Skip to main content

Network Policy Should Be Enabled

More Info:​

Ensures all Kubernetes clusters have network policy enabled. Kubernetes network policy creates isolation between cluster pods, this creates a more secure environment with only specified connections allowed.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • NIST CSF

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of "Network Policy Should Be Enabled" in GCP using GCP console, please follow the below steps:

  1. Login to your GCP console.
  2. Navigate to the VPC Network page.
  3. Click on the VPC network that you want to remediate.
  4. Click on the Firewall rules tab.
  5. Click on the Create Firewall Rule button.
  6. Enter a name for the firewall rule.
  7. In the Targets section, select the network that you want to apply the firewall rule to.
  8. In the Source filter section, select the IP ranges that you want to allow or block.
  9. In the Protocols and ports section, specify the protocols and ports that you want to allow or block.
  10. In the Action section, select the action that you want to take on the traffic that matches the firewall rule.
  11. Click on the Create button to create the firewall rule.

By following the above steps, you will be able to remediate the misconfiguration of "Network Policy Should Be Enabled" in GCP using GCP console.

Using CLI

To remediate the "Network Policy Should Be Enabled" misconfiguration in GCP using GCP CLI, follow the below steps:

  1. Open the GCP Cloud Shell from the GCP console.
  2. Run the following command to enable the Network Policy for the default network in your GCP project: 
    gcloud compute networks update default --update-policy=ENABLE_NETWORK_POLICY
  3. This command will update the default network with the Network Policy enabled.

Once the Network Policy is enabled, you can create and apply the necessary firewall rules to control traffic between your VM instances. You can also create a custom network with the Network Policy enabled and use it for your VM instances.

Using Python

To remediate the misconfiguration "Network Policy Should Be Enabled" in GCP using Python, you can follow the below steps:

  1. Import the required libraries:
from googleapiclient import discovery
from oauth2client.client import GoogleCredentials
  1. Set the project ID and the zone where the cluster is located:
project_id = 'your-project-id'
zone = 'us-central1-a'
  1. Get the credentials to access the GCP API:
credentials = GoogleCredentials.get_application_default()
  1. Create a client object for the Kubernetes API:
container_api = discovery.build('container', 'v1', credentials=credentials)
  1. Get the list of clusters in the project:
clusters = container_api.projects().zones().clusters().list(projectId=project_id, zone=zone).execute()
  1. Loop through the clusters and enable network policy:
for cluster in clusters['clusters']:
    # Get the cluster name
    cluster_name = cluster['name']
    
    # Get the current cluster configuration
    cluster_config = container_api.projects().zones().clusters().get(projectId=project_id, zone=zone, clusterId=cluster_name).execute()
    
    # Check if network policy is already enabled
    if cluster_config['networkPolicy']['enabled']:
        print(f"Network policy is already enabled for cluster {cluster_name}")
    else:
        # Enable network policy
        cluster_config['networkPolicy']['enabled'] = True
        
        # Update the cluster configuration
        update_op = container_api.projects().zones().clusters().update(projectId=project_id, zone=zone, clusterId=cluster_name, body=cluster_config).execute()
        
        print(f"Network policy is enabled for cluster {cluster_name}")

This code will loop through all the clusters in the specified project and zone, and enable network policy for each cluster that does not already have it enabled.

Using Terraform
resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"        # replace with your cluster name
  location = "GCP_REGION_OR_ZONE"      # replace with the region/zone
  project  = "GCP_PROJECT_ID"          # replace with your project ID

  # ... other required cluster arguments ...

  # Enable Kubernetes Network Policy
  network_policy {
    enabled  = true
    provider = "CALICO"
  }

  # Ensure the Network Policy add-on is enabled
  addons_config {
    network_policy_config {
      disabled = false
    }
  }
}

This change is applied in place on an existing cluster (no forced replacement), though GKE may perform rolling operations on nodes as network policy is enabled.

Verification: terraform plan should show network_policy.enabled changing from false (or unset) to true, network_policy.provider set to "CALICO", and addons_config.network_policy_config.disabled changing from true (or unset) to false on the google_container_cluster.GKE_CLUSTER resource.

Additional Reading:​