Project: KICS (Provisioning / Security & Compliance)
File: 98e04ca0-34f5-4c74-8fec-d2e611ce2790.md

title: Network Policy Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 98e04ca0-34f5-4c74-8fec-d2e611ce2790 Query name: Network Policy Disabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Kubernetes Engine Clusters must have Network Policy enabled, meaning that the attribute 'networkpolicy.enabled' must be true and the attribute 'addonsconfig.networkpolicyconfig.disabled' must be false<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="96 3 73 21 54" name: create a cluster1 google.cloud.gcpcontainercluster: name: my-cluster1 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present addons_config: networkpolicyconfig: disabled: false name: create a cluster2 google.cloud.gcpcontainercluster: name: my-cluster2 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present network_policy: enabled: yes name: create a cluster3 google.cloud.gcpcontainercluster: name: my-cluster3 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present network_policy: enabled: yes addons_config: horizontalpodautoscaling: disabled: yes name: create a cluster4 google.cloud.gcpcontainercluster: name: my-cluster4 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present network_policy: enabled: no addons_config: networkpolicyconfig: disabled: no name: create a cluster5 google.cloud.gcpcontainercluster: name: my-cluster5 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present network_policy: enabled: yes addons_config: networkpolicyconfig: disabled: yes ``` ```yaml title="Negative test num. 1 - yaml file" name: create a cluster google.cloud.gcpcontainercluster: name: my-cluster initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present network_policy: enabled: yes addons_config: networkpolicyconfig: disabled: no ```