documentation_complete: true


title: 'Ensure that project templates autocreate Network Policies'

description: |-
    Configure a template for newly created projects to use default network
    policies.
    For more information, follow
    {{{ weblink(link="https://docs.openshift.com/container-platform/latest/networking/network_policy/default-network-policy.html",
    text="the relevant documentation") }}}.

rationale: |-
    Running different applications on the same Kubernetes cluster creates a risk of one
    compromised application attacking a neighboring application. Network segmentation is
    important to ensure that containers can communicate only with those they are supposed
    to. When a network policy is introduced to a given namespace, all traffic not allowed
    by the policy is denied. Editing the default project template to include
    NetworkPolicies in all new namespaces ensures that all namespaces include at
    least some NetworkPolicy objects.

severity: medium

{{% set api_path = '/apis/template.openshift.io/v1/namespaces/openshift-config/templates' %}}
{{% set jqfilter = '[.items[] | any(.objects[]?; .kind == "NetworkPolicy") ]' %}}

ocil_clause: 'The project template does not include NetworkPolicies'

ocil: |-
    Verify that a Template exists in the <tt>openshift-config</tt> namespace
    that includes at least one NetworkPolicy Kind in the list of .objects:
    <pre>oc get -nopenshift-config template -ojson |  jq -r '{{{ jqfilter }}}'</pre>
    If there is at least one matching template, the above query would
    return true.

references:
    srg: SRG-APP-000039-CTR-000110

identifiers:
      cce@ocp4: CCE-86275-5

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({api_path: jqfilter}) | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: |-
      {{{ openshift_filtered_path(api_path, jqfilter) }}}
    yamlpath: "[:]"
    check_existence: "all_exist"
    entity_check: "all"
    values:
      - value: "true"
        operation: "pattern match"
