<p>I am trying to setup NetworkPolicy to control access to pods running in acs cluster. The cluster is created using acs-engine and networkPolicy=azure. </p>

<p>The contents of the json file used to create the cluster:</p>

<pre><code>{
  "apiVersion": "vlabs",
  "properties": {
    "orchestratorProfile": {
      "orchestratorType": "Kubernetes",
      "kubernetesConfig": {
        "networkPolicy": "azure"
      },
      "orchestratorRelease": "1.9"
    },
    ...
}
</code></pre>

<p>The network policy that I am applying is to deny all ingress traffic to pods in my namespace:</p>

<pre><code> apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: default-deny
 spec:
   podSelector: {}
   policyTypes:
   - Ingress
</code></pre>

<p>The required restrictions are not effected with this NetworkPolicy.</p>

<p>If this even possible with "networkPolicy": "azure"?</p>

<p>Can someone point to right direction to achieve this?</p>

<p>After exploring I found that Azure CNI policy does not support Kubernetes network policies. The solution is to use CNI that supports it eg Calico.</p>

<p><a href="https://learn.microsoft.com/en-us/azure/virtual-network/container-networking" rel="nofollow noreferrer">Container networking capabilities of Azure CNI</a></p>
