Every Non-System Namespace Should Have A Default-Deny NetworkPolicy

# 1) List non-system namespaces and see which lack default-deny
# Run on: any machine with kubectl access
kubectl get ns

# 2) For each *application* namespace that should be isolated, create a default-deny NetworkPolicy.
# Replace <NAMESPACE> with the target namespace name.

cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: <NAMESPACE>
spec:
  podSelector: {}
  policyTypes:
    - Ingress
EOF

# Example for namespace "payments"
cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: payments
spec:
  podSelector: {}
  policyTypes:
    - Ingress
EOF

# 3) (Optional but recommended) Store the manifest in Git/IaC.
# Example manifest file you can commit, parameterized per namespace:

# file: networkpolicy-default-deny-ingress-payments.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: payments
spec:
  podSelector: {}
  policyTypes:
    - Ingress

# Apply it:
kubectl apply -f networkpolicy-default-deny-ingress-payments.yaml

# Run on: any machine with kubectl access
{ kubectl get networkpolicies --all-namespaces -o json \
  kubectl get namespaces -o json; } | jq -rs '
  .[0] as $nps | .[1] |
  [ .items[]
  | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ $nps.items[]
       | select(.metadata.namespace == $m.name)
       | select((.spec.podSelector == {}) or (.spec.podSelector.matchLabels == null and .spec.podSelector.matchExpressions == null))
       | select((.spec.policyTypes // []) | index("Ingress")) ] | length) as $deny
  | "kind=Namespace name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $labels == "" then "" else " labels=\($labels)" end)
    + " defaultDenyPolicies=\($deny)"
    + " is_compliant=\(if $deny > 0 then "true" else "false" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

#!/usr/bin/env bash
#
# Ensure every non-system namespace in a GKE cluster has a default-deny
# ingress NetworkPolicy, per CBP C3.1.
#
# Requirements:
# - Run on any machine with kubectl access and sufficient RBAC
# - kubectl configured for the target GKE cluster/context
#
# Safe to re-run: uses create --dry-run=client | apply for idempotency.

set -euo pipefail

# Name of the default-deny policy to enforce in each namespace
POLICY_NAME="default-deny-ingress"

echo "Discovering non-system namespaces..."

# Get all namespaces except the standard system ones
mapfile -t NAMESPACES < <(
  kubectl get namespaces -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' \
  | grep -Ev '^(kube-system|kube-public|kube-node-lease)$' \
  || true
)

if [ "${#NAMESPACES[@]}" -eq 0 ]; then
  echo "No non-system namespaces found."
else
  for ns in "${NAMESPACES[@]}"; do
    [ -z "$ns" ] && continue
    echo "Ensuring default-deny ingress NetworkPolicy in namespace: ${ns}"

    # Create-or-update a default-deny ingress NetworkPolicy:
    # - empty podSelector => applies to all pods in the namespace
    # - policyTypes: [Ingress] => denies all ingress by default
    kubectl create networkpolicy "${POLICY_NAME}" \
      --namespace "${ns}" \
      --pod-selector='' \
      --ingress='{}' \
      --dry-run=client -o yaml \
    | kubectl apply -f -
  done
fi

echo
echo "Verification: checking that every non-system namespace has at least one"
echo "default-deny ingress NetworkPolicy (empty podSelector, policyTypes includes Ingress)."
echo

{ kubectl get networkpolicies --all-namespaces -o json
  kubectl get namespaces -o json
} | jq -rs '
  .[0] as $nps | .[1] |
  [ .items[]
  | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ $nps.items[]
       | select(.metadata.namespace == $m.name)
       | select((.spec.podSelector == {}) or (.spec.podSelector.matchLabels == null and .spec.podSelector.matchExpressions == null))
       | select((.spec.policyTypes // []) | index("Ingress")) ] | length) as $deny
  | "kind=Namespace name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $labels == "" then "" else " labels=\($labels)" end)
    + " defaultDenyPolicies=\($deny)"
    + " is_compliant=\(if $deny > 0 then "true" else "false" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'