Enable NetworkPolicy enforcement with GKE Dataplane V2 or Calico

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Review the GKE Standard cluster configuration and verify that NetworkPolicy enforcement is available through GKE Dataplane V2 or Calico. NetworkPolicy requires a network plugin to implement enforcement. GKE Dataplane V2 is the recommended option, and Calico is available for Standard clusters. If no managed or self managed plugin is configured, NetworkPolicy objects are not enforced.

修補方式

修補方法: 操作指南或基礎設施修補檔

For noncompliant GKE Standard clusters, update the cluster build standard so a supported NetworkPolicy enforcement option is selected during cluster creation. Use GKE Dataplane V2 where possible, or Calico based NetworkPolicy enforcement where Dataplane V2 is not used. GKE Dataplane V2 is selected only during cluster creation, and existing clusters cannot be upgraded to use it. • Select GKE Dataplane V2 when creating new or replacement GKE Standard clusters, because NetworkPolicy enforcement is built into Dataplane V2. For existing legacy datapath clusters that cannot be recreated immediately, enable Calico based NetworkPolicy enforcement as an interim remediation path by enabling both the NetworkPolicy add-on and node enforcement.