How to fix cni plugin not initialized in Kubernetes

Check if nodes are ready and CNI initialized:

kubectl get nodes -o wide
kubectl describe node <node-name> | grep -A5 "Conditions"
kubectl get pods -n kube-system | grep cni

Look for "cni plugin not initialized" condition. If present, CNI pods may not be running.

Azure NSG rules may block overlay traffic:

az network nsg rule list --resource-group <rg> --nsg-name <nsg-name> -o table

Ensure rules allow:
- Node CIDR ↔ Pod CIDR (all ports/protocols)
- Pod CIDR ↔ Pod CIDR (all ports/protocols)
- Pod CIDR → External (outbound)

Add missing rules if needed.

Check if pod IP pool is exhausted:

kubectl get nodes -o wide
kubectl describe node <node-name> | grep -A2 "Pod CIDR"

Ensure:
- Pod CIDR range is large enough (default 192.168.0.0/16)
- Nodes have available IPs (check allocatable IPs)
- No external hosts using pod CIDR range

SNAT routing misconfiguration breaks outbound traffic:

kubectl get configmap -n kube-system azure-ip-masq-agent-config -o yaml

If problematic nonMasqueradeCIDR entries exist, fix them:

kubectl edit configmap -n kube-system azure-ip-masq-agent-config
# Remove problematic CIDR entries
kubectl rollout restart daemonset -n kube-system azure-ip-masq-agent

Debug networking with a test pod:

kubectl run -it --rm debug --image=busybox --restart=Never -- sh
# Inside pod:
ping <external-host>
nslookup kubernetes.default
nc -zv <service-ip> <port>

If connectivity fails, network rules are blocking traffic.

Check AKS cluster overlay settings:

az aks show --resource-group <rg> --name <cluster> --query networkProfile

Should show:
- networkPlugin: azure
- networkPluginMode: overlay (for overlay)
- podCidr configured

Review CNI plugin logs:

kubectl logs -n kube-system -l k8s-app=azure-cni -f
kubectl logs -n kube-system -l k8s-app=azure-ip-masq-agent

Look for download failures, IP allocation errors, or SNAT issues.