How to fix Network policy not enforced in Kubernetes

KubernetesINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 105 views

Network policy errors occur when Calico policies are not enforced or configured incorrectly. Fix by verifying policy syntax, enabling enforcement mode, and checking for conflicting rules.

Quick fix

Fixes Network policy not enforced

kubectl get deployment -n calico-system calico-kube-controllers
kubectl logs -n calico-system -l app=calico-kube-controllers
  1. Verify Calico policy controller is running
  2. Check NetworkPolicy YAML syntax
  3. Verify pod selectors match actual pods
  4. Enable default deny policy gradually
kubernetes — error
kubectl get deployment -n calico-system calico-kube-controllers
kubectl logs -n calico-system -l app=calico-kube-controllers
Network policy not enforced

What this error means

Calico implements Kubernetes NetworkPolicy and native Calico policy for network access control. When policies are not enforced, traffic flows despite policy rules that should block it. This happens due to misconfigured policies, incorrect enforcement mode, or issues with the policy controller.

Typical symptoms

  • Traffic allowed despite NetworkPolicy rules forbidding it
  • Network policies appear correctly configured but ineffective
  • Pods communicate when they should be blocked
  • Error CALICO-1014 in logs indicating policy enforcement failure
  • Policy rules updating slowly or not at all
  • Network policies work on some pods but not others
  • Service mesh policies conflicting with Calico policies
  • Logging shows traffic being allowed when should be denied

Common causes

  1. Policy enforcement mode not enabled for the namespace
  2. Calico policy controller not running or healthy
  3. Network policy YAML syntax errors
  4. Incorrect selector matching pods
  5. Missing allow rules when switching to default deny
  6. Rule order causing early Allow before intended Deny
  7. Conflict between Kubernetes NetworkPolicy and Calico policies
  8. Service mesh sidecar proxies bypassing network policies

How to fix "Network policy not enforced"

1Verify Calico policy controller is running

Ensure the policy controller deployment is healthy:

bash
kubectl get deployment -n calico-system calico-kube-controllers
kubectl logs -n calico-system -l app=calico-kube-controllers

If not running, restart it.

2Check NetworkPolicy YAML syntax

Validate policy YAML for errors:

bash
kubectl apply -f network-policy.yaml --dry-run=client
kubectl validate -f network-policy.yaml

Look for indentation errors, invalid selectors, or missing required fields.

3Verify pod selectors match actual pods

Ensure your selectors correctly identify target pods:

bash
kubectl get pods --show-labels
kubectl get networkpolicy -o yaml | grep -A 5 "podSelector|namespaceSelector"

Matching labels must be present on the target pods.

4Enable default deny policy gradually

When enforcing policies, start with logging before blocking:

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          allow-traffic: "true"
5Use Calico policies for advanced features

For more control, use native Calico policies:

yaml
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: default-deny
spec:
  selector: "all()"
  order: 0
  types:
  - Ingress

Calico policies have more features like policy ordering.

6Review policy rule order

Policies are evaluated in order - deny rules must come after allow:

yaml
spec:
  order: 10  # Lower numbers evaluated first
  ingress:
  - action: Allow
    from:
    - namespaceSelector:
        matchLabels:
          team: backend
  - action: Deny
    from:
    - namespaceSelector: {}
7Enable audit logging to debug policies

Enable flow logs to see which policies are matching:

bash
calicoctl apply -f - << EOF
apiVersion: projectcalico.org/v3
kind: FelixConfiguration
metadata:
  name: default
spec:
  flowLogsFileEnabled: true
  flowLogsFile: /var/log/calico/flows.log
EOF

Review logs to see policy evaluations.

8Restart Calico kube-controllers if policies not updating

Force policy reload by restarting controller:

bash
kubectl rollout restart deployment/calico-kube-controllers -n calico-system
kubectl rollout status deployment/calico-kube-controllers -n calico-system

Advanced notes

For production, use Calico policy for precise control over deny/allow ordering and performance. Test policies in logging mode before enforcement. Document policy intent and keep rules as simple as possible. Use namespaceSelector and podSelector consistently. Monitor policy violations via logs to catch unintended blocks. For service mesh, ensure policies work with sidecar proxies or disable proxying for policy enforcement.

Frequently asked questions

What does "Network policy not enforced" mean?
Calico implements Kubernetes NetworkPolicy and native Calico policy for network access control. When policies are not enforced, traffic flows despite policy rules that should block it. This happens due to misconfigured policies, incorrect enforcement mode, or issues with the policy controller.
How do I fix "Network policy not enforced"?
Network policy errors occur when Calico policies are not enforced or configured incorrectly. Fix by verifying policy syntax, enabling enforcement mode, and checking for conflicting rules.
What causes "Network policy not enforced"?
Policy enforcement mode not enabled for the namespace Calico policy controller not running or healthy Network policy YAML syntax errors
Is the "Network policy not enforced" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading