> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Policy Should Be Enabled

### More Info:

Ensures all Kubernetes clusters have network policy enabled. Kubernetes network policy creates isolation between cluster pods, this creates a more secure environment with only specified connections allowed.

### Risk Level

Medium

### Address

Security

### Compliance Standards

NISTCSF

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of "Network Policy Should Be Enabled" in GCP using GCP console, please follow the below steps:

        1. Login to your GCP console.
        2. Navigate to the VPC Network page.
        3. Click on the VPC network that you want to remediate.
        4. Click on the Firewall rules tab.
        5. Click on the Create Firewall Rule button.
        6. Enter a name for the firewall rule.
        7. In the Targets section, select the network that you want to apply the firewall rule to.
        8. In the Source filter section, select the IP ranges that you want to allow or block.
        9. In the Protocols and ports section, specify the protocols and ports that you want to allow or block.
        10. In the Action section, select the action that you want to take on the traffic that matches the firewall rule.
        11. Click on the Create button to create the firewall rule.

        By following the above steps, you will be able to remediate the misconfiguration of "Network Policy Should Be Enabled" in GCP using GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Network Policy Should Be Enabled" misconfiguration in GCP using GCP CLI, follow the below steps:

        1. Open the GCP Cloud Shell from the GCP console.
        2. Run the following command to enable the Network Policy for the default network in your GCP project:
           ```
           gcloud compute networks update default --update-policy=ENABLE_NETWORK_POLICY
           ```
        3. This command will update the default network with the Network Policy enabled.

        Once the Network Policy is enabled, you can create and apply the necessary firewall rules to control traffic between your VM instances. You can also create a custom network with the Network Policy enabled and use it for your VM instances.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Network Policy Should Be Enabled" in GCP using Python, you can follow the below steps:

        1. Import the required libraries:

        ```python theme={null}
        from googleapiclient import discovery
        from oauth2client.client import GoogleCredentials
        ```

        2. Set the project ID and the zone where the cluster is located:

        ```python theme={null}
        project_id = 'your-project-id'
        zone = 'us-central1-a'
        ```

        3. Get the credentials to access the GCP API:

        ```python theme={null}
        credentials = GoogleCredentials.get_application_default()
        ```

        4. Create a client object for the Kubernetes API:

        ```python theme={null}
        container_api = discovery.build('container', 'v1', credentials=credentials)
        ```

        5. Get the list of clusters in the project:

        ```python theme={null}
        clusters = container_api.projects().zones().clusters().list(projectId=project_id, zone=zone).execute()
        ```

        6. Loop through the clusters and enable network policy:

        ```python theme={null}
        for cluster in clusters['clusters']:
            # Get the cluster name
            cluster_name = cluster['name']
            
            # Get the current cluster configuration
            cluster_config = container_api.projects().zones().clusters().get(projectId=project_id, zone=zone, clusterId=cluster_name).execute()
            
            # Check if network policy is already enabled
            if cluster_config['networkPolicy']['enabled']:
                print(f"Network policy is already enabled for cluster {cluster_name}")
            else:
                # Enable network policy
                cluster_config['networkPolicy']['enabled'] = True
                
                # Update the cluster configuration
                update_op = container_api.projects().zones().clusters().update(projectId=project_id, zone=zone, clusterId=cluster_name, body=cluster_config).execute()
                
                print(f"Network policy is enabled for cluster {cluster_name}")
        ```

        This code will loop through all the clusters in the specified project and zone, and enable network policy for each cluster that does not already have it enabled.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/kubernetes-engine/docs/how-to/network-policy](https://cloud.google.com/kubernetes-engine/docs/how-to/network-policy)