AKS clusters with no network policy plugin enforcing pod traffic rules

Flat pod networks and blast radius

Without a network policy plugin, the pod network in an AKS cluster is flat: any pod can open a connection to any other pod, in any namespace. Compromise one internet-facing workload and the attacker’s next hop is a free choice: the internal payments service, the in-cluster database, the kube-system components. NetworkPolicy resources are the Kubernetes mechanism for stopping that lateral movement, but they are inert text unless a plugin enforces them. Applying policies to a cluster with no enforcement engine changes nothing, silently.

The plugin values that count

The discoverer reads networkProfile.networkPolicy off the cluster through Azure Resource Graph (a Reader-role read) and emits network_policy_enabled as metadata. Azure reports one of four states (azure, calico, cilium, or none), and only the none case becomes an explicit "false". Rule RC-1350 fires solely on that value; when the network profile was not surfaced, it abstains. Any of the three real plugins satisfies the rule. It does not rank them, and it never guesses from a tag (the old network_policy tag read was a dead contract).

Why the fix means a new cluster

Network policy enforcement is set at cluster creation and cannot be bolted onto an existing AKS cluster; remediation is recreation plus workload migration, which is what earns the high severity. Building the replacement, Microsoft’s current recommendation is Azure CNI powered by Cilium (--network-dataplane cilium), with --network-policy azure as the classic option; Calico remains selectable but is in maintenance mode for new AKS clusters. Plan the rebuild alongside other create-time-only settings (private API server, for instance) so one migration closes several findings.

Reading the network profile with az

az aks list \
  --query "[].{name:name, rg:resourceGroup, policy: networkProfile.networkPolicy}" \
  -o table

Clusters showing none (or an empty policy column) are running the flat network described above. After migration, define actual NetworkPolicy resources: default-deny per namespace, then explicit allows. The plugin only enforces what you write.