documentation_complete: true


title: 'Ensure that application Namespaces have Network Policies defined.'

description: |-
    Use network policies to isolate traffic in your cluster network.

rationale: |-
    Running different applications on the same Kubernetes cluster creates a risk of one
    compromised application attacking a neighboring application. Network segmentation is
    important to ensure that containers can communicate only with those they are supposed
    to. When a network policy is introduced to a given namespace, all traffic not allowed
    by the policy is denied. However, if there are no network policies in a namespace all
    traffic will be allowed into and out of the pods in that namespace.

severity: high

references:
    cis@eks: 4.3.2
    cis@ocp4: 5.3.2
    nerc-cip: CIP-003-8 R4,CIP-003-8 R4.2,CIP-003-8 R5,CIP-003-8 R6,CIP-004-6 R2.2.4,CIP-004-6 R3,CIP-007-3 R2,CIP-007-3 R2.1,CIP-007-3 R2.2,CIP-007-3 R2.3,CIP-007-3 R5.1,CIP-007-3 R6.1
    nist: AC-4,AC-4(21),CA-3(5),CM-6,CM-6(1),CM-7,CM-7(1),SC-7,SC-7(3),SC-7(5),SC-7(8),SC-7(12),SC-7(13),SC-7(18),SC-7(10),SI-4(22)
    pcidss: Req-1.1.4,Req-1.2,Req-1.2.1,Req-1.3.1,Req-1.3.2,Req-2.2
    srg: SRG-APP-000038-CTR-000105

{{% set networkpolicies_api_path = '/apis/networking.k8s.io/v1/networkpolicies' %}}
{{% set namespaces_api_path = '/api/v1/namespaces' %}}
{{% set networkpolicies_for_non_ctlplane_namespaces_filter = '[.items[] | select((.metadata.namespace | startswith("openshift") | not) and (.metadata.namespace | startswith("kube-") | not) and .metadata.namespace != "default" and ({{if ne .var_network_policies_namespaces_exempt_regex "None"}}.metadata.namespace | test("{{.var_network_policies_namespaces_exempt_regex}}") | not{{else}}true{{end}})) | .metadata.namespace] | unique' %}}
{{% set non_ctlplane_namespaces_filter = '[.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default" and ({{if ne .var_network_policies_namespaces_exempt_regex "None"}}.metadata.name | test("{{.var_network_policies_namespaces_exempt_regex}}") | not{{else}}true{{end}}))]' %}}
platform: not ocp4-on-hypershift

ocil_clause: 'Namespaced Network Policies needs review'

# same as above except filters the names only. Used in OCIL only, not in the 'warnings attribute'
{{% set non_ctlplane_namespaces_filter_names = '[.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default" and ({{if ne .var_network_policies_namespaces_exempt_regex "None"}}.metadata.name | test("{{.var_network_policies_namespaces_exempt_regex}}") | not{{else}}true{{end}})) | .metadata.name ]' %}}

ocil: |-
    Verify that the every non-control plane namespace has an appropriate
    NetworkPolicy.

    To get all the non-control plane namespaces, you can do the
    following command <tt>{{{ ocil_oc_pipe_jq_filter('namespaces', non_ctlplane_namespaces_filter_names) }}}</tt>

    To get all the non-control plane namespaces with a NetworkPolicy, you can do the
    following command <tt>{{{ ocil_oc_pipe_jq_filter('networkpolicies', networkpolicies_for_non_ctlplane_namespaces_filter, all_namespaces=true) }}}</tt>

    Namespaces matching the variable <tt>ocp4-var-network-policies-namespaces-exempt-regex</tt> regex are excluded from this check.

    Make sure that the namespaces displayed in the commands of the commands match.

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({
            networkpolicies_api_path: networkpolicies_for_non_ctlplane_namespaces_filter,
            namespaces_api_path: non_ctlplane_namespaces_filter,
        }) | indent(4) }}}
