Use NetworkPolicy with built in GKE Dataplane V2 enforcement

OrtaDüzey 2Manuel incelemegke-autopilot

Açıklama

NetworkPolicy enforcement is built in for GKE Autopilot clusters through GKE Dataplane V2. Kubernetes NetworkPolicy objects can restrict Pod to Pod, Pod to Service, ingress, and egress traffic without enabling Calico or a separate NetworkPolicy add-on. The benchmark marks this recommendation Manual.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Review the GKE Autopilot cluster configuration and verify that the cluster uses GKE Dataplane V2 for built in NetworkPolicy enforcement. NetworkPolicy requires a network plugin to implement enforcement. In Autopilot clusters, GKE Dataplane V2 is enabled by default and Kubernetes NetworkPolicy is always on.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For GKE Autopilot clusters, no remediation is required to enable NetworkPolicy enforcement because GKE Dataplane V2 is enabled by default and Kubernetes NetworkPolicy enforcement is built in. Remediation should focus on creating and maintaining NetworkPolicy resources that define the intended ingress and egress traffic rules for workloads. • Apply NetworkPolicy resources in the required namespaces to define explicit allowed traffic paths for approved workload communication. • Use default deny policies where appropriate, followed by explicit allow policies for required ingress and egress traffic. • Validate application connectivity after applying NetworkPolicy resources.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: gke-autopilotpoliciesnetwork
Referans: CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v2.0.0 - 4.3.1 Use NetworkPolicy with built in GKE Dataplane V2 enforcement