id: k8s-netpol-namespace

info:
  name: Network Policies specify namespace
  author: princechaddha
  severity: medium
  description: Checks for Kubernetes Network Policies that do not specify a namespace, which can lead to potential misconfigurations and security issues.
  impact: |
    Omitting the namespace in Network Policies can cause the policies to apply incorrectly, potentially exposing Kubernetes resources to unauthorized access. This poses a security risk by not isolating network traffic properly within the cluster.
  remediation: |
    Ensure that all Network Policies explicitly define a namespace to maintain proper network isolation and security boundaries.
  reference:
    - https://kubernetes.io/docs/concepts/services-networking/network-policies/
  tags: cloud,devops,kubernetes,security,devsecops,networking

flow: |
  code(1);
  for (let policy of template.items) {
    set("policy", policy)
    javascript(1);
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: kubectl get netpol --all-namespaces --output=json
    extractors:
      - type: json
        name: items
        internal: true
        json:
          - '.items[] | {policy: .metadata.name, namespace: .metadata.namespace}'

javascript:
  - code: |
        let policyData = JSON.parse(template.policy);
        if (!policyData.namespace) {
          let result = (`Network Policy '${policyData.policy}' does not specify a namespace.`);
          Export(result);
        }

    extractors:
      - type: dsl
        dsl:
          - response
# digest: 490a00463044022005edb8b78c4db40572f8297946636ce446d578c62f1ec7bf7f1621ed021f27c9022078555811953b55f080c0dc21ec6138fbd712b5069ca571e2492c5e7cc3172759:366f2a24c8eb519f6968bd8801c08ebe