OCI OKE CNI Plugin Should Support Network Policies

Using Console

To have the OKE CNI plugin support Kubernetes NetworkPolicies, the cluster must be:

Using VCN-native (OCI VCN CNI) networking, and
Have Network Policy enabled at cluster creation time.

This cannot be retroactively enabled on an existing non–VCN-native cluster; you must create a new cluster with the correct options, then migrate workloads.

1. Check your current cluster networking mode

In the OCI Console, go to: Developer Services → Kubernetes Clusters (OKE).
Select your Cluster.
On the Cluster Details page, check:
- Cluster Type / Networking:
  - If it says VCN-native or similar: good.
  - If it says Flannel or Overlay: you must create a new cluster; network policies aren’t supported on this CNI.

If your cluster is not VCN-native, skip to section 2 (create a new cluster).

1a. If cluster is already VCN-native: verify Network Policy add-on

For recent console versions, Network Policy is controlled via an add-on:

In your Cluster Details page, check the Add-ons or Add-ons Management tab (name may vary).
Look for something like Network Policy or Kubernetes Network Policy:
- If it is Enabled / Installed, your CNI already supports NetworkPolicies. You just need to apply NetworkPolicy objects with kubectl.
- If it is Disabled / Not installed and the UI allows toggling:
  1. Click Edit Add-ons (or similar).
  2. Enable the Network Policy add-on.
  3. Save/Apply and wait until the status is Active.

If you do not see any way to enable it on an existing VCN-native cluster, Oracle’s current restriction is that it must be turned on at cluster creation; then proceed to section 2 and create a new cluster.

2. Create a new OKE cluster with CNI network policies enabled (OCI Console)

In the OCI Console, go to Developer Services → Kubernetes Clusters (OKE).
Click Create Cluster.
Choose the Compartment.
Select Quick Create or Custom Create:
- Custom Create gives explicit control; recommended.

2.1. Configure networking as VCN-native

In the Cluster Configuration step:
- Ensure Kubernetes version is a supported, recent version.
- Under Networking (or Network Type):
  - Select VCN-native (or “Use existing VCN with native pod networking” / similar wording).
  - Do not select Flannel/Overlay networking.
Choose or create the VCN and subnets as prompted (node subnets and pod subnet if requested).

2.2. Enable Network Policy (CNI plugin support)

In the Add-ons or Optional Features section (typically later in the wizard):
- Locate Network Policy / Kubernetes Network Policy.
- Check/enable the Network Policy option.
- Confirm any related settings (there are typically no extra fields; it’s just On/Off).
Finish configuring:
- Configure Node Pools (shape, number of nodes, etc.).
- Click Create Cluster.
Wait for:
- Cluster status: Active
- Node Pools status: Active
- Add-ons: Network Policy shows Active / Installed.

3. Migrate workloads from old cluster (if applicable)

From your existing cluster:
- Export Kubernetes manifests (Deployments, Services, etc.) with kubectl get ... -o yaml or from your Git/CI.
Point kubectl to the new cluster (download kubeconfig from the cluster details page via Access Cluster).
Apply the manifests:
kubectl apply -f your-apps/
Configure NetworkPolicy objects in the new cluster as needed.
Update DNS, ingress, or external references to point to the new cluster; then decommission the old cluster when traffic has drained.

4. Validate NetworkPolicy support

Create a simple NetworkPolicy in the new cluster (e.g., deny all ingress to a namespace):

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
    - Ingress

Apply it:
kubectl apply -f deny-all.yaml
Verify that traffic to pods in that namespace is blocked as expected from other pods/namespaces. If behavior enforces the policy, the OKE CNI Network Policy support is working.

If you tell me your cluster’s current networking type (VCN-native vs Flannel) from the console, I can give a more exact “change vs recreate” path.

Using CLI

In OKE, Kubernetes NetworkPolicy is enforced only when the OKE CNI plugin has network policy enabled on the cluster. That is controlled in the cluster’s options via the OCI CLI.Below is the minimal, practical way to do this via OCI CLI.

1. Prerequisites

OCI CLI configured with a user that can manage OKE clusters.
The cluster is VCN-native (OCI VCN IP Native) or at least using an OKE CNI version that supports network policies.
You know your:
- Compartment OCID
- Cluster OCID
- VCN subnets for pods/services if required

2. Inspect current cluster options (check if network policy is enabled)

CLUSTER_ID="<your_cluster_ocid>"

oci ce cluster get \
  --cluster-id "$CLUSTER_ID" \
  --query 'data."options"' \
  --output json

Look for a structure under options (or options.kubernetesNetworkConfig / options.networkConfig) related to network policy, for example:

networkPolicyConfig.isNetworkPolicyEnabled
or kubernetesNetworkConfig.networkPolicyConfig.isNetworkPolicyEnabled

If it’s false or missing, you need to update.

3. Generate the JSON skeleton for a cluster update

This avoids guessing field names:

oci ce cluster update --generate-full-command-json-input > cluster-update.json

Open cluster-update.json. Find the options section. Within it you should see or add the network policy part, for example (schema names may differ slightly per OKE version; align with what you saw in step 2):

"options": {
  "kubernetesNetworkConfig": {
    "podsCidr": "10.244.0.0/16",
    "servicesCidr": "10.96.0.0/16",
    "networkPolicyConfig": {
      "isNetworkPolicyEnabled": true
    }
  }
  /* keep all other existing fields as they were */
}

Key rules:

Do not remove or change other existing fields you don’t intend to modify.
Only set "isNetworkPolicyEnabled": true within the appropriate network config section that already exists.

If your generated JSON instead shows networkConfig or similar, mirror that exact structure and field name; the key is to set the isNetworkPolicyEnabled flag to true in the right place.

4. Apply the update to enable network policy

oci ce cluster update \
  --cluster-id "$CLUSTER_ID" \
  --from-json file://cluster-update.json \
  --force

Wait for the work request to complete:

oci ce work-request list \
  --compartment-id "<your_compartment_ocid>" \
  --query "data[?\"operation-type\"=='CLUSTER_UPDATE']"

or get the last work request ID from the previous command’s output and:

oci ce work-request get --work-request-id "<work_request_ocid>"

5. Verify network policy support is enabled

Re-check the options:

oci ce cluster get \
  --cluster-id "$CLUSTER_ID" \
  --query 'data."options"' \
  --output json

Confirm that the network policy flag (e.g., isNetworkPolicyEnabled) is now true.

6. Use Kubernetes NetworkPolicy resources

Once enabled, you can apply standard Kubernetes NetworkPolicy YAML:

kubectl apply -f your-network-policy.yaml

These policies will now be enforced by the OKE CNI plugin.

If your generated JSON doesn’t show any network-policy-related field at all, your cluster/OCI CLI version may not yet expose that feature; in that case, upgrade the cluster to a supported version or recreate the cluster with the correct options, then repeat the steps above.

Using Python

For OKE, network policies are only supported when using the OCI VCN-Native CNI with network policy mode enabled. You cannot “flip a switch” on an existing non‑VCN‑native cluster; you must create (or already have) a cluster with the right CNI options.Below are step‑by‑step remediation instructions using Python and the OCI SDK.

1. Prerequisites

Install/upgrade SDK:
pip install --upgrade oci
Have a configured OCI CLI/profile (used by the SDK): ~/.oci/config with a profile, e.g. [DEFAULT].
Collect:
- compartment_id
- vcn_id
- kubernetes_version
- cluster_name
- Subnets for:
  - endpoint_subnet_id (API endpoint)
  - service_lb_subnet_ids (Service LB subnets)

2. Understand the Required CNI Settings

For OKE to support Kubernetes NetworkPolicies with the OCI CNI, you need a cluster with:

network_config → type = "VCN_NATIVE"
options.kubernetes_network_config.pod_network_options including:
- cni_type = "OCI_VCN_IP_NATIVE"
- nsg_mode = "POLICY" (this turns on network-policy mode)

These options are immutable on an existing cluster; you must create a new cluster with them, then migrate workloads.

3. Create a New OKE Cluster with Network Policy–Capable CNI (Python)

import oci
from oci.container_engine import ContainerEngineClient
from oci.container_engine.models import (
    CreateClusterDetails,
    ClusterCreateOptions,
    KubernetesNetworkConfig,
    ClusterPodNetworkOptionDetails,
    ClusterNetworkConfig
)

# ----- CONFIGURE THIS BLOCK -----
config = oci.config.from_file("~/.oci/config", "DEFAULT")

compartment_id = "<your_compartment_ocid>"
vcn_id = "<your_vcn_ocid>"
cluster_name = "oke-with-network-policies"
kubernetes_version = "v1.29.1"   # example; use a supported version

endpoint_subnet_id = "<endpoint_subnet_ocid>"          # private or public
service_lb_subnet_ids = ["<lb_subnet1_ocid>", "<lb_subnet2_ocid>"]
# -------------------------------

ce_client = ContainerEngineClient(config)

# Define pod network options for OCI VCN IP Native + Network Policy mode
pod_network_options = ClusterPodNetworkOptionDetails(
    cni_type="OCI_VCN_IP_NATIVE",
    nsg_ids=[],       # optionally attach NSGs; can be managed later
    nsg_mode="POLICY" # enables network policy mode
)

k8s_network_config = KubernetesNetworkConfig(
    pods_cidr=None,      # not required for VCN-native pod networking
    services_cidr=None   # optional; can be specified if needed
)

network_config = ClusterNetworkConfig(
    type="VCN_NATIVE",
    vcn_id=vcn_id,
    kubernetes_network_config=k8s_network_config,
    pod_network_options=[pod_network_options]
)

cluster_options = ClusterCreateOptions(
    service_lb_subnet_ids=service_lb_subnet_ids
)

create_cluster_details = CreateClusterDetails(
    name=cluster_name,
    compartment_id=compartment_id,
    vcn_id=vcn_id,
    kubernetes_version=kubernetes_version,
    endpoint_config={
        "isPublicIpEnabled": False,            # or True if you want public endpoint
        "subnetId": endpoint_subnet_id
    },
    options=cluster_options,
    network_config=network_config
)

response = ce_client.create_cluster(create_cluster_details)
cluster_id = response.data.id
print("Creating cluster:", cluster_id)

Optionally, wait for the cluster to become ACTIVE:

from oci.waiter import wait_until

get_cluster_response = ce_client.get_cluster(cluster_id)
wait_until(ce_client, get_cluster_response, 'lifecycle_state', 'ACTIVE')
print("Cluster is ACTIVE:", cluster_id)

4. Create Node Pools for the New Cluster (Python)

from oci.container_engine.models import CreateNodePoolDetails, NodePoolNodeConfigDetails

node_image_id = "<node_image_ocid>"        # an OKE-supported node image
node_shape = "VM.Standard3.Flex"          # example
node_subnet_ids = ["<worker_subnet_ocid>"]

node_config = NodePoolNodeConfigDetails(
    placement_configs=[{"availabilityDomain": "<AD-1>", "subnetId": node_subnet_ids[0]}],
    size=3  # number of nodes
)

create_node_pool_details = CreateNodePoolDetails(
    compartment_id=compartment_id,
    cluster_id=cluster_id,
    name="node-pool-with-network-policies",
    kubernetes_version=kubernetes_version,
    node_shape=node_shape,
    node_image_id=node_image_id,
    node_config_details=node_config
)

np_response = ce_client.create_node_pool(create_node_pool_details)
node_pool_id = np_response.data.id
print("Creating node pool:", node_pool_id)

get_np_response = ce_client.get_node_pool(node_pool_id)
wait_until(ce_client, get_np_response, 'lifecycle_state', 'ACTIVE')
print("Node pool is ACTIVE:", node_pool_id)

5. Migrate Workloads from the Old Cluster

Get kubeconfig for the new cluster (can also be done with the Python SDK using ce_client.create_kubeconfig):

from oci.container_engine.models import CreateClusterKubeconfigDetails

details = CreateClusterKubeconfigDetails(token_version="2.0.0")
kubeconfig_response = ce_client.create_kubeconfig(cluster_id, details)
with open("kubeconfig-new-oke", "wb") as f:
    f.write(kubeconfig_response.data.content)

Use kubectl to:
- Export manifests from the old cluster (or use your IaC manifests/Helm charts).
- Apply them to the new cluster:
  KUBECONFIG=./kubeconfig-new-oke kubectl apply -f <your-manifests>
Cut traffic over (e.g., update DNS / load balancer targets if necessary).
Decommission the old cluster and its node pools once traffic is fully moved.

6. Apply Kubernetes NetworkPolicies

Now that your cluster uses the OCI VCN-native CNI in POLICY mode, you can define NetworkPolicies as usual:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Apply with:

KUBECONFIG=./kubeconfig-new-oke kubectl apply -f deny-all.yaml

7. Verifying CNI and Network Policy Support (Python snippet)

To confirm the cluster is using the correct CNI options:

cluster = ce_client.get_cluster(cluster_id).data

print("Network type:", cluster.network_config.type)
for opt in cluster.network_config.kubernetes_network_config.pod_network_options:
    print("CNI type:", opt.cni_type, "NSG mode:", opt.nsg_mode)

You should see:

Network type: VCN_NATIVE
CNI type: OCI_VCN_IP_NATIVE
NSG mode: POLICY

If you provide your existing cluster’s details (network type and pod_network_options), I can tailor a Python migration script to mirror its settings while enabling NSG_MODE=POLICY.

Using Terraform

resource "oci_containerengine_cluster" "OKE_CLUSTER" {
  # Replace with your existing cluster arguments
  name           = "OKE_CLUSTER_NAME"            # set to your cluster name
  compartment_id = "COMPARTMENT_OCID"            # set to your compartment OCID
  vcn_id         = "VCN_OCID"                    # set to your VCN OCID
  kubernetes_version = "K8S_VERSION"             # e.g. "v1.29.1"

  # Other required cluster arguments (endpoint_config, kms_key_id, etc.) go here

  options {
    # Ensure the CNI plugin supports NetworkPolicy:
    # Set to OCI VCN-native pod networking, which is policy-aware.
    cluster_pod_network_options {
      cni_type = "OCI_VCN_IP_NATIVE"
    }

    # keep/merge any other options you already configure here
  }
}

Setting cni_type = "OCI_VCN_IP_NATIVE" enables a CNI that enforces Kubernetes NetworkPolicy. Changing the CNI type on an existing OKE cluster forces replacement; terraform apply will destroy and recreate the cluster to apply this setting, causing an outage for workloads on that cluster.Verification: terraform plan should show options[0].cluster_pod_network_options[0].cni_type changing from its current value (for example "FLANNEL_OVERLAY" or null) to "OCI_VCN_IP_NATIVE", with the plan indicating that the oci_containerengine_cluster resource will be replaced.

OCI Misconfigurations

OCI OKE CNI Plugin Should Support Network Policies

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Check your current cluster networking mode

1a. If cluster is already VCN-native: verify Network Policy add-on

2. Create a new OKE cluster with CNI network policies enabled (OCI Console)

2.1. Configure networking as VCN-native

2.2. Enable Network Policy (CNI plugin support)

3. Migrate workloads from old cluster (if applicable)

4. Validate NetworkPolicy support

1. Prerequisites

2. Inspect current cluster options (check if network policy is enabled)

3. Generate the JSON skeleton for a cluster update

4. Apply the update to enable network policy

5. Verify network policy support is enabled

6. Use Kubernetes NetworkPolicy resources

1. Prerequisites

2. Understand the Required CNI Settings

3. Create a New OKE Cluster with Network Policy–Capable CNI (Python)

4. Create Node Pools for the New Cluster (Python)

5. Migrate Workloads from the Old Cluster

6. Apply Kubernetes NetworkPolicies

7. Verifying CNI and Network Policy Support (Python snippet)

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Check your current cluster networking mode

​1a. If cluster is already VCN-native: verify Network Policy add-on

​2. Create a new OKE cluster with CNI network policies enabled (OCI Console)

​2.1. Configure networking as VCN-native

​2.2. Enable Network Policy (CNI plugin support)

​3. Migrate workloads from old cluster (if applicable)

​4. Validate NetworkPolicy support

​1. Prerequisites

​2. Inspect current cluster options (check if network policy is enabled)

​3. Generate the JSON skeleton for a cluster update

​4. Apply the update to enable network policy

​5. Verify network policy support is enabled

​6. Use Kubernetes NetworkPolicy resources

​1. Prerequisites

​2. Understand the Required CNI Settings

​3. Create a New OKE Cluster with Network Policy–Capable CNI (Python)

​4. Create Node Pools for the New Cluster (Python)

​5. Migrate Workloads from the Old Cluster

​6. Apply Kubernetes NetworkPolicies

​7. Verifying CNI and Network Policy Support (Python snippet)

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Check your current cluster networking mode

1a. If cluster is already VCN-native: verify Network Policy add-on

2. Create a new OKE cluster with CNI network policies enabled (OCI Console)

2.1. Configure networking as VCN-native

2.2. Enable Network Policy (CNI plugin support)

3. Migrate workloads from old cluster (if applicable)

4. Validate NetworkPolicy support

1. Prerequisites

2. Inspect current cluster options (check if network policy is enabled)

3. Generate the JSON skeleton for a cluster update

4. Apply the update to enable network policy

5. Verify network policy support is enabled

6. Use Kubernetes NetworkPolicy resources

1. Prerequisites

2. Understand the Required CNI Settings

3. Create a New OKE Cluster with Network Policy–Capable CNI (Python)

4. Create Node Pools for the New Cluster (Python)

5. Migrate Workloads from the Old Cluster

6. Apply Kubernetes NetworkPolicies

7. Verifying CNI and Network Policy Support (Python snippet)