = true
            provider = "CALICO"
          }

          # OPTION 2 (alternative to OPTION 1): Enable Dataplane V2 instead of network policy
          # Do NOT use this together with the network_policy block above for the same cluster.
          # datapath_provider = "ADVANCED_DATAPATH"

          # ...other required cluster arguments...
        }
        ```

        Enabling network policy or changing `datapath_provider` may force recreation of the cluster or its node pools; review the plan carefully to avoid an unintended outage.

        `terraform plan` should show either:

        * updates to `addons_config.network_policy_config` and `network_policy.enabled/provider`, or
        * an update setting `datapath_provider = "ADVANCED_DATAPATH"`,\
          with no other unexpected changes.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>