What are the default firewall settings for AKS?

Question

What are the default firewall settings for AKS?

MaximilianR-2403 45

Greetings,

I would like to know what the default firewall configuration is for AKS. Do customers need to use Azure Firewall or Network Security Groups to configure the settings?

Thank you for your assistance!

Accepted answer

0 additional answers

Your answer

Answer 1

Prrudram-MSFT 28,366 Microsoft Employee Moderator

Hi @MaximilianR-2403

Thank you for reaching out to the Microsoft Q&A platform.

By default, AKS clusters have unrestricted outbound (egress) internet access. This level of network access allows nodes and services you run to access external resources as needed. If you wish to restrict egress traffic, a limited number of ports and addresses must be accessible to maintain healthy cluster maintenance tasks. The simplest solution to securing outbound addresses lies in use of a firewall device that can control outbound traffic based on domain names. Azure Firewall, for example, can restrict outbound HTTP and HTTPS traffic based on the FQDN of the destination. You can also configure your preferred firewall and security rules to allow these required ports and addresses.

However, blocking internal subnet traffic using network security groups (NSGs) and firewalls is not supported. To control and block the traffic within the cluster, use Network Policies.

You can check the following AKS networking guide for more details https://learn.microsoft.com/en-us/azure/aks/concepts-network

Please don’t forget to Accept Answer and hit Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members for remediation for similar issues.

MaximilianR-2403 45 Reputation points

2023-12-14T15:31:56.54+00:00

Thanks for the answer!

Can you also give information about the firewall settings/rules for ingress traffic? Is there a basic firewall which denies all traffic from outside to inside? What recommendations can you give to also limit the ingress traffic that comes from outside?

Thank you!
MaximilianR-2403 45 Reputation points

2023-12-14T15:36:38.1466667+00:00

Thanks for the answer! (This comment might be duplicate, not sure if the first request was successfull)

Can you also give information about the firewall settings/rules for ingress traffic? Is there a basic firewall which denies all traffic from outside to inside? Do you have recommendations on how to limit ingress traffic that comes from the outside?

Thank you!
Prrudram-MSFT 28,366 Reputation points Microsoft Employee Moderator

2023-12-26T04:23:44.44+00:00
Maximilian Ramin

By default, AKS has no ingress requirements. This means that there is no basic firewall that denies all traffic from outside to inside. However, you can use Kubernetes Ingress to expose HTTP and HTTPS routes from outside the cluster to services within the cluster.

When you create an Ingress resource, you can specify the rules for routing traffic to the appropriate services. You can also use annotations to configure additional settings, such as SSL certificates and load balancing.

To limit the ingress traffic that comes from outside, you can use Azure Firewall or NSGs to restrict traffic to the IP addresses and ports that are required for your services. You can also use Kubernetes Network Policies to control the traffic flow between pods in your cluster.

Network Policies are a Kubernetes feature that allow you to define rules for how pods can communicate with each other. You can use Network Policies to restrict traffic to specific pods or namespaces, or to allow traffic only from specific IP addresses or ports.

Here are some recommendations for limiting ingress traffic in AKS:

Use Kubernetes Ingress to expose only the necessary HTTP and HTTPS routes from outside the cluster to services within the cluster.

Use Azure Firewall or NSGs to restrict traffic to the IP addresses and ports that are required for your services.

Use Kubernetes Network Policies to control the traffic flow between pods in your cluster.

Use SSL certificates to encrypt traffic between clients and your services.

Use load balancing to distribute traffic across multiple instances of your services.

Use authentication and authorization to control access to your services.

By following these recommendations, you can help to ensure that your AKS cluster is secure and that your services are protected from unauthorized access.

Share via

What are the default firewall settings for AKS?

0 additional answers

Your answer