Restrict certain AKS pod from External World

Sunil Yadav 25

I am using Application Gateway with WAF and application (pod1, pod2, pod3) running in AKS. I would like to Restrict certain pod (pod1 and pod2) access from External/Internet and only allow through certain IP addresses.

What could be the best approach to implement restriction if we have WAF and AKS.

ChaitanyaNaykodi-MSFT 25,841 Reputation points Microsoft Employee

2023-09-08T05:36:09.5+00:00

@Sunil Yadav

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

ChaitanyaNaykodi-MSFT 25,841 Reputation points Microsoft Employee

2023-09-01T02:59:42.0766667+00:00
@Sunil Yadav

Welcome to the Microsoft Q&A forum.

I think the best way to implement the required restriction will be to

Use Custom rules for Web Application Firewall v2 to apply the IP restriction. You can refer to this example here and use WAF custom rules to allow certain IP addresses to communicate with the Application Gateway.

Configure per-site WAF policies to apply WAF policies to individual listeners to allow for site-specific WAF configuration. As you need IP restrictions above for (pod1 and pod2) only you can implement a separate WAF policy which will contain the custom rule above to apply the restrictions. For pod3 you can have a different WAF policy to allow communication as per your requirements.

Hope this helps! Please let me know if you have any additional questions. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Sunil Yadav 25 Reputation points

2023-09-01T07:06:32.3733333+00:00

thanks for the answer, Do we need to have WAF in Prevention mode to have restrictions in place or rules can work with Detection mode as well?

Also, instead of creating per site policy, can we use a single WAF and use exclusion rules to exclude the Pod3 Host Name in request headers, Can we do something like this?

ChaitanyaNaykodi-MSFT 25,841 Reputation points Microsoft Employee

2023-09-01T16:24:55.74+00:00

@Sunil Yadav

Thank you for getting back.

Do we need to have WAF in Prevention mode to have restrictions in place or rules can work with Detection mode as well?

The WAF should be in prevention mode to have restrictions in place.

Additional Reference for best practices: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/best-practices

Also, instead of creating per site policy, can we use a single WAF and use exclusion rules to exclude the Pod3 Host Name in request headers, Can we do something like this?

I think this will not work in your case as custom rules hold a higher priority than the rest of the rules in the managed rule sets. The custom rules contain a rule name, rule priority, and an array of matching conditions. If these conditions are met, an action is taken (to allow, block, or log). If a custom rule is triggered, and an allow or block action is taken, no further custom or managed rules are evaluated. If you use only one WAF policy the custom rules will be applied first, and they will also apply to Pod3.

Hope this helps! Please let me know if you have any additional questions. Thank you!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Restrict certain AKS pod from External World

1 answer

Your answer