-
Notifications
You must be signed in to change notification settings - Fork 21.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
AKS outbound traffic requirements for storage and ACR #116239
Comments
@dstarkowski |
@dstarkowski @asudbring |
+1 , Facing the same issue and a more clear document would be highly appretiated . We leverage Azure Native Tools like ACR and even still seeing issues while connecting from AKS Clusters via Azure Firewall . Ideally the container registry tag should cover everything thats needed for the firewall to allow all URLS needed to pull image from ACR |
Do we have any update? |
Thank you for your dedication to our documentation. Unfortunately, at this time we have been unable to review your issue in a timely manner, and we sincerely apologize for the delayed response. The requested updates have not been made since the creation of this issue, so we've created an internal work item to incorporate your suggestions. We are closing this issue for now, but feel free to comment here as necessary. #please-close |
@rayoef Please keep in mind that this issue is not about a typo or something unclear/missing in the documentation, which can wait another 9 months. This is about SECURITY. It is currently not possible to properly secure the cluster without this information. |
@rayoef We need update on this, I have a major client who could dismiss AKS because of this issue |
@psddp @dstarkowski My team is working on investigating this issue. I'll circle back when we've updated the text. |
I have configured all the outbound rules as described in the article.
I still see some outbound flows in Azure Firewall logs that were not matched by any of the rules.
First is an Azure Container Registry:
inuxgeneva-microsoft.azurecr.io
.This is used by one of the containers in DAPR extension, but the only mention I found of it on the internet is related to ARC (we're using AKS managed cluster).
Then there are 37 storage accounts (where
###
are numbers or random strings):neumanaged###.blob.core.windows.net
md-############.z##.blob.storage.azure.net
wusreplica###.blob.core.windows.net
umsa################.blob.core.windows.net
Here's the only mention about storage accounts in the article:
"Under certain circumstances" and "You might want" are a bit vague when talking about security. Can we get a clarification about the circumstances and what are those accounts used for exactly?
Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.
The text was updated successfully, but these errors were encountered: