Ensure That All Namespaces Have Network Policies Defined

ns_without_np=$(kubectl get namespaces -o json | jq -r '.items[].metadata.name' | while read ns; do
  count=$(kubectl get networkpolicy -n "$ns" --no-headers 2>/dev/null | wc -l)
  if [ "$count" -eq 0 ]; then echo "$ns"; fi
done)

echo "$ns_without_np"

cat << 'EOF' > default-netpol-namespace-here.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress-allow-all-egress
  namespace: NAMESPACE_HERE
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - {}
EOF

kubectl apply -f default-netpol-namespace-here.yaml

for ns in $ns_without_np; do
  cat << EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress-allow-all-egress
  namespace: $ns
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - {}
EOF
done

ns_without_np=$(kubectl get namespaces -o json | jq -r '.items[].metadata.name' | while read ns; do
  count=$(kubectl get networkpolicy -n "$ns" --no-headers 2>/dev/null | wc -l)
  if [ "$count" -eq 0 ]; then echo "$ns"; fi
done)
if [ -z "$ns_without_np" ]; then
  echo "ALL_NAMESPACES_HAVE_NETWORK_POLICIES"
else
  echo "NAMESPACES_WITHOUT_NETWORK_POLICIES: $ns_without_np"
fi

#!/usr/bin/env bash
set -euo pipefail

# This script:
# - Finds all namespaces without any NetworkPolicy
# - Creates a default-deny NetworkPolicy in each such namespace
# - Is safe to re-run (it uses kubectl apply)
# - Verifies that all namespaces now have at least one NetworkPolicy
#
# Run on: any machine with kubectl access and jq installed.

# Fail fast if required tools are missing
for cmd in kubectl jq; do
  if ! command -v "$cmd" >/dev/null 2>&1; then
    echo "ERROR: $cmd is required but not installed or not in PATH." >&2
    exit 1
  fi
done

# Optional: restrict to "active" namespaces (ignore those in Terminating phase)
namespaces_json=$(kubectl get namespaces -o json)

# Find namespaces with zero NetworkPolicies
ns_without_np=()
while IFS= read -r ns; do
  # Skip namespaces that are Terminating
  phase=$(echo "$namespaces_json" | jq -r ".items[] | select(.metadata.name==\"$ns\") | .status.phase")
  if [ "$phase" != "Active" ]; then
    continue
  fi

  count=$(kubectl get networkpolicy -n "$ns" --no-headers 2>/dev/null | wc -l | tr -d ' ')
  if [ "$count" -eq 0 ]; then
    ns_without_np+=("$ns")
  fi
done < <(echo "$namespaces_json" | jq -r '.items[].metadata.name')

if [ "${#ns_without_np[@]}" -eq 0 ]; then
  echo "ALL_NAMESPACES_ALREADY_HAVE_NETWORK_POLICIES"
else
  echo "NAMESPACES_MISSING_NETWORK_POLICIES: ${ns_without_np[*]}"
  echo "Creating default-deny NetworkPolicy in each missing namespace..."

  for ns in "${ns_without_np[@]}"; do
    cat <<EOF | kubectl apply -n "$ns" -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
EOF
  done
fi

echo "Verifying that all namespaces have at least one NetworkPolicy..."

verify_ns_without_np=$(kubectl get namespaces -o json | jq -r '.items[].metadata.name' | while read -r ns; do
  # Skip namespaces that are Terminating
  phase=$(kubectl get namespace "$ns" -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
  if [ "$phase" != "Active" ]; then
    continue
  fi
  count=$(kubectl get networkpolicy -n "$ns" --no-headers 2>/dev/null | wc -l | tr -d ' ')
  if [ "$count" -eq 0 ]; then echo "$ns"; fi
done)

if [ -z "$verify_ns_without_np" ]; then
  echo "ALL_NAMESPACES_HAVE_NETWORK_POLICIES"
  exit 0
else
  echo "NAMESPACES_STILL_WITHOUT_NETWORK_POLICIES: $verify_ns_without_np" >&2
  exit 1
fi