Enable NetworkPolicy enforcement with GKE Dataplane V2 or Calico

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Review the GKE Standard cluster configuration and verify that NetworkPolicy enforcement is available through GKE Dataplane V2 or Calico. NetworkPolicy requires a network plugin to implement enforcement. GKE Dataplane V2 is the recommended option, and Calico is available for Standard clusters. If no managed or self managed plugin is configured, NetworkPolicy objects are not enforced.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

For noncompliant GKE Standard clusters, update the cluster build standard so a supported NetworkPolicy enforcement option is selected during cluster creation. Use GKE Dataplane V2 where possible, or Calico based NetworkPolicy enforcement where Dataplane V2 is not used. GKE Dataplane V2 is selected only during cluster creation, and existing clusters cannot be upgraded to use it. • Select GKE Dataplane V2 when creating new or replacement GKE Standard clusters, because NetworkPolicy enforcement is built into Dataplane V2. For existing legacy datapath clusters that cannot be recreated immediately, enable Calico based NetworkPolicy enforcement as an interim remediation path by enabling both the NetworkPolicy add-on and node enforcement.