# AKS Cluster Network Policy Not Enabled

> AKS clusters running without a network policy plugin let every pod reach every other pod. Rule RC-1350 reads network_policy_enabled, which the discoverer derives from networkProfile.networkPolicy (azure, calico, cilium, or none), and fires high severity only on an explicit "false". Fixing it requires recreating the cluster, since the plugin cannot be added later.

Source: https://zop.dev/integrations/azure/recommendations/aks-cluster-network-policy-not-enabled
Updated: 2026-08-19

---

## Flat pod networks and blast radius

Without a network policy plugin, the pod network in an AKS cluster is flat: any pod can open
a connection to any other pod, in any namespace. Compromise one internet-facing workload and
the attacker's next hop is a free choice: the internal payments service, the in-cluster
database, the kube-system components. NetworkPolicy resources are the Kubernetes mechanism
for stopping that lateral movement, but they are inert text unless a plugin enforces them.
Applying policies to a cluster with no enforcement engine changes nothing, silently.

## The plugin values that count

The discoverer reads `networkProfile.networkPolicy` off the cluster through Azure Resource
Graph (a Reader-role read) and emits `network_policy_enabled` as metadata. Azure reports one
of four states (`azure`, `calico`, `cilium`, or `none`), and only the none case becomes an
explicit `"false"`. Rule RC-1350 fires solely on that value; when the network profile was not
surfaced, it abstains. Any of the three real plugins satisfies the rule. It does not rank
them, and it never guesses from a tag (the old `network_policy` tag read was a dead
contract).

## Why the fix means a new cluster

Network policy enforcement is set at cluster creation and cannot be bolted onto an existing
AKS cluster; remediation is recreation plus workload migration, which is what earns the
high severity. Building the replacement, Microsoft's current recommendation is Azure CNI
powered by Cilium (`--network-dataplane cilium`), with `--network-policy azure` as the
classic option; Calico remains selectable but is in maintenance mode for new AKS clusters.
Plan the rebuild alongside other create-time-only settings (private API server, for
instance) so one migration closes several findings.

## Reading the network profile with az

```bash
az aks list \
  --query "[].{name:name, rg:resourceGroup, policy: networkProfile.networkPolicy}" \
  -o table
```

Clusters showing `none` (or an empty policy column) are running the flat network described
above. After migration, define actual NetworkPolicy resources: default-deny per namespace,
then explicit allows. The plugin only enforces what you write.