Is there any option to control outgoing traffic at the Azure API gateway

Question

Is there any option to control outgoing traffic at the Azure API gateway

Shreyas Arani 271

There are some pods in my AKS cluster which need to communicate outside the AKS cluster. So is there a way to control outgoing traffic from my pod at the Azure API gateway?

SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-06-21T06:30:47.61+00:00

@Shreyas Arani , Thank you for your question.

By default, AKS will provision a Standard SKU Load Balancer to be set up and used for egress. However, the default setup may not meet the requirements of all scenarios if public IPs are disallowed or additional hops are required for egress. Are you using a userDefinedRouting with your AKS cluster to route egress traffic to a gateway resource?

You can restrict egress traffic from the AKS cluster using Azure Firewall
SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-06-24T03:38:05.427+00:00

@Shreyas Arani , I wanted to follow up with you if the insights shared have helped.

Accepted answer

0 additional answers

Your answer

SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-06-21T06:30:47.61+00:00

@Shreyas Arani , Thank you for your question.

By default, AKS will provision a Standard SKU Load Balancer to be set up and used for egress. However, the default setup may not meet the requirements of all scenarios if public IPs are disallowed or additional hops are required for egress. Are you using a userDefinedRouting with your AKS cluster to route egress traffic to a gateway resource?

You can restrict egress traffic from the AKS cluster using Azure Firewall
SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-06-24T03:38:05.427+00:00

@Shreyas Arani , I wanted to follow up with you if the insights shared have helped.

Answer 1

Shreyas Arani 271

Hi @SRIJIT-BOSE-MSFT actually we are using nginx ingress controller as a API gateway. So all the requests from internet will first hit the ingress controller and ingress rules have been defined to redirect to the particular backend service based on the hostname. So my concern is controlling egress traffic from pods. I would like to allow ingress to my ingress controller pod. And would like to block egress on some pods. So I thought of using network policies https://learn.microsoft.com/en-us/azure/aks/use-network-policies . I am not sure whether azure firewall serves my purpose. If it does will look into it.

SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-06-24T06:29:01.087+00:00

Hi @Shreyas Arani , thank you for your response. If you want to restrict egress traffic at the pod in the AKS cluster then definitely you can use Network Policies. For more details on designing the network policy please refer to this article.

However, if you want to deploy traffic restrictions at the underlying network to the AKS cluster (this will include all egress traffic from the nodes) then you can choose to deploy an Azure Firewall and use an UDR to route traffic through it.

----------

Hope this helps!

Please "Accept as Answer" if it helped, so that it can help others in the community looking for help on similar topics.

Share via

Is there any option to control outgoing traffic at the Azure API gateway

0 additional answers

Your answer