Ensure Use Of Vpc-Native Clusters

#!/usr/bin/env bash
#
# Audit VPC-native (Alias IP) usage for all GKE clusters in one or more projects.
# REQUIREMENTS:
#   - gcloud SDK installed and authenticated
#   - jq installed
#
# USAGE EXAMPLES:
#   Check all projects visible to your account:
#     ./audit_gke_vpc_native.sh
#
#   Check specific projects:
#     ./audit_gke_vpc_native.sh proj-1 proj-2

set -euo pipefail

# Colors for readability (can be removed if undesired)
RED="$(printf '\033[31m')"
GREEN="$(printf '\033[32m')"
YELLOW="$(printf '\033[33m')"
RESET="$(printf '\033[0m')"

# If no project IDs passed, use all currently accessible projects
if [ "$#" -gt 0 ]; then
  PROJECTS=("$@")
else
  echo "No projects specified; discovering all accessible projects via gcloud..."
  mapfile -t PROJECTS < <(gcloud projects list --format='value(projectId)')
fi

if [ "${#PROJECTS[@]}" -eq 0 ]; then
  echo "No projects found. Exiting." >&2
  exit 1
fi

echo "Auditing GKE clusters for VPC-native (Alias IP) usage..."
echo

for PROJECT in "${PROJECTS[@]}"; do
  echo "=== Project: ${PROJECT} ==="

  # List all clusters (zonal and regional)
  mapfile -t CLUSTERS < <(
    gcloud container clusters list \
      --project "${PROJECT}" \
      --format='value(name,location)' 2>/dev/null || true
  )

  if [ "${#CLUSTERS[@]}" -eq 0 ]; then
    echo "  No clusters found."
    echo
    continue
  fi

  printf "  %-30s %-20s %-12s %-10s\n" "CLUSTER" "LOCATION" "VPC_NATIVE" "STATUS"

  for LINE in "${CLUSTERS[@]}"; do
    # LINE format: "<name> <location>"
    CLUSTER_NAME="$(awk '{print $1}' <<< "${LINE}")"
    LOCATION="$(awk '{print $2}' <<< "${LINE}")"

    # Describe cluster and extract useIpAliases flag
    USE_IP_ALIASES="$(
      gcloud container clusters describe "${CLUSTER_NAME}" \
        --location "${LOCATION}" \
        --project "${PROJECT}" \
        --format=json 2>/dev/null | \
      jq -r '.ipAllocationPolicy.useIpAliases // "false"' 2>/dev/null || echo "unknown"
    )"

    if [ "${USE_IP_ALIASES}" = "true" ]; then
      STATUS="${GREEN}OK${RESET}"
      VPC_NATIVE="true"
    elif [ "${USE_IP_ALIASES}" = "false" ]; then
      STATUS="${RED}NOT_VPC_NATIVE${RESET}"
      VPC_NATIVE="false"
    else
      STATUS="${YELLOW}UNKNOWN${RESET}"
      VPC_NATIVE="unknown"
    fi

    printf "  %-30s %-20s %-12s %-10b\n" "${CLUSTER_NAME}" "${LOCATION}" "${VPC_NATIVE}" "${STATUS}"
  done

  echo
done

cat <<'EOF'
INTERPRETATION:
  - VPC_NATIVE = true, STATUS = OK
      Cluster is VPC-native (uses Alias IPs) and aligns with CIS GKE 5.6.2.
  - VPC_NATIVE = false, STATUS = NOT_VPC_NATIVE
      Cluster is NOT VPC-native. This is a finding and requires manual review:
        * Decide whether to recreate/migrate the cluster with --enable-ip-alias.
        * Assess impact on network policies, firewall rules, and IP planning.
  - VPC_NATIVE = unknown, STATUS = UNKNOWN
      Script could not reliably determine the setting (check permissions / API availability).

NOTE:
  Enabling Alias IP cannot be flipped on for an existing non–VPC-native cluster.
  Remediation typically involves creating a new cluster with:
    gcloud container clusters create <cluster_name> --location <location> --enable-ip-alias
  and migrating workloads. This decision must be made manually per cluster.
EOF