Ensure Network Policy Is Enabled And Set As Appropriate

More Info:

Enable and configure Network Policy for the cluster to control pod-to-pod traffic and enforce network segmentation.

Risk Level

High

Address

Security

Compliance Standards

• CIS OKE

Triage and Remediation

Remediation

Remediation

Manual Steps

1. Identify whether the cluster supports NetworkPolicy

   • On any machine with access to your cloud provider/IaC:
     • For OKE (OCI CLI):

       oci ce cluster get --cluster-id <OCID> --query "data.options.\"kubernetes-network-config\""

       Confirm the CNI/plugin in use supports Kubernetes NetworkPolicy (e.g., Calico, Cilium, appropriate OCI CNI mode).

2. List existing NetworkPolicy resources and check coverage

   • On any machine with kubectl access:

     kubectl get networkpolicy --all-namespaces -o wide

   • Review whether:
     • Namespaces containing sensitive workloads (e.g., prod, payments, customer-data) have at least one NetworkPolicy.
     • There is a strategy (e.g., default deny + explicit allows) rather than a few ad‑hoc policies.

3. Check for default-deny behavior per namespace

   • On any machine with kubectl access:

     for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
       echo "=== $ns ==="
       kubectl get networkpolicy -n "$ns" \
         -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.podSelector}{"\t"}{.spec.policyTypes}{"\n"}{end}' || echo "no policies"
       echo
     done

   • For important namespaces, confirm there is at least one policy that:
     • Uses an empty podSelector: {} with policyTypes including Ingress and/or Egress to enforce default deny,
     • Or otherwise clearly restricts traffic according to your segmentation requirements.

4. Review cloud/IaC configuration for CNI and policy enablement

   • In cloud console or IaC (Terraform, OCI Resource Manager templates, etc.), inspect cluster configuration:
     • Confirm the selected network plugin/CNI is the one intended and supports NetworkPolicy.
     • Confirm any “Network Policy” / “Network Security” options exposed by the provider are enabled where required (document the setting and where it is defined in your IaC).
   • If IaC is used, locate the cluster resource and inspect:
     • CNI type and any flags that enable/disable network policies.

5. Decide and define the target segmentation model

   • Outside of the cluster, document:
     • Which namespaces are “default deny” by design.
     • Which system/infra namespaces (e.g., kube-system, logging, monitoring) need carefully scoped exceptions.
     • Any required cross-namespace and external dependencies (databases, APIs, ingress controllers).
   • Based on this, determine where NetworkPolicy must be tightened (namespaces with no policies or policies that are too permissive).

6. Implement and validate policy changes

   • Using your cloud provider console/CLI/IaC:
     • If NetworkPolicy is not enabled at the cluster/CNI level, update the cluster configuration to an option that supports it (this may require cluster recreation or node pool changes per provider documentation).
   • Using manifests applied through your normal deployment process (IaC/CI/CD), add or update NetworkPolicy objects to enforce the decided model (e.g., default deny + explicit allow).
   • Validate behavior on any machine with kubectl access:

     kubectl get networkpolicy --all-namespaces -o wide

     Optionally, run connectivity tests between pods in different namespaces to confirm policies are enforced as intended.

Using kubectl

kubectl cannot be used to enable or configure the cluster‑level Network Policy provider; this must be done in the cloud provider’s managed control plane configuration (console, CLI, or IaC). Refer to the Manual Steps section for guidance on what to review and how to remediate this finding at the provider/IaC level.

Automation

#!/usr/bin/env bash
#
# Report Kubernetes NetworkPolicy usage and CNI support across all namespaces.
# Run from any machine with kubectl access and cluster-admin RBAC.
#
# Usage:
#   ./report-network-policy.sh > network-policy-report.txt

set -euo pipefail

echo "=== Cluster Network Policy Assessment ==="
echo "Timestamp: $(date -Iseconds)"
echo

#############################################
# 1. Identify CNI plugin (best-effort only) #
#############################################

echo "== CNI / Network plugin detection (best-effort) =="

# Try well-known CNI indicators in kube-system
kubectl get pods -n kube-system -o wide 2>/dev/null | \
  awk 'NR==1 || /calico|cilium|weave|flannel|antrea|ovn|kube-router|azure-cni|aws-node|amazon-k8s-cni|gke-net|azure-npm|azure-networkpolicymanager/'

echo
echo "# Notes:"
echo "# - Presence of a CNI that SUPPORTS NetworkPolicy (e.g. calico, cilium, antrea, weave-net,"
echo "#   ovn-kubernetes, kube-router, Azure NPM, GKE Network Policy, AWS VPC CNI with policy addon)"
echo "#   is required for policies to be enforced."
echo "# - If you only see basic CNI pods (e.g. aws-node without policy addon, azure-cni without NPM),"
echo "#   NetworkPolicy objects may exist but will not be enforced."
echo

###################################################
# 2. Summary of NetworkPolicy objects by namespace #
###################################################

echo "== NetworkPolicy presence by namespace =="

# Header
printf "%-30s %-10s %-10s %-10s\n" "NAMESPACE" "NP_COUNT" "HAS_PODS" "HAS_SVCS"
echo "----------------------------------------------------------------------"

# Build summary using a single API query per resource type
# Namespaces
namespaces=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')

# Pods map: namespace -> 1/0
declare -A ns_has_pods
while read -r ns; do
  [[ -z "$ns" ]] && continue
  count=$(kubectl get pods -n "$ns" --no-headers 2>/dev/null | wc -l | tr -d ' ')
  if [[ "$count" -gt 0 ]]; then
    ns_has_pods["$ns"]=1
  else
    ns_has_pods["$ns"]=0
  fi
done < <(printf "%s\n" "$namespaces")

# Services map: namespace -> 1/0
declare -A ns_has_svcs
while read -r ns; do
  [[ -z "$ns" ]] && continue
  count=$(kubectl get svc -n "$ns" --no-headers 2>/dev/null | wc -l | tr -d ' ')
  if [[ "$count" -gt 0 ]]; then
    ns_has_svcs["$ns"]=1
  else
    ns_has_svcs["$ns"]=0
  fi
done < <(printf "%s\n" "$namespaces")

# NetworkPolicies count
declare -A ns_np_count
while read -r line; do
  [[ -z "$line" ]] && continue
  ns=$(cut -d' ' -f1 <<<"$line")
  cnt=$(cut -d' ' -f2 <<<"$line")
  ns_np_count["$ns"]="$cnt"
done < <(kubectl get networkpolicy --all-namespaces --no-headers 2>/dev/null | awk '{count[$1]++} END{for (n in count) print n, count[n]}')

# Print summary
for ns in $namespaces; do
  np_count="${ns_np_count[$ns]:-0}"
  has_pods="${ns_has_pods[$ns]:-0}"
  has_svcs="${ns_has_svcs[$ns]:-0}"
  printf "%-30s %-10s %-10s %-10s\n" "$ns" "$np_count" "$has_pods" "$has_svcs"
done

cat <<'EOF'

# How to interpret:
# - Focus on namespaces where:
#     HAS_PODS=1 (there is workload) AND NP_COUNT=0
#   These namespaces have no NetworkPolicy and therefore allow all pod-to-pod
#   traffic by default (subject to CNI behavior). This is usually a problem.
#
# - Namespaces with HAS_PODS=0 and NP_COUNT=0 are typically not a concern.
#
# - System namespaces (kube-system, kube-public, kube-node-lease, etc.) may have
#   different risk tolerance; review them explicitly.

EOF

########################################################
# 3. Detailed view of NetworkPolicies (for review)     #
########################################################

echo "== Detailed NetworkPolicy listing =="

kubectl get networkpolicy --all-namespaces -o wide 2>/dev/null || \
  echo "No NetworkPolicy objects found in the cluster."

cat <<'EOF'

# How to interpret:
# - Confirm that critical namespaces (containing business apps or sensitive data)
#   have at least one NetworkPolicy.
# - Review each policy for:
#     * Selectors: which pods are actually covered (podSelector/namespaceSelector).
#     * PolicyTypes: Ingress, Egress, or both.
#     * Default deny/allow posture (e.g., a policy with empty ingress/egress can
#       serve as a default deny for selected pods).
#
# WARNING INDICATORS (potential problems):
# - Cluster has NO NetworkPolicy objects at all.
# - Business-critical namespaces with HAS_PODS=1 and NP_COUNT=0.
# - CNI plugin does NOT support NetworkPolicy, but policies are defined
#   (they will not be enforced).
#
# This script does NOT change any configuration; it only reports the current
# state so you can make informed, manual decisions and then enforce via your
# cloud provider's network policy options and/or CNI configuration.
EOF