GKE clusters should have a Network Policy installed
Kubernetes Engine Clusters must have Network Policy enabled. All `google_container_cluster` resources should enable network policy support. Network policies can provide better security by limiting connections between pods.
Network policies can provide better security by limiting connections between pods thus reducing compromise radius. Enabling a network policy allows the segregation of network traffic by namespace.
What this control checks
GKE clusters must have network_policy enabled (enabled = true)
Common pitfalls
Both network policy attributes must be set correctly
Enabling network policy requires that the attribute network_policy.enabled must be true and the attribute addons_config.network_policy_config.disabled must be false.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.gke_restrict_pod_traffic.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_12; KICS queries "Network Policy Disabled" (11e7550e-c4b6-472e-adff-c698f157cdd7) and "Beta - Cluster Without Network Policy Support Enabled" (99976ba0-aa37-4745-93a6-5f1d55997f67); Trivy check GCP-0056.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gke_restrict_pod_traffic - Checkov Check:
CKV_GCP_12 - Powerpipe Control:
gcp_compliance.control.gke_restrict_pod_traffic - KICS Queries:
11e7550e-c4b6-472e-adff-c698f157cdd7,99976ba0-aa37-4745-93a6-5f1d55997f67 - Trivy Check:
GCP-0056
Last reviewed: 2026-10-09