Ensure Control Plane Authorized Networks Is Enabled

#!/usr/bin/env bash
#
# Report GKE Control Plane Authorized Networks configuration
# for all clusters in one or more projects.
#
# Requirements:
#   - gcloud CLI authenticated and configured
#   - jq installed
#
# Usage examples:
#   ./report-master-authorized-networks.sh            # uses current gcloud project
#   GCP_PROJECTS="proj-a proj-b" ./report-master-authorized-networks.sh

set -euo pipefail

# Space-separated list of projects. If not set, use current gcloud project.
GCP_PROJECTS="${GCP_PROJECTS:-}"

if [[ -z "${GCP_PROJECTS}" ]]; then
  CURRENT_PROJECT="$(gcloud config get-value project 2>/dev/null || true)"
  if [[ -z "${CURRENT_PROJECT}" ]]; then
    echo "ERROR: No project set. Either:"
    echo "  - run: gcloud config set project <PROJECT_ID>"
    echo "  - or set GCP_PROJECTS=\"proj-a proj-b\" before running this script."
    exit 1
  fi
  GCP_PROJECTS="${CURRENT_PROJECT}"
fi

echo "Reporting Control Plane Authorized Networks state"
echo "Projects: ${GCP_PROJECTS}"
echo "Timestamp: $(date -Iseconds)"
echo

for PROJECT in ${GCP_PROJECTS}; do
  echo "==== Project: ${PROJECT} ===="

  # List all clusters (both zonal and regional) in the project.
  # We use --format to get a simple JSON array for easier parsing.
  CLUSTERS_JSON="$(gcloud container clusters list \
    --project "${PROJECT}" \
    --format='json(name,location,endpoint)' 2>/dev/null || true)"

  if [[ -z "${CLUSTERS_JSON}" || "${CLUSTERS_JSON}" == "[]" ]]; then
    echo "  No GKE clusters found."
    echo
    continue
  fi

  echo "${CLUSTERS_JSON}" | jq -c '.[]' | while read -r CLUSTER; do
    NAME="$(echo "${CLUSTER}"     | jq -r '.name')"
    LOCATION="$(echo "${CLUSTER}" | jq -r '.location')"
    ENDPOINT="$(echo "${CLUSTER}" | jq -r '.endpoint')"

    # Describe cluster to get masterAuthorizedNetworksConfig
    DESC_JSON="$(gcloud container clusters describe "${NAME}" \
      --location "${LOCATION}" \
      --project "${PROJECT}" \
      --format=json 2>/dev/null || true)"

    if [[ -z "${DESC_JSON}" ]]; then
      echo "  [ERROR] Failed to describe cluster ${NAME} (${LOCATION})"
      continue
    fi

    MAN_CFG="$(echo "${DESC_JSON}" | jq '.masterAuthorizedNetworksConfig')"

    # Determine basic status:
    # - If null or {}: feature disabled => NON-COMPLIANT
    # - If enabled == false or missing: treat as disabled => NON-COMPLIANT
    # - If enabled == true but no cidrBlocks or an empty list: MISCONFIGURED
    # - If enabled == true with non-empty cidrBlocks: configured (needs review)
    ENABLED_RAW="$(echo "${DESC_JSON}" | jq '.masterAuthorizedNetworksConfig.enabled // false')"
    CIDR_COUNT="$(echo "${DESC_JSON}" \
      | jq '.masterAuthorizedNetworksConfig.cidrBlocks // [] | length')"

    STATUS="UNKNOWN"
    REASON=""

    if [[ "${MAN_CFG}" == "null" || "${MAN_CFG}" == "{}" ]]; then
      STATUS="NON-COMPLIANT"
      REASON="masterAuthorizedNetworksConfig is not set (feature disabled)."
    elif [[ "${ENABLED_RAW}" != "true" ]]; then
      STATUS="NON-COMPLIANT"
      REASON="masterAuthorizedNetworksConfig.enabled is false or missing (feature disabled)."
    elif [[ "${CIDR_COUNT}" -eq 0 ]]; then
      STATUS="MISCONFIGURED"
      REASON="Feature enabled but no cidrBlocks configured; review endpoint exposure."
    else
      STATUS="CONFIGURED"
      REASON="Feature enabled with ${CIDR_COUNT} configured CIDR block(s); review for least privilege."
    fi

    echo "  Cluster: ${NAME}"
    echo "    Location: ${LOCATION}"
    echo "    Endpoint: ${ENDPOINT}"
    echo "    Status:   ${STATUS}"
    echo "    Detail:   ${REASON}"
    echo "    masterAuthorizedNetworksConfig:"
    echo "${MAN_CFG}" | jq '."enabled", ."cidrBlocks"' | sed 's/^/      /'
    echo
  done

  echo
done