Ensure CNI Supports Network Policies

# 1) Identify the current cluster network plugin
# Run on: any machine with kubectl access
kubectl -n kube-system get pods -o wide \
  -l k8s-app=calico-node,app=calico,app=flannel,k8s-app=flannel, \
     k8s-app=weave-net,app=weave-net,k8s-app=cilium,app=cilium, \
     app=canal,k8s-app=canal,app=kube-router,k8s-app=kube-router

# If nothing obvious is returned, list all Pods in kube-system for manual inspection:
kubectl -n kube-system get pods -o wide

# 2) Check if any NetworkPolicy objects exist in the cluster
# Run on: any machine with kubectl access
kubectl get networkpolicies --all-namespaces

# 3) Test basic NetworkPolicy behavior in a non-critical namespace
#    (this does NOT enforce policy cluster‑wide; it is a safe, temporary check)
# Run on: any machine with kubectl access

# 3.1 Create an isolated test namespace
kubectl create namespace netpol-test

# 3.2 Create two test pods: one "backend" (with a label) and one "client"
kubectl -n netpol-test apply -f - << 'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: backend
  labels:
    app: backend
spec:
  containers:
  - name: backend
    image: docker.io/library/nginx:stable
    ports:
    - containerPort: 80
---
apiVersion: v1
kind: Pod
metadata:
  name: client
spec:
  containers:
  - name: client
    image: docker.io/library/busybox:1.36
    command: ["sh", "-c", "sleep 3600"]
EOF

# Wait for pods to be Ready
kubectl -n netpol-test wait --for=condition=Ready pod/backend --timeout=120s
kubectl -n netpol-test wait --for=condition=Ready pod/client --timeout=120s

# Get backend Pod IP
BACKEND_IP=$(kubectl -n netpol-test get pod backend -o jsonpath='{.status.podIP}')
echo "$BACKEND_IP"

# 3.3 Confirm client can reach backend BEFORE any NetworkPolicy
kubectl -n netpol-test exec client -- wget -qO- "http://$BACKEND_IP" || echo "connect failed"

# 3.4 Apply a DENY-ALL ingress NetworkPolicy to backend
kubectl -n netpol-test apply -f - << 'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-backend-ingress
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress: []
EOF

# 3.5 Test again AFTER applying NetworkPolicy
kubectl -n netpol-test exec client -- wget -qO- "http://$BACKEND_IP" || echo "connect failed"

# 4) Cleanup test resources after review
# Run on: any machine with kubectl access
kubectl delete namespace netpol-test

#!/usr/bin/env bash
# Purpose: Report whether the current CNI appears to support Kubernetes NetworkPolicies

set -euo pipefail

echo "=== 1) Detect CNI plugin(s) in use (from node annotations) ==="
kubectl get nodes -o custom-columns=NAME:.metadata.name,CNI:.metadata.annotations['k8s\.ovn\.org/node-chassis-id','vpc\.amazonaws\.com/eni-id','cni\.projectcalico\.org/IPv4IPIPTunnelAddr','weave\.works/agent','flannel\.alpha\.coreos\.com/backend-type'] --no-headers || true

echo
echo "=== 2) List CNI-related DaemonSets in kube-system (common CNIs) ==="
kubectl get ds -n kube-system \
  -o custom-columns=NAME:.metadata.name,IMAGES:.spec.template.spec.containers[*].image \
  --no-headers | grep -Ei 'calico|cilium|weave|flannel|canal|cni|ovn|antrea|multus' || \
  echo "No common CNI DaemonSets detected in kube-system."

echo
echo "=== 3) List CNI directories on each node (from Node status) ==="
kubectl get nodes -o custom-columns=NAME:.metadata.name,CNI_DIRS:.status.nodeInfo.containerRuntimeVersion --no-headers

echo
echo "=== 4) Try creating a test NetworkPolicy (non-disruptive) ==="
TEST_NS="cni-networkpolicy-check"
TEST_NP="np-cni-support-check"

# Create an isolated namespace for the test policy
kubectl get ns "${TEST_NS}" >/dev/null 2>&1 || kubectl create ns "${TEST_NS}" >/dev/null

# Apply a minimal NetworkPolicy that selects no pods (no traffic impact)
cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np-cni-support-check
  namespace: cni-networkpolicy-check
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
EOF

echo
echo "NetworkPolicy object created. Current status:"
kubectl get networkpolicy -n "${TEST_NS}" "${TEST_NP}" -o yaml | sed -n '1,40p'

echo
echo "=== 5) Summary guidance ==="
cat <<'EOM'
Review results:

1) CNI plugin identification:
   - From step (1) and (2), identify which CNI you are running (e.g. calico, cilium, antrea, weave, flannel, canal, ovn-kubernetes, etc.).
   - Cross-check that plugin's documentation to confirm it supports Kubernetes NetworkPolicies.

2) NetworkPolicy object behavior:
   - If the NetworkPolicy resource in step (4) was ACCEPTED by the API server (it appears in kubectl get output),
     that only confirms the API supports NetworkPolicies, NOT that the CNI enforces them.
   - You must still verify in a follow-up manual test that traffic is actually restricted when NetworkPolicies are applied.

Indicators of a potential problem:
   - Step (2) does not show a known NetworkPolicy-capable CNI (e.g. only "flannel" with no policy controller).
   - You are using a custom or cloud-vendor CNI whose docs do not explicitly state NetworkPolicy support.
   - NetworkPolicy objects exist but connectivity tests show they are not enforced.

This script cannot determine with certainty that your CNI enforces NetworkPolicies; it only surfaces
the likely CNI implementation and confirms that NetworkPolicy objects can be created for manual review.
EOM