Setting the file. One moment.
Skill 05 · AKS Troubleshooting
Subchapter 5.14
network-policy.mdMarkdown1 KBView on GitHub
Use this guide when pod-to-pod or pod-to-service traffic is selectively blocked and the symptom points at ingress or egress filtering.
# List all policies in the namespace - check both ingress and egress
kubectl get networkpolicy -n <ns> -o yaml
# Check for a default-deny policy (blocks everything unless explicitly allowed)
kubectl get networkpolicy -n <ns> -o jsonpath='{range .items[?(@.spec.podSelector=={})]}{.metadata.name}{"\n"}{end}'AKS network policy engine check: Azure NPM (Azure CNI): kubectl get pods -n kube-system -l k8s-app=azure-npm. Calico: kubectl get pods -n calico-system.
Policy audit: source labels, destination labels, destination ingress rules, and source egress rules must all line up. With default-deny, explicitly allow UDP/TCP 53 to kube-dns.
Keep selector, ingress, egress, and engine evidence as the primary diagnostic path. If those rules and direct connectivity evidence remain ambiguous, hand off to aks-network-capture only when packet-level proof is requested or explicitly approved. The capture skill owns capture scope, runtime, least-privilege controls, and commands; packet capture is not a mandatory network-policy step.