Detections
Analytics

4.3.1 Enable NetworkPolicy enforcement with GKE Dataplane V2 or Calico

Information

NetworkPolicy enforcement should be enabled for GKE clusters by using a supported enforcement mechanism, either GKE Dataplane V2 or the Calico network policy plugin. Without a supported enforcement mechanism, Kubernetes NetworkPolicy objects cannot reliably restrict pod to pod, pod to service, ingress, or egress traffic.

NetworkPolicies define pod level traffic rules, but enforcement depends on the networking implementation used by the cluster. In GKE, the GKE Dataplane V2 is the recommended network plugin and uses Cilium and eBPF for routing, load balancing, and NetworkPolicy enforcement. Calico is also available for Standard clusters and enforces NetworkPolicy through the cluster network plugin.

By default, pods in a cluster can communicate freely. Enabling NetworkPolicy enforcement allows teams to implement defense in depth, namespace based segmentation, tenant isolation, and explicit ingress and egress controls for approved workload communication paths.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

For noncompliant GKE Standard clusters, update the cluster build standard so a supported NetworkPolicy enforcement option is selected during cluster creation. Use GKE Dataplane V2 where possible, or Calico based NetworkPolicy enforcement where Dataplane V2 is not used. GKE Dataplane V2 is selected only during cluster creation, and existing clusters cannot be upgraded to use it.

 - Select GKE Dataplane V2 when creating new or replacement GKE Standard clusters, because NetworkPolicy enforcement is built into Dataplane V2.

For existing legacy datapath clusters that cannot be recreated immediately, enable Calico based NetworkPolicy enforcement as an interim remediation path by enabling both the NetworkPolicy add-on and node enforcement. Enabling only the add-on does not enforce policies, and enabling node enforcement recreates node pools, so plan the change during an approved maintenance window.

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --update-addons=NetworkPolicy=ENABLED

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-network-policy

After remediation, validate that the cluster either reports ADVANCED_DATAPATH or reports networkPolicy.enabled=True, networkPolicy.provider=CALICO, and addonsConfig.networkPolicyConfig.disabled=False.

Impact:

Enabling NetworkPolicy enforcement can change workload connectivity because traffic not explicitly allowed by policy might be denied. For clusters that do not use GKE Dataplane V2, enabling NetworkPolicy enforcement can recreate node pools and may disrupt manually deployed pods. For clusters using GKE Dataplane V2, NetworkPolicy enforcement is built in and should not be separately enabled or disabled.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv7|18.4

Plugin: GCP

Control ID: b52759d215bfbc2e5616c0951202518874775375f079fbbdfff7a006b41a29ef