Hardening AKS Cluster via API server authorized IP ranges

Question

Hi,

We plan to harden our AKS environment by use of API server authorized IP ranges for API server and Disable Public Access to Azure Container Registry by using Private endpoint with Azure Private Link for ACR or by use of Registry firewall rules. We use Azure DevOps pipelines to code, build, test and push our images to ACR and then use kubectl in pipelines to deploy on top of AKS cluster.

Our question - How we can enable the above security features without losing the connectivity to ACR or AKS cluster API server with azure devops pipelines which are being executed on random microsoft hosted buid agents?

Answer 1

Hi @Kaushalendra Kumar ,

Thank you for your question.

The connection to both AKS and ACR would not be available when the features you mentioned are enabled, since the public agents (MS hosted) are using unpredictable IPs.

To work around this, I would consider using self-hosted agents, that have direct access to ACR's private link, and the AKS cluster, it would even work if you decided to go with a private AKS instead of authorized ranges.

Please check this document which also mentions the above points.

Also, check this blogpost for the Private AKS connection.

Thank you.

Please Accept the answer if the information helped you. This will help us and others in the community as well.

Answer 2

In scenarios where private networking is preferred, you should leverage self hosted agents. These will run on an adjacent subnet (or peered vnet) to your Container Registry. https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/agents?view=azure-devops&tabs=browser#install

It is possible to get the list of IP addresses used by the Microsoft hosted agents, and create firewall exceptions for the inbound traffic - however most enterprise security teams do not favour this approach. https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=azure-devops&tabs=yaml#networking

---

On your point about using Authorized IP ranges, an alternate option to consider is to use a Private AKS cluster, where communication to the Kubernetes API server will need to be made from a connected network.