Use NetworkPolicy with built in GKE Dataplane V2 enforcement

보통레벨 2수동 검토gke-autopilot

설명

NetworkPolicy enforcement is built in for GKE Autopilot clusters through GKE Dataplane V2. Kubernetes NetworkPolicy objects can restrict Pod to Pod, Pod to Service, ingress, and egress traffic without enabling Calico or a separate NetworkPolicy add-on. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review the GKE Autopilot cluster configuration and verify that the cluster uses GKE Dataplane V2 for built in NetworkPolicy enforcement. NetworkPolicy requires a network plugin to implement enforcement. In Autopilot clusters, GKE Dataplane V2 is enabled by default and Kubernetes NetworkPolicy is always on.

조치 방법

조치 방식: 가이드 또는 인프라 패치

For GKE Autopilot clusters, no remediation is required to enable NetworkPolicy enforcement because GKE Dataplane V2 is enabled by default and Kubernetes NetworkPolicy enforcement is built in. Remediation should focus on creating and maintaining NetworkPolicy resources that define the intended ingress and egress traffic rules for workloads. • Apply NetworkPolicy resources in the required namespaces to define explicit allowed traffic paths for approved workload communication. • Use default deny policies where appropriate, followed by explicit allow policies for required ingress and egress traffic. • Validate application connectivity after applying NetworkPolicy resources.

속성

운영 체제: 모두
태그: gke-autopilotpoliciesnetwork
참고 자료: CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v2.0.0 - 4.3.1 Use NetworkPolicy with built in GKE Dataplane V2 enforcement