Ensure that the CNI in use supports Network Policies
An XCCDF Rule
Description
There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster. OpenShift supports Kubernetes NetworkPolicy using a Kubernetes Container Network Interface (CNI) plug-in.
warning alert: Warning
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the following:
-
/apis/operator.openshift.io/v1/networks/clusterAPI endpoint, filter with with thejqutility using the following filter[.spec.defaultNetwork.type]and persist it to the local
Rationale
Kubernetes network policies are enforced by the CNI plugin in use. As such it is important to ensure that the CNI plugin supports both Ingress and Egress network policies.
- ID
- xccdf_org.ssgproject.content_rule_configure_network_policies
- Severity
- High
- References
- Updated