Ensure Network Policy Is Enabled And Set As Appropriate

#!/usr/bin/env bash
# Purpose:
#   Report Kubernetes NetworkPolicy usage and CNI/network policy engines
#   so you can review whether network segmentation is in place.
#
# Run on:
#   Any machine with kubectl context to the target cluster.

set -euo pipefail

echo "=== Cluster-wide NetworkPolicy Inventory ==="
echo

# 1) List all namespaces and whether they have any NetworkPolicy objects
echo "Per-namespace NetworkPolicy counts:"
echo "namespace,networkpolicies"
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{";"}{.metadata.name}{"\n"}{end}' \
  | while IFS=';' read -r ns _; do
      count="$(kubectl get networkpolicy -n "${ns}" --no-headers 2>/dev/null | wc -l || true)"
      # If there are no NetworkPolicy resources, wc -l prints 0 but also prints a header if present.
      # Strip spaces.
      count="$(echo "${count}" | tr -d ' ')"
      echo "${ns},${count}"
    done \
  | sort

echo
echo "=== Explanation ==="
echo "Namespaces with '0' NetworkPolicy objects allow all pod-to-pod traffic by default."
echo "These namespaces should be reviewed: consider adding default-deny policies and explicit allow rules."

# 2) Show detail for namespaces with zero NetworkPolicies
echo
echo "Namespaces with NO NetworkPolicies (potentially wide-open):"
no_np_namespaces=$(kubectl get ns -o json | jq -r '
  .items[].metadata.name as $ns
  | ($ns + " " + (
      (try (.[0].metadata.name) catch "") // ""
    ))
  ' 2>/dev/null || true)

# Simpler: re-use output from above
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' \
  | while read -r ns; do
      count="$(kubectl get networkpolicy -n "${ns}" --no-headers 2>/dev/null | wc -l || true)"
      count="$(echo "${count}" | tr -d ' ')"
      if [ "${count}" = "0" ]; then
        echo " - ${ns}"
      fi
    done

echo
echo "For each listed namespace, verify whether unrestricted traffic is acceptable."
echo "If not, design and apply NetworkPolicies implementing least-privilege communication."

# 3) Check for Cilium (example network policy–capable CNI)
echo
echo "=== CNI / Network Policy Engine Indicators ==="
echo "Checking for common network policy–capable CNIs (Calico, Cilium, etc.)"
echo

echo "- Pods in kube-system that may indicate CNI:"
kubectl get pods -n kube-system -o wide | grep -Ei 'calico|cilium|weave|antrea|ovn|azure-cni|aws-node|amazon-vpc-cni' || \
  echo "  (No obvious CNI pods matched common names; inspect your cloud provider docs/console.)"

echo
echo "- Node CNI annotations (if present):"
kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"  cni: "}{.metadata.annotations.k8s\.ovn\.org/node-preferred-cidr}{"\n"}{end}' 2>/dev/null || \
  echo "  (No specific CNI-related node annotations found via this pattern.)"

echo
echo "=== How to interpret this report ==="
echo "1) If no network policy–capable CNI (e.g., Calico, Cilium, Antrea) is visible here, verify via:"
echo "   - Your cloud provider console/CLI/IaC which CNI is configured for this cluster."
echo "   - Ensure the chosen CNI supports Kubernetes NetworkPolicy and is actually enabled."
echo
echo "2) If many namespaces show '0' NetworkPolicies, network segmentation is likely weak or absent."
echo "   That is a potential problem relative to the benchmark."
echo
echo "3) This script does NOT change configuration."
echo "   Use it periodically to track whether namespaces are covered by NetworkPolicies and"
echo "   to confirm the presence of a network policy–capable CNI (e.g., Calico)."