TMA-GKE-4.3.1

Enable NetworkPolicy enforcement with GKE Dataplane V2 or Calico

보통레벨 1수동 검토gke

설명

NetworkPolicy enforcement should be enabled for GKE clusters by using a supported enforcement mechanism, either GKE Dataplane V2 or the Calico network policy plugin. Without a supported enforcement mechanism, Kubernetes NetworkPolicy objects cannot reliably restrict pod to pod, pod to service, ingress, or egress traffic. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review the GKE Standard cluster configuration and verify that NetworkPolicy enforcement is available through GKE Dataplane V2 or Calico. NetworkPolicy requires a network plugin to implement enforcement. GKE Dataplane V2 is the recommended option, and Calico is available for Standard clusters. If no managed or self managed plugin is configured, NetworkPolicy objects are not enforced.

조치 방법

조치 방식: 가이드 또는 인프라 패치

For noncompliant GKE Standard clusters, update the cluster build standard so a supported NetworkPolicy enforcement option is selected during cluster creation. Use GKE Dataplane V2 where possible, or Calico based NetworkPolicy enforcement where Dataplane V2 is not used. GKE Dataplane V2 is selected only during cluster creation, and existing clusters cannot be upgraded to use it. • Select GKE Dataplane V2 when creating new or replacement GKE Standard clusters, because NetworkPolicy enforcement is built into Dataplane V2. For existing legacy datapath clusters that cannot be recreated immediately, enable Calico based NetworkPolicy enforcement as an interim remediation path by enabling both the NetworkPolicy add-on and node enforcement.

속성

운영 체제: 모두
태그: gkepoliciesnetwork
참고 자료: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.3.1 Enable NetworkPolicy enforcement with GKE Dataplane V2 or Calico