Kubernetes clusters should use the Azure network plugin
This control checks if Azure CNI networking is enabled for Kubernetes cluster. Azure Kubernetes Clusters should use Azure CNI. Ensure AKS cluster has Azure CNI networking enabled.
Azure CNI is a prerequisite for some Azure Kubernetes Service features, including Azure network policies, Windows node pools and virtual nodes add-on.
What this control checks
AKS cluster networkPlugin must be azure (Azure CNI); other values fail.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Kubernetes Clusters should use Azure CNI" (46238e2f-3f6f-4589-9f3f-77bed4116e67); PowerPipe control azure_compliance.control.kubernetes_cluster_network_plugin_azure.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_29.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_network_plugin_azure - Checkov Check:
CKV2_AZURE_29 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_network_plugin_azure - Azure Policy Definition:
46238e2f-3f6f-4589-9f3f-77bed4116e67
Last reviewed: 2026-10-13