Calico network policies not getting enforced

[m-raman]

I enabled a cluster with calico. Tried applying network policies using both kubectl and calicoctl. The policies are not taking effect.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 13ac2648-7dce-c83c-0b14-79d5b091b1af
• Version Independent ID: 6aa0b306-6926-87cc-9b59-496ac91dfba6
• Content: Secure pods with network policies in Azure Kubernetes Service (AKS)
• Content Source: articles/aks/use-network-policies.md
• Service: container-service
• GitHub Login: @iainfoulds
• Microsoft Alias: iainfou

[jakaruna-MSFT]

Thanks for the feedback! We are currently investigating and will update you shortly.

[jakaruna-MSFT]

@m-raman I hope you have applied the network policy while creating the cluster itself

[m-raman]

@jakaruna-MSFT Yes. See below and the version I have used is 1.13.5.

"location": "australiasoutheast",
"name": "aksrm12",
"networkProfile": {
"dnsServiceIp": "10.0.0.10",
"dockerBridgeCidr": "172.17.0.1/16",
"networkPlugin": "azure",
"networkPolicy": "calico",
"podCidr": null,
"serviceCidr": "10.0.0.0/16"
},

[jakaruna-MSFT]

@m-raman I created a cluster today with calico networking plugin.
Netwroking rules didnt work for me as well.
I will investigate further and let you know.

[jakaruna-MSFT]

Azure/AKS#905 Same issue

[jakaruna-MSFT]

@m-raman Current workaround is to use 1.11.* if we need calico networking plugin.
Though Azure networking plugin works well with all versions.
Also go though this table to find out the difference between calico networking plugin and azure.

[jakaruna-MSFT]

Currently if you create a cluster with calico and with version 1.12.* and above, then the nodes will be in not ready state. It will have an error message saying that networking plugin is not ready.
If thats not the case then the network policy feature registration is not done properly.

[jakaruna-MSFT]

@m-raman I verified both the scenarios (described below) and it works well.

• AKS with verison 1.11.9 + calico networking plugin
• AKS with version 1.12.6 + Azure networking plugin

I will close this issue for now as we dont need to update the doc. We will follow up with the Azure/AKS#905 issue for the updates.

[jakaruna-MSFT]

@m-raman If need further help please mention me in the comment.