Use NetworkPolicy with built in GKE Dataplane V2 enforcement

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review the GKE Autopilot cluster configuration and verify that the cluster uses GKE Dataplane V2 for built in NetworkPolicy enforcement. NetworkPolicy requires a network plugin to implement enforcement. In Autopilot clusters, GKE Dataplane V2 is enabled by default and Kubernetes NetworkPolicy is always on.

How it is fixed

Fix method: Guidance or infrastructure patch

For GKE Autopilot clusters, no remediation is required to enable NetworkPolicy enforcement because GKE Dataplane V2 is enabled by default and Kubernetes NetworkPolicy enforcement is built in. Remediation should focus on creating and maintaining NetworkPolicy resources that define the intended ingress and egress traffic rules for workloads. • Apply NetworkPolicy resources in the required namespaces to define explicit allowed traffic paths for approved workload communication. • Use default deny policies where appropriate, followed by explicit allow policies for required ingress and egress traffic. • Validate application connectivity after applying NetworkPolicy resources.