Ensure Latest CNI Version Is Used

# 1) List all NetworkPolicies in all namespaces
# Run on: any machine with kubectl access
kubectl get networkpolicy --all-namespaces -o wide

# 2) Inspect all NetworkPolicies, including their spec
kubectl get networkpolicy --all-namespaces -o yaml

# 3) Check which CNI plugin is in use and its version (helps judge capabilities)
kubectl get pods -n kube-system -o wide \
  | grep -iE 'calico|cilium|weave|flannel|cni|antrea'

# Example: describe a suspected CNI DaemonSet
kubectl get daemonset -n kube-system
kubectl describe daemonset <cni-daemonset-name> -n kube-system

# 4) For a specific namespace, review effective policy coverage
# Replace NAMESPACE with the namespace you care about
kubectl get networkpolicy -n NAMESPACE -o yaml

# 5) (Optional) For Calico-only clusters, check for any GlobalNetworkPolicies
kubectl get globalnetworkpolicies.crd.projectcalico.org -A -o yaml 2>/dev/null

#!/usr/bin/env bash
#
# Purpose:
#   Cluster-wide review of CNI and NetworkPolicy posture for CIS OKE 4.3.1
#
# Run on:
#   Any machine with kubectl access and current-context pointing at the target cluster.
#
# Requirements:
#   - kubectl in PATH
#   - jq in PATH (optional but recommended; script degrades gracefully without it)

set -euo pipefail

echo "=== 1) Detect CNI implementation and version (cluster-wide) ==="
echo

# Try common CNI DaemonSets and custom-resources to infer CNI and versions.
# This is heuristic only; you must review results manually.

echo "- Searching for common CNI DaemonSets in kube-system..."
kubectl get ds -n kube-system 2>/dev/null | sed '1!{/calico\|cilium\|weave\|flannel\|aws-node\|azure-cni\|antrea\|ovn\|kube-router/!d}'
echo

echo "- Detailed images for likely CNI DaemonSets:"
for ds in calico-node cilium aws-node azure-cni antrea-agent kube-flannel-ds weave-net kube-router ovnkube-node; do
  if kubectl get ds "$ds" -n kube-system >/dev/null 2>&1; then
    echo "  * kube-system/DaemonSet/${ds}:"
    kubectl get ds "$ds" -n kube-system -o jsonpath='{.spec.template.spec.containers[*].image}' 2>/dev/null
    echo
  fi
done
echo

echo "- Checking for common CNI CRDs (if present, also imply CNI type):"
kubectl get crd 2>/dev/null | sed '1!{/calico\|cilium\|antrea\|networkpolicies.crd.projectcalico.org/!d}' || true
echo

cat <<'EOF'

INTERPRETATION (possible problems):
- If no known CNI DaemonSet is found, determine manually which CNI you run and its version.
- Compare the listed CNI images/tags with vendor documentation to see if they are:
  - Out of date or unsupported
  - Missing NetworkPolicy support (some basic CNIs ignore NetworkPolicy).
- A problem for this control is:
  - Using a CNI that does NOT implement Kubernetes NetworkPolicy, or
  - Running obviously obsolete or deprecated CNI versions.
EOF

echo
echo "=== 2) List namespaces lacking any NetworkPolicy (no isolation defined) ==="
echo

# Namespaces with zero NetworkPolicy resources
all_ns=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
ns_with_np=$(kubectl get networkpolicy --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}{"\n"}{end}' | sort -u)
problem_ns=()

for ns in $all_ns; do
  if ! printf '%s\n' "$ns_with_np" | grep -qx "$ns"; then
    problem_ns+=("$ns")
  fi
done

echo "Namespaces with NO NetworkPolicy objects defined:"
if [ ${#problem_ns[@]} -eq 0 ]; then
  echo "  (none)"
else
  for ns in "${problem_ns[@]}"; do
    echo "  - $ns"
  done
fi
echo

cat <<'EOF'
INTERPRETATION (possible problems):
- Namespaces listed above have no NetworkPolicy at all.
- Under CIS guidance, you typically want at least a baseline deny policy
  (or equivalent global policy) so unrestricted traffic is not allowed by default.
EOF

echo
echo "=== 3) Inspect baseline isolation: does each namespace have a 'default deny' policy? ==="
echo

# Heuristic check for default-deny-like policies per namespace.

default_deny_report() {
  local ns="$1"
  echo "Namespace: ${ns}"

  # Get all NPs in namespace as JSON
  if ! np_json=$(kubectl get networkpolicy -n "$ns" -o json 2>/dev/null); then
    echo "  Error: could not fetch NetworkPolicy in namespace."
    return
  fi

  if command -v jq >/dev/null 2>&1; then
    total=$(echo "$np_json" | jq '.items | length')
    echo "  NetworkPolicies: $total"

    # Default deny ingress: spec.podSelector={} and no ingress or empty list
    dd_ingress=$(echo "$np_json" | jq '[.items[]
      | select(.spec.podSelector == {} and (.spec.ingress == null or .spec.ingress == []))
    ] | length')

    # Default deny egress: spec.podSelector={} and no egress or empty list
    dd_egress=$(echo "$np_json" | jq '[.items[]
      | select(.spec.podSelector == {} and (.spec.egress == null or .spec.egress == []))
    ] | length')

    echo "  Default-deny-like ingress policies: $dd_ingress"
    echo "  Default-deny-like egress policies:  $dd_egress"
  else
    echo "  (jq not installed: printing raw policies for manual review)"
    kubectl get networkpolicy -n "$ns" -o yaml
  fi
  echo
}

for ns in $all_ns; do
  # Skip namespaces with no NPs (already flagged above)
  if printf '%s\n' "$ns_with_np" | grep -qx "$ns"; then
    default_deny_report "$ns"
  fi
done

cat <<'EOF'
INTERPRETATION (possible problems):
- For each namespace:
  - If "NetworkPolicies: 0", that namespace has NO isolation.
  - If "Default-deny-like ingress policies: 0", inbound traffic is not globally denied by default.
  - If "Default-deny-like egress policies: 0", outbound traffic is not globally denied by default.
- CIS guidance prefers:
  - A starting point of deny-all for ingress AND egress at namespace level (or via CNI global policy),
    with explicit allow rules layered on as needed.
- Note: Some CNIs (e.g., Calico) can enforce global policies outside NetworkPolicy;
  review your CNI’s own policy objects in addition to this output.
EOF

echo
echo "=== 4) Quick summary of potential issues ==="
echo

echo "1) CNI / NetworkPolicy support:"
echo "   - If no capable CNI is detected above or CNI version is very old, investigate and upgrade."
echo
echo "2) Namespaces with no NetworkPolicy:"
if [ ${#problem_ns[@]} -eq 0 ]; then
  echo "   - All namespaces have at least one NetworkPolicy."
else
  for ns in "${problem_ns[@]}"; do
    echo "   - $ns"
  done
fi
echo
echo "3) Default deny posture:"
echo "   - Review per-namespace section above."
echo "   - A problem exists where default-deny-like policies are missing AND no equivalent CNI-global policy exists."
echo
echo "This script is assessment-only. Apply fixes by:"
echo "- Validating/Upgrading the CNI to a NetworkPolicy-aware and supported version, and"
echo "- Designing and applying explicit deny-all + allow-exception NetworkPolicies (or CNI global policies) per your risk profile."