Answers: <p>If anyone else has the same issue, please double-check your AKS configuration in Azure and make sure that the Network policy filed in the Networking settings does NOT display None. It should say either Azure or Calico.</p>
  <p>My cluster was created with terraform and even though I had added network_plugin     = &quot;azure&quot;, I had missed the network_policy = &quot;azure&quot; field which meant that Network Policies would not be applied.</p>
  <p>Also, this setting can only be enabled when creating a new cluster. You cannot enabled it on an existing one.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-01-17T22:31:32.853Z
Answers: Thanks a lot! Finally found the reason why my policies won't work on an existing (production) cluster I'm dealing with.
Answers: rflume
Answers: CC BY-SA 4.0
Answers: 2022-05-20T14:20:56.643Z
Answers: 2022-05-20T14:20:56.643Z
Answers: Lubomir Krustev
Body: <p>I am trying to implement Network Policies in my test Azure Kubernetes cluster, but I cannot get them to work. I have two namespaces - default and nginx (and others as well, but they shouldn't be affecting the NP).</p>
  <p>I have an nginx deployment in each ns that displays a webpage with some text on '/'. (I have modified the pages slightly so I can recognize which one I'm hitting).
  I also have a ClusterIP service for each deployment. I deployed a Deny All Network Policy in the nginx namespace that targets all pods inside. However, when I open a shell inside the nginx pod in the default namespace and I do a curl <a href="http://servicename.namespace.svc:serviceport" rel="nofollow noreferrer">http://servicename.namespace.svc:serviceport</a> (which resolves to the service inside the nginx namespace) I can access the pod despite the Network Policy rule.</p>
  <p>Here are my manifests:</p>
  <ul>
  <li>nginx in the nginx namespace:</li>
  </ul>
  <pre><code>    apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: svet-nginx-deployment
        namespace: nginx
      spec:
        selector:
          matchLabels:
            app: nginx
        replicas: 1
        template:
          metadata:
            labels:
              app: nginx
          spec:
            containers:
            - name: nginx
              image: &lt;azurecr&gt;/samples/nginx
              ports:
              - containerPort: 80
              volumeMounts:
              - name: config-volume
                mountPath: /usr/share/nginx/html
            volumes:
            - name: config-volume
              configMap:
                name: svet-config
  </code></pre>
  <ul>
  <li>ClusterIP service in the nginx namespace:</li>
  </ul>
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: ingress2
    namespace: nginx
  spec:
    selector:
      app: nginx
    ports:
      - protocol: TCP
        port: 80
        targetPort: 80
  </code></pre>
  <ul>
  <li>Network Policy in the nginx namespace</li>
  </ul>
  <p>I got this one from github, but I also tested with Default deny all ingress traffic from the official kubernetes <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic" rel="nofollow noreferrer">documentation</a></p>
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: default-deny-ingress
    namespace: nginx
  spec:
    podSelector: {}
    policyTypes:
    - Ingress
    ingress: []
  </code></pre>
  <ul>
  <li>nginx in the default namespace:</li>
  </ul>
  <pre><code>apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: svet-nginx-deployment
    namespace: default
  spec:
    selector:
      matchLabels:
        app: nginx
    replicas: 1
    template:
      metadata:
        labels:
          app: nginx
      spec:
        containers:
        - name: nginx
          image: &lt;azurecr&gt;.azurecr.io/samples/nginx
          ports:
          - containerPort: 80
          volumeMounts:
          - name: config-volume
            mountPath: /usr/share/nginx/html
        volumes:
        - name: config-volume
          configMap:
            name: svet-config
  
  </code></pre>
  <ul>
  <li>ClusterIP service in the default namespace:</li>
  </ul>
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: ingress1
    namespace: default
  spec:
    selector:
      app: nginx
    ports:
      - protocol: TCP
        port: 80
        targetPort: 80
  </code></pre>
  <p><em>Please ignore the bad naming - this is only a training environment</em></p>
  <p>I have tried many different iterations of the Network Policy starting with more complex and moving to the simplest denyall policy that I have pasted, but nothing seems to be working. I have enabled Azure CNI as required.</p>
  <p>Am I missing something?</p>
  
Tags: <kubernetes><azure><azure-kubernetes-service>
Title: AKS Network Policy - cannot deny traffic to namespace
UserDisplayName: Lubomir Krustev
ThreadText: # AKS Network Policy - cannot deny traffic to namespace
  
  (Asked by: username_0 on 2022-05-19)
  
  I am trying to implement Network Policies in my test Azure Kubernetes cluster, but I cannot get them to work. I have two namespaces - default and nginx (and others as well, but they shouldn't be affecting the NP).
  
  I have an nginx deployment in each ns that displays a webpage with some text on '/'. (I have modified the pages slightly so I can recognize which one I'm hitting).
  I also have a ClusterIP service for each deployment. I deployed a Deny All Network Policy in the nginx namespace that targets all pods inside. However, when I open a shell inside the nginx pod in the default namespace and I do a curl <http://servicename.namespace.svc:serviceport> (which resolves to the service inside the nginx namespace) I can access the pod despite the Network Policy rule.
  
  Here are my manifests:
  
  * nginx in the nginx namespace:
  
  ```
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: svet-nginx-deployment
        namespace: nginx
      spec:
        selector:
          matchLabels:
            app: nginx
        replicas: 1
        template:
          metadata:
            labels:
              app: nginx
          spec:
            containers:
            - name: nginx
              image: <azurecr>/samples/nginx
              ports:
              - containerPort: 80
              volumeMounts:
              - name: config-volume
                mountPath: /usr/share/nginx/html
            volumes:
            - name: config-volume
              configMap:
                name: svet-config
  
  ```
  
  * ClusterIP service in the nginx namespace:
  
  ```
  apiVersion: v1
  kind: Service
  metadata:
    name: ingress2
    namespace: nginx
  spec:
    selector:
      app: nginx
    ports:
      - protocol: TCP
        port: 80
        targetPort: 80
  
  ```
  
  * Network Policy in the nginx namespace
  
  I got this one from github, but I also tested with Default deny all ingress traffic from the official kubernetes [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic)
  
  ```
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: default-deny-ingress
    namespace: nginx
  spec:
    podSelector: {}
    policyTypes:
    - Ingress
    ingress: []
  
  ```
  
  * nginx in the default namespace:
  
  ```
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: svet-nginx-deployment
    namespace: default
  spec:
    selector:
      matchLabels:
        app: nginx
    replicas: 1
    template:
      metadata:
        labels:
          app: nginx
      spec:
        containers:
        - name: nginx
          image: <azurecr>.azurecr.io/samples/nginx
          ports:
          - containerPort: 80
          volumeMounts:
          - name: config-volume
            mountPath: /usr/share/nginx/html
        volumes:
        - name: config-volume
          configMap:
            name: svet-config
  
  ```
  
  * ClusterIP service in the default namespace:
  
  ```
  apiVersion: v1
  kind: Service
  metadata:
    name: ingress1
    namespace: default
  spec:
    selector:
      app: nginx
    ports:
      - protocol: TCP
        port: 80
        targetPort: 80
  
  ```
  
  *Please ignore the bad naming - this is only a training environment*
  
  I have tried many different iterations of the Network Policy starting with more complex and moving to the simplest denyall policy that I have pasted, but nothing seems to be working. I have enabled Azure CNI as required.
  
  Am I missing something?
  
  **Tags:** kubernetes, azure, azure-kubernetes-service
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2022-05-20. Score: 1
  
  If anyone else has the same issue, please double-check your AKS configuration in Azure and make sure that the Network policy filed in the Networking settings does NOT display None. It should say either Azure or Calico.
  
  My cluster was created with terraform and even though I had added network\_plugin = "azure", I had missed the network\_policy = "azure" field which meant that Network Policies would not be applied.
  
  Also, this setting can only be enabled when creating a new cluster. You cannot enabled it on an existing one.
  
  > **Comments:**
  > **username_1**: Thanks a lot! Finally found the reason why my policies won't work on an existing (production) cluster I'm dealing with.  
  
  ---
  
  