turbot/alicloud_compliance

Query: cs_kubernetes_cluster_network_policy_enabled

Usage

powerpipe query alicloud_compliance.query.cs_kubernetes_cluster_network_policy_enabled

SQL

with network_policy_enabled as (
select
cluster_id
from
alicloud_cs_kubernetes_cluster,
jsonb_array_elements(meta_data -> 'Addons') as a
where
a ->> 'name' = 'terway-eniip'
and regexp_replace(a ->> 'config', '\\"', '"', 'g') :: jsonb @> '{"NetworkPolicy":"true"}'
)
select
arn as resource,
case
when a.meta_data -> 'Addons' @> '[{"name": "flannel"}]' then 'skip'
when n.cluster_id is null then 'alarm'
else 'ok'
end as status,
case
when a.meta_data -> 'Addons' @> '[{"name": "flannel"}]' then a.title || ' does not support network policy.'
when n.cluster_id is null then a.title || ' network policy disabled.'
else a.title || ' network policy enabled.'
end as reason,
a.account_id as account_id,
a.region as region
from
alicloud_cs_kubernetes_cluster a
left join network_policy_enabled n on a.cluster_id = n.cluster_id;

Controls

The query is being used by the following controls: