VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

AKS clusters should be configured with a supported network policy engine (Azure, Calico, or Cilium) so that NetworkPolicy resources can govern pod ingress and egress traffic. Without a network policy engine, pods communicate without restriction by default, weakening namespace segmentation and increasing the blast radius of a compromised workload. NetworkPolicy objects are defined at the namespace level and are not exposed on the cluster resource, so this rule verifies that the cluster has a supported network policy engine enabled as a prerequisite for namespace-level segmentation.

Remediation

Enable a supported network policy engine on the cluster and define explicit NetworkPolicy objects for every workload-hosting namespace. For guidance on enabling and using network policies, see the Secure traffic between pods using network policies in AKS documentation.

References

• Secure traffic between pods using network policies in AKS
• Azure CNI Overlay networking in AKS
• CIS Kubernetes Benchmarks