> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure That All Namespaces Have Network Policies Defined

### More Info:

Without NetworkPolicies, pods accept traffic from any source by default. Every namespace should define at least one NetworkPolicy to control pod-level traffic.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS AKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. Identify namespaces missing NetworkPolicies (run on any machine with kubectl access):
           ```sh theme={null}
           ns_without_np=$(comm -23 \
             <(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | sort) \
             <(kubectl get networkpolicy --all-namespaces -o jsonpath='{.items[*].metadata.namespace}' | tr ' ' '\n' | sort))

           printf '%s\n' "$ns_without_np"
           ```

        2. For each namespace that needs a strict default, create a default-deny-all policy (run on any machine with kubectl access; replace NAMESPACE with one from the list above):
           ```sh theme={null}
           kubectl apply -n NAMESPACE -f - <<'EOF'
           apiVersion: networking.k8s.io/v1
           kind: NetworkPolicy
           metadata:
             name: default-deny-all
           spec:
             podSelector: {}
             policyTypes:
               - Ingress
               - Egress
           EOF
           ```

        3. For namespaces where you cannot fully deny all traffic, create an initial restrictive policy and adjust later (example allowing only intra-namespace traffic; run on any machine with kubectl access and replace NAMESPACE):
           ```sh theme={null}
           kubectl apply -n NAMESPACE -f - <<'EOF'
           apiVersion: networking.k8s.io/v1
           kind: NetworkPolicy
           metadata:
             name: restrict-to-namespace
           spec:
             podSelector: {}
             policyTypes:
               - Ingress
           ingress:
             - from:
               - podSelector: {}
           EOF
           ```

        4. Review and customize policies in critical namespaces (e.g., kube-system, monitoring, ingress) to avoid breaking traffic (run on any machine with kubectl access):
           ```sh theme={null}
           # List policies in a namespace
           kubectl get networkpolicy -n NAMESPACE

           # Show details of a policy
           kubectl describe networkpolicy -n NAMESPACE POLICY_NAME

           # Edit a policy in-place
           kubectl edit networkpolicy -n NAMESPACE POLICY_NAME
           ```

        5. Optionally export policies to manifests for version control (run on any machine with kubectl access):
           ```sh theme={null}
           kubectl get networkpolicy -A -o yaml > all-networkpolicies-backup.yaml
           ```

        6. Verification (run on any machine with kubectl access):
           ```sh theme={null}
           ns_without_np=$(comm -23 \
             <(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | sort) \
             <(kubectl get networkpolicy --all-namespaces -o jsonpath='{.items[*].metadata.namespace}' | tr ' ' '\n' | sort))

           if [ -z "$ns_without_np" ]; then
             echo "ALL_NAMESPACES_HAVE_NETWORKPOLICIES"
           else
             echo "MISSING_NETWORKPOLICIES"
             printf '%s\n' "$ns_without_np"
           fi
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        On any machine with kubectl access to the cluster:

        1. List namespaces currently missing NetworkPolicies (for your awareness):

        ```bash theme={null}
        ns_without_np=$(comm -23 \
          <(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | sort) \
          <(kubectl get networkpolicy --all-namespaces -o jsonpath='{.items[*].metadata.namespace}' | tr ' ' '\n' | sort))

        printf '%s\n' "$ns_without_np"
        ```

        2. Create a default-deny NetworkPolicy in each namespace that lacks one (replace the namespace list as needed, or paste from the previous command’s output):

        ```bash theme={null}
        for ns in kube-system default; do
          kubectl apply -n "$ns" -f - <<EOF
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: default-deny-all
        spec:
          podSelector: {}
          policyTypes:
            - Ingress
            - Egress
        EOF
        done
        ```

        Adjust the `for ns in ...` list to include every namespace that should receive a default-deny policy, based on your environment and application needs.

        3. Verification (same command used by the audit):

        ```bash theme={null}
        ns_without_np=$(comm -23 \
          <(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | sort) \
          <(kubectl get networkpolicy --all-namespaces -o jsonpath='{.items[*].metadata.namespace}' | tr ' ' '\n' | sort))
        if [ -z "$ns_without_np" ]; then echo "ALL_NAMESPACES_HAVE_NETWORKPOLICIES"; else echo "MISSING_NETWORKPOLICIES: $ns_without_np"; fi
        ```
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Applies a default-deny NetworkPolicy to every namespace that has none.
        # Run on: any machine with kubectl access and current context set to target cluster.

        set -euo pipefail

        echo "[INFO] Discovering namespaces without any NetworkPolicy..."
        ns_without_np=$(comm -23 \
          <(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | sort) \
          <(kubectl get networkpolicy --all-namespaces -o jsonpath='{.items[*].metadata.namespace}' | tr ' ' '\n' | sort) \
          || true)

        if [ -z "${ns_without_np}" ]; then
          echo "[INFO] All namespaces already have at least one NetworkPolicy."
        else
          echo "[INFO] Namespaces missing NetworkPolicies:"
          echo "${ns_without_np}" | sed 's/^/  - /'

          # Apply a default-deny-all NetworkPolicy in each namespace that lacks any policy.
          # This is idempotent: apply will create or update the same object safely.
          while read -r ns; do
            [ -z "${ns}" ] && continue
            echo "[INFO] Applying default-deny-all NetworkPolicy in namespace: ${ns}"

            kubectl apply -n "${ns}" -f - <<'EOF'
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: default-deny-all
        spec:
          podSelector: {}
          policyTypes:
            - Ingress
            - Egress
        EOF

          done <<< "${ns_without_np}"
        fi

        echo "[INFO] Verifying that all namespaces now have at least one NetworkPolicy..."
        verify_ns_without_np=$(comm -23 \
          <(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | sort) \
          <(kubectl get networkpolicy --all-namespaces -o jsonpath='{.items[*].metadata.namespace}' | tr ' ' '\n' | sort) \
          || true)

        if [ -z "${verify_ns_without_np}" ]; then
          echo "ALL_NAMESPACES_HAVE_NETWORKPOLICIES"
          exit 0
        else
          echo "MISSING_NETWORKPOLICIES"
          echo "[WARN] The following namespaces still lack NetworkPolicies (investigate manually):"
          echo "${verify_ns_without_np}" | sed 's/^/  - /'
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>