feat(query): implements "Beta - Cluster Without Network Policy Support"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there is no query to ensure that a "google_container_cluster" resource allows support for a network policy.

• Quoting CIS_Google_Kubernetes_Engine_(GKE)_Benchmark_v1.9.0 page 64: "There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster.

Proposed Changes

• Implemented the missing query.

• The remediation suggested in the Benchmark helps bridge the gap between CNI plugins and their compatibility with network policies and what we must actually check in the terraform IaC samples : "To use a CNI plugin with Network Policy, enable Network Policy in GKE, and the CNI plugin will be updated."

• To ensure a given "google_container_cluster" resource supports use of a "network policy" it must be setup with the "network_policy.enabled" field set to true. The documentation seems to imply changing the "network_policy.provider" field can be done without the need to recreate the cluster whilst the "enabled" field would require said re creation.

• With this the query will flag the target "google_container_cluster" if it:

  • Does not set a "network_policy" block
  • Sets a "network_policy" block where "enabled" is set to a value that is not true (since "enabled" is a required field the scenario of it missing was not included in the tests)

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.17

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0