Skip to main content

OCI OKE Clusters Should Have Network Policy Support Enabled

More Info:​

Clusters should be created with a network plugin that enforces NetworkPolicy. Without it, pod-to-pod traffic is unrestricted by default and a compromised pod can pivot freely across the cluster.

Risk Level​

High

Address​

Compliance, Security

Compliance Standards​

  • CIS OKE

Triage and Remediation​

Remediation​

Using Console

In OCI OKE, Kubernetes Network Policy enforcement must be enabled at cluster creation time; it cannot be switched on for an existing cluster.
So remediation in the Console means:

  1. Plan to replace the existing cluster

    • Export current manifests: 
      kubectl get all,configmap,secret,ingress,job,cronjob -A -o yaml > backup.yaml
    • Take note of:
      • Node shapes, OCPUs, memory
      • VCN/subnets
      • Load balancers, DNS, ingress
      • Storage classes, PVCs, persistent volumes
    • Plan downtime or a blue/green migration if needed.

  2. Create a new OKE cluster with Network Policy enabled (Console)

    1. In the OCI Console, go to:
      Menu → Developer Services → Kubernetes Clusters (OKE)
    2. Choose the compartment.
    3. Click Create cluster.
    4. Choose Quick Create or Custom Create (Custom gives more control).
    5. In the Networking or Cluster configuration section:
      • Ensure Network type is VCN-native (required for network policies).
      • Find the option Network policy or Kubernetes Network Policy and set it to Enabled.
    6. Select:
      • Kubernetes version (use a supported, current version).
      • VCN and subnets (reuse existing or create new).
      • Worker node shape, OCPUs, and node count.
    7. Complete the wizard and click Create.
    8. Wait until the cluster status is Active and worker nodes are Ready.

  3. Point kubectl to the new cluster

    1. In the OKE cluster details page, click Access Cluster.
    2. Follow the instructions to:
      • Install/ensure kubectl and oci CLI are set up.
      • Run the provided oci ce cluster create-kubeconfig … command to get kubeconfig for the new cluster.
    3. Verify: 
      kubectl get nodes

  4. Recreate workloads on the new cluster

    • Adjust the exported manifests if needed (storage classes, load balancer annotations, namespaces).
    • Apply them to the new cluster: 
      kubectl apply -f backup.yaml
    • Recreate any external integrations (e.g., OCI Load Balancers, DNS records, external secrets) if they are not managed via manifests.

  5. Define and test NetworkPolicies

    • Create minimal NetworkPolicies first (e.g., allow-all within namespace) to avoid breaking traffic, then tighten: 
      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-namespace
        namespace: my-namespace
      spec:
        podSelector: {}
        policyTypes:
        - Ingress
        - Egress
        ingress:
        - {}
        egress:
        - {}
    • Apply and test app connectivity: 
      kubectl apply -f networkpolicy.yaml

  6. Cut over and decommission old cluster

    • Update DNS / ingress / external endpoints to point to the new cluster’s load balancers.
    • Validate workloads and traffic flows.
    • When satisfied, in the Console:
      1. Go to Kubernetes Clusters (OKE).
      2. Select the old cluster.
      3. Drain & cordon nodes if you want a clean shutdown: 
        kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data
      4. Click Delete to remove the old cluster and node pools.

This results in OKE clusters with Network Policy support enabled, satisfying the requirement.

Using CLI

Below are the concrete OCI CLI steps to enable Network Policy on an OKE cluster.

1. Prerequisites​

  • OCI CLI installed and configured (oci setup config)
  • You have permission to manage the target OKE cluster
  • You know the OCID of the cluster you want to update

2. Verify current Network Policy setting​

CLUSTER_OCID="<your_cluster_ocid>"

oci ce cluster get \
  --cluster-id "$CLUSTER_OCID" \
  --query 'data."options"."kubernetes-network-config"."is-network-policy-enabled"' \
  --raw-output

If this returns false or null, Network Policy is not enabled.

3. Get the full existing options payload​

You must preserve the existing cluster options and only flip the network policy flag.

oci ce cluster get \
  --cluster-id "$CLUSTER_OCID" \
  --query 'data.options' > options.json

Open options.json and locate/ensure this structure exists:

{
  "kubernetes-network-config": {
    "is-network-policy-enabled": true
  }
}
  • If "kubernetes-network-config" exists, just set "is-network-policy-enabled": true.
  • If it doesn’t exist, add it under options:
{
  "admission-controller-options": { ... },     // keep existing values
  "persistent-volume-config": { ... },        // keep existing values
  ...
  "kubernetes-network-config": {
    "is-network-policy-enabled": true
  }
}

Do not remove any existing keys in options.json.

4. Update the cluster to enable Network Policy​

oci ce cluster update \
  --cluster-id "$CLUSTER_OCID" \
  --options file://options.json \
  --force \
  --wait-for-state SUCCEEDED

This will enable network policy support (Calico) on the cluster.

5. Confirm Network Policy is enabled​

oci ce cluster get \
  --cluster-id "$CLUSTER_OCID" \
  --query 'data."options"."kubernetes-network-config"."is-network-policy-enabled"' \
  --raw-output

You should now see:

true

6. (Kubernetes side) Start using NetworkPolicies​

Once enabled on the cluster, apply Kubernetes NetworkPolicy resources as usual:

kubectl apply -f my-network-policy.yaml

This completes the remediation using OCI CLI.

Using Python

In OKE, Kubernetes Network Policy can only be enabled at cluster creation time. You cannot turn it on for an existing cluster; you must create a new OKE cluster with network policy support enabled, then migrate workloads.

Below are the steps and an example using the OCI Python SDK.

1. Prerequisites​

  • OCI Python SDK installed:
pip install oci
  • A configured OCI profile in ~/.oci/config (or use instance principal / resource principal).
  • Existing:
    • Compartment OCID
    • VCN OCID
    • Subnet OCIDs for worker nodes and pods (for VCN-native pod networking)
    • KMS key etc. if you use encryption (optional)

2. Enable Network Policy on a New OKE Cluster (Python)​

Network policy is enabled by:

  • Using VCN-native pod networking
  • Setting the network policy flag in the cluster’s network configuration

The structure may evolve with SDK versions, so adapt the exact class/field names based on your installed SDK (refer to oci.container_engine.models).

import oci
from oci.container_engine import ContainerEngineClient
from oci.container_engine.models import (
    CreateClusterDetails,
    ClusterCreateOptions,
    KubernetesNetworkConfig,
    VcnIpNativePodNetworkOption
)

# Configuration & client
config = oci.config.from_file("~/.oci/config", "DEFAULT")  # or use oci.config.from_file() defaults
ce_client = ContainerEngineClient(config)

# Required IDs
compartment_id = "<COMPARTMENT_OCID>"
vcn_id = "<VCN_OCID>"
# Subnets – adapt to your design
endpoint_subnet_id = "<CONTROL_PLANE_SUBNET_OCID>"
node_subnet_id = "<NODE_SUBNET_OCID>"
pod_subnet_id = "<POD_SUBNET_OCID>"  # for VCN-native pod networking

# 1. Define Kubernetes network config with network policy enabled
k8s_network_config = KubernetesNetworkConfig(
    # Example CIDRs; adapt as needed
    pods_cidr="10.244.0.0/16",
    services_cidr="10.96.0.0/16"
)

# 2. VCN-native pod networking and network policy
pod_network_option = VcnIpNativePodNetworkOption(
    # This tells OKE to use VCN-native pod networking
    cni_type="VCN_IP_NATIVE",
    pod_subnet_ids=[pod_subnet_id],
    # Enable network policies – field name can vary by SDK version;
    # check your SDK docs / dir(oci.container_engine.models.VcnIpNativePodNetworkOption)
    is_network_policy_enabled=True
)

create_options = ClusterCreateOptions(
    service_lb_subnet_ids=[node_subnet_id],
    kubernetes_network_config=k8s_network_config,
    # Plug in pod networking options
    pod_network_option_details=pod_network_option
)

# 3. Create the cluster
create_cluster_details = CreateClusterDetails(
    name="oke-with-network-policy",
    compartment_id=compartment_id,
    vcn_id=vcn_id,
    kubernetes_version="v1.28.2",  # use a supported version
    endpoint_config={
        "subnet_id": endpoint_subnet_id,
        "is_public_ip_enabled": False
    },
    options=create_options
)

response = ce_client.create_cluster(create_cluster_details)
work_request_id = response.headers["opc-work-request-id"]
print("Cluster creation work request:", work_request_id)

Important notes:

  • Field names like is_network_policy_enabled, cni_type, pod_network_option_details can differ slightly depending on SDK release.
    • Run in Python REPL: 
      import oci, inspect
      from oci.container_engine.models import VcnIpNativePodNetworkOption
      print(inspect.getsource(VcnIpNativePodNetworkOption))
      and confirm the exact property names for:
      • CNI type / pod networking
      • Network policy flag
  • If your SDK has a different model name for pod networking (e.g., ClusterPodNetworkOptionDetails or similar), use that instead and set its is_network_policy_enabled or equivalent.

3. Verify Network Policy Support in the New Cluster​

After the cluster is active and node pools are created:

# Configure kubeconfig for the new cluster
oci ce cluster create-kubeconfig \
  --cluster-id <NEW_CLUSTER_OCID> \
  --file $HOME/.kube/config-new \
  --region <REGION> --token-version 2.0.0

KUBECONFIG=$HOME/.kube/config-new kubectl get nodes

Then create a simple NetworkPolicy and validate it is enforced:

KUBECONFIG=$HOME/.kube/config-new kubectl apply -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
EOF

If the policy works (pods lose connectivity as expected), network policy is enabled.

4. Migrate Workloads​

  • Deploy your workloads to the new cluster.
  • Migrate services, ingresses, secrets, and PVCs as needed.
  • Decommission the old cluster once migration is complete.

If you share the output of inspect.getsource for VcnIpNativePodNetworkOption / ClusterCreateOptions from your environment, I can give you an exact, version-accurate Python snippet.

Using Terraform
resource "oci_containerengine_cluster" "OKE_CLUSTER" {
  # Substitute these with your actual values
  name           = "OKE_CLUSTER_NAME"
  compartment_id = "COMPARTMENT_OCID"
  vcn_id         = "VCN_OCID"
  kubernetes_version = "K8S_VERSION"

  # This must use a CNI that supports NetworkPolicy, i.e. OCI_VCN_NATIVE
  # Changing cni_type on an existing cluster forces replacement of the cluster.
  cluster_pod_network_options {
    cni_type = "OCI_VCN_NATIVE"
  }

  # ...keep your existing endpoint_config, options, etc. here...
}

Enabling network policy enforcement on OKE is done by creating the cluster with a CNI that supports it (OCI_VCN_NATIVE); Terraform cannot switch an existing cluster’s CNI in place, so this change will destroy and recreate the oci_containerengine_cluster resource (cluster outage and node/pod replacement).

After updating the Terraform, terraform plan should show the oci_containerengine_cluster resource being replaced with the cluster_pod_network_options[0].cni_type changing from its current value (for example "FLANNEL_OVERLAY") to "OCI_VCN_NATIVE".