Ensure that all Namespaces have Network Policies defined

MediumLevel 2Manual reviewopenshift

Description

Use network policies to isolate traffic in your cluster network. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

The OpenShift 4 CNI plugin uses network policies and by default all Pods in a project are accessible from other Pods and network endpoints. To isolate one or more Pods in a project, you create NetworkPolicy objects in that project to indicate the allowed incoming connections. Project administrators can create and delete NetworkPolicy objects within their own project. For more information see: Run the following command and review the NetworkPolicy objects created in the cluster.

How it is fixed

Fix method: Guidance or infrastructure patch

Follow the documentation and create NetworkPolicy objects as you need them.

Properties

Operating systems: Any
Tags: openshiftpoliciesnetwork
Reference: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.3.2 Ensure that all Namespaces have Network Policies defined