---
title: Ensure that all Namespaces have Network Policies defined
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Ensure that all Namespaces have Network
  Policies defined
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Ensure that all Namespaces have Network Policies defined
 
## Description{% #description %}

AKS clusters should be configured with a supported network policy engine (Azure, Calico, or Cilium) so that NetworkPolicy resources can govern pod ingress and egress traffic. Without a network policy engine, pods communicate without restriction by default, weakening namespace segmentation and increasing the blast radius of a compromised workload. NetworkPolicy objects are defined at the namespace level and are not exposed on the cluster resource, so this rule verifies that the cluster has a supported network policy engine enabled as a prerequisite for namespace-level segmentation.

## Remediation{% #remediation %}

Enable a supported network policy engine on the cluster and define explicit NetworkPolicy objects for every workload-hosting namespace. For guidance on enabling and using network policies, see the [Secure traffic between pods using network policies in AKS](https://learn.microsoft.com/en-us/azure/aks/use-network-policies) documentation.

## References{% #references %}

- [Secure traffic between pods using network policies in AKS](https://learn.microsoft.com/en-us/azure/aks/use-network-policies)
- [Azure CNI Overlay networking in AKS](https://learn.microsoft.com/en-us/azure/aks/azure-cni-overlay)
- [CIS Kubernetes Benchmarks](https://www.cisecurity.org/benchmark/kubernetes)