Ensure The CNI In Use Supports NetworkPolicies

# 1. Identify which CNI plugin is in use
# Run on: any machine with kubectl access

kubectl get pods -n kube-system -o wide | egrep 'calico|cilium|weave|flannel|canal|antrea|azure-cni|amazon-vpc-cni|gke|ovn|tigera|cni'

# Also list all DaemonSets in kube-system (most CNIs run as a DaemonSet)
kubectl get daemonsets -n kube-system -o wide

# 2. Check whether any NetworkPolicy objects exist
# Run on: any machine with kubectl access

kubectl get networkpolicy --all-namespaces

# 3. Inspect an example NetworkPolicy spec
# Run on: any machine with kubectl access

# Replace NAMESPACE and NAME with a policy you saw above
kubectl get networkpolicy -n NAMESPACE NAME -o yaml

# 4. (Optional) Quick runtime sanity check of isolation behavior
# Run on: any machine with kubectl access

# 4a. Create a test namespace
kubectl create namespace np-test

# 4b. Create two simple test pods
kubectl run client -n np-test --image=busybox --restart=Never -- /bin/sh -c "sleep 3600"
kubectl run server -n np-test --image=nginx --restart=Never

# Wait for them to be Ready
kubectl wait --for=condition=Ready pod/client pod/server -n np-test --timeout=120s

# 4c. Get the server Pod IP
SERVER_IP=$(kubectl get pod server -n np-test -o jsonpath='{.status.podIP}')
echo "$SERVER_IP"

# 4d. Test connectivity BEFORE any NetworkPolicy (should generally succeed in typical clusters)
kubectl exec -n np-test client -- wget -qO- "http://$SERVER_IP"

# 4e. Apply a default-deny NetworkPolicy in np-test
cat << 'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: np-test
spec:
  podSelector: {}
  policyTypes:
  - Ingress
EOF

# 4f. Test connectivity AGAIN after policy is applied
kubectl exec -n np-test client -- wget -qO- "http://$SERVER_IP" || echo "connection blocked"

kubectl delete namespace np-test

# 5. Verification summary command (for documentation)
# Run on: any machine with kubectl access

# Summarize CNI-related pods and whether NetworkPolicies exist
echo "=== CNI Pods (kube-system) ==="
kubectl get pods -n kube-system -o wide | egrep 'calico|cilium|weave|flannel|canal|antrea|azure-cni|amazon-vpc-cni|gke|ovn|tigera|cni' || echo "No known CNI pods found"

echo "=== NetworkPolicies in the cluster ==="
kubectl get networkpolicy --all-namespaces || echo "No NetworkPolicies defined"

#!/usr/bin/env bash
#
# Check CNI plugins in use and whether NetworkPolicies are likely to be enforced
# Run on: any machine with kubectl access and cluster-wide RBAC
#
# Requires: kubectl, jq

set -euo pipefail

echo "=== 1) Detect CNI plugins in use on each node ==="
kubectl get nodes -o wide | sed 's/^/NODE: /'

echo
echo "Node-level CNI detection (from kubelet args and CNI config paths):"
kubectl get nodes -o name | while read -r node; do
  nodename="${node##*/}"
  echo
  echo "---- ${nodename} ----"

  # Try to detect kubelet CNI-related flags from the kubelet config (if present)
  # This only works on some distros that expose config via the ConfigMap
  if kubectl -n kube-system get cm kubelet-config -o json >/dev/null 2>&1; then
    echo "  kubelet CNI configuration (cluster-wide, from kubelet-config ConfigMap):"
    kubectl -n kube-system get cm kubelet-config -o json \
      | jq -r '.data | to_entries[] | select(.key|test("kubelet")) | .value' \
      | jq -r '.cniConfDir? // "<unknown>", .cniBinDir? // "<unknown>"' \
      | awk 'NR==1{printf "    cniConfDir: %s\n",$0} NR==2{printf "    cniBinDir: %s\n",$0}'
  else
    echo "  kubelet-config ConfigMap not found; CNI paths may need to be checked on nodes directly."
  fi

  # Look for CNI-related DaemonSets on this node via nodeSelector / tolerations
  echo "  CNI-related DaemonSets scheduled on this node:"
  kubectl get daemonsets -A -o json \
    | jq -r --arg NODE "${nodename}" '
        .items[]
        | select(.metadata.name|test("calico|cilium|weave|flannel|antrea|canal|ovn|kube-ovn";"i"))
        | "\(.metadata.namespace)/\(.metadata.name)"' \
      | sed 's/^/    /' || true
done

echo
echo "=== 2) Detect installed CNI plugin components (best-effort from known labels) ==="
echo "Known network/CNI DaemonSets:"
kubectl get daemonsets -A \
  | grep -Ei 'calico|cilium|weave|flannel|antrea|canal|ovn|kube-ovn|kube-router|tigera' \
  || echo "  No known CNI DaemonSets matched by heuristic grep."

echo
echo "For each candidate CNI, basic capability hints:"
kubectl get daemonsets -A -o json \
  | jq -r '
    .items[]
    | select(.metadata.name|test("calico|cilium|weave|flannel|antrea|canal|ovn|kube-ovn|kube-router|tigera";"i"))
    | "- CNI: \(.metadata.namespace)/\(.metadata.name)
       Images: \(.spec.template.spec.containers[].image)
       Annotations: \(.metadata.annotations // {} | to_entries[]? | select(.key|test(\"networkpolicy|network-policy|policies\";\"i\")) | .key + \"=\" + .value)"' \
    | sed 's/^[ ]\+//'

echo
echo "=== 3) Detect presence of NetworkPolicy objects in the cluster ==="
kubectl get networkpolicies --all-namespaces || echo "No NetworkPolicies found (no output)."

echo
echo "=== 4) Probe whether basic egress isolation is likely enforced (heuristic) ==="
echo "NOTE: This does NOT prove correctness; it only checks if any default-deny policies exist."
echo "Default-deny ingress NetworkPolicies:"
kubectl get networkpolicies --all-namespaces -o json \
  | jq -r '
    .items[]
    | select(
        (.spec.podSelector | has("matchLabels") or has("matchExpressions"))
        and
        ((.spec.ingress | length == 0) or (.spec.ingress == null))
      )
    | "\(.metadata.namespace)/\(.metadata.name)"' \
  || echo "  None detected."

echo
echo "Default-deny egress NetworkPolicies:"
kubectl get networkpolicies --all-namespaces -o json \
  | jq -r '
    .items[]
    | select(
        (.spec.podSelector | has("matchLabels") or has("matchExpressions"))
        and
        ((.spec.egress | length == 0) or (.spec.egress == null))
        and
        (.spec.policyTypes[]? | ascii_downcase == "egress")
      )
    | "\(.metadata.namespace)/\(.metadata.name)"' \
  || echo "  None detected."

echo
echo "=== 5) Summary of potential issues to review manually ==="
echo "1) If no CNI DaemonSet or plugin could be identified above, manually check:"
echo "   - Which CNI is installed on each node (e.g., /etc/cni/net.d on the node)."
echo "   - Whether that CNI's documentation states explicit support for Kubernetes NetworkPolicy."
echo
echo "2) If the identified CNI is known NOT to support NetworkPolicies (e.g., vanilla Flannel),"
echo "   this is a finding: NetworkPolicies defined in the cluster will NOT be enforced."
echo
echo "3) If NetworkPolicy objects exist but the CNI plugin does not support them, this is a finding."
echo "   Compare the CNIs detected in section (2) against vendor docs."
echo
echo "4) If no NetworkPolicy objects exist at all, this script cannot tell whether the CNI"
echo "   would enforce them; you must still confirm the plugin's capabilities from its docs."
echo
echo "This check is MANUAL: use the above data + the CNI vendor documentation to decide whether"
echo "the CNI in use truly supports Kubernetes NetworkPolicies."