GKE clusters should have network policy enabled
Checkov CKV_GCP_12 looks for network policy configuration on `google_container_cluster` resources. Trivy GCP-0056 states that enabling a network policy allows the segregation of network traffic by namespace within the cluster.
Enabling a network policy allows the segregation of network traffic by namespace.
What this control checks
GKE clusters must have network policy enabled or use ADVANCED_DATAPATH
Common pitfalls
Disabled policy passes with ADVANCED_DATAPATH
A cluster with the network policy disabled still passes this check when it uses ADVANCED_DATAPATH.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_network_policy_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_12; Trivy check GCP-0056.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_kubernetes_cluster_network_policy_enabled - Checkov Check:
CKV_GCP_12 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_network_policy_enabled - Trivy Check:
GCP-0056
Last reviewed: 2026-10-09