Ensure Master Authorized Networks Is Enabled

#!/usr/bin/env bash
#
# Report GKE Master Authorized Networks status for all clusters in the project.
# REQUIREMENTS:
#   - gcloud CLI installed and authenticated
#   - jq installed
#
# RUN ON: any machine with gcloud access to the GCP project.

set -euo pipefail

PROJECT_ID="$(gcloud config get-value project 2>/dev/null || true)"
if [[ -z "${PROJECT_ID}" ]]; then
  echo "ERROR: No default project set in gcloud config."
  echo "Run: gcloud config set project PROJECT_ID"
  exit 1
fi

echo "Using project: ${PROJECT_ID}"
echo

# List all zones that have GKE clusters in this project
ZONES="$(gcloud container clusters list \
  --project "${PROJECT_ID}" \
  --format='value(location)' 2>/dev/null | sort -u)"

if [[ -z "${ZONES}" ]]; then
  echo "No GKE clusters found in project ${PROJECT_ID}."
  exit 0
fi

printf "Cluster,Location,MAN_Enabled,Has_Authorized_Networks,Authorized_CIDRs\n"

# For each cluster, describe and extract masterAuthorizedNetworksConfig
while read -r LOCATION; do
  [[ -z "${LOCATION}" ]] && continue

  # The same list command will work for both zonal and regional clusters
  CLUSTERS_IN_LOC="$(gcloud container clusters list \
    --project "${PROJECT_ID}" \
    --region "${LOCATION}" \
    --format='value(name)' 2>/dev/null || true)"

  if [[ -z "${CLUSTERS_IN_LOC}" ]]; then
    # Try as zone if region listing failed / empty
    CLUSTERS_IN_LOC="$(gcloud container clusters list \
      --project "${PROJECT_ID}" \
      --zone "${LOCATION}" \
      --format='value(name)' 2>/dev/null || true)"
  fi

  while read -r CLUSTER; do
    [[ -z "${CLUSTER}" ]] && continue

    # Describe cluster; location can be region or zone, gcloud will handle it
    DESC_JSON="$(gcloud container clusters describe "${CLUSTER}" \
      --project "${PROJECT_ID}" \
      --location "${LOCATION}" \
      --format=json 2>/dev/null || true)"

    if [[ -z "${DESC_JSON}" ]]; then
      printf "%s,%s,ERROR,ERROR,ERROR (failed to describe cluster)\n" \
        "${CLUSTER}" "${LOCATION}"
      continue
    fi

    # Extract masterAuthorizedNetworksConfig block
    MAN_CFG="$(printf '%s\n' "${DESC_JSON}" | jq -c '.masterAuthorizedNetworksConfig')"

    if [[ "${MAN_CFG}" == "null" || "${MAN_CFG}" == "{}" ]]; then
      # MAN not configured at all
      printf "%s,%s,DISABLED,NO,\n" "${CLUSTER}" "${LOCATION}"
      continue
    fi

    ENABLED="$(printf '%s\n' "${MAN_CFG}" | jq -r '.enabled // "false"')"
    # Extract all CIDRs if present
    CIDRS="$(printf '%s\n' "${MAN_CFG}" \
      | jq -r '.cidrBlocks[]? | .displayName + "=" + .cidrBlock' 2>/dev/null \
      | paste -sd'|' -)"

    if [[ "${ENABLED}" != "true" ]]; then
      printf "%s,%s,DISABLED,YES,%s\n" "${CLUSTER}" "${LOCATION}" "${CIDRS}"
    else
      if [[ -z "${CIDRS}" ]]; then
        # Enabled but no specific networks configured (effectively open)
        printf "%s,%s,ENABLED,BUT_NO_CIDRS,\n" "${CLUSTER}" "${LOCATION}"
      else
        printf "%s,%s,ENABLED,YES,%s\n" "${CLUSTER}" "${LOCATION}" "${CIDRS}"
      fi
    fi

  done <<< "${CLUSTERS_IN_LOC}"

done <<< "${ZONES}"