I have a question and couldn't really find an answer or a google query to start with looking..

I have Azure managed K8s (Azure AKS) and it is accessible via internet https://somek8scluster.azureregion.azmk8s.io and I want/need to be able access to it from specific subnet. For all other stuff I am doing this with NSG, but how to "attach" NSG to this Azure AKS object? I can block access to nodes and other resources Azure AKS is creating in it's dummy RG, but the cluster itself is accessible from the Internet :)

I have tried with Application Gateway but it doesn't really work, because Azure AKS "doesn't have" a subnet, I can choose Nodes subnets etc.

I hope I wrote it clearly, if you have any questions for details, please ask. Looking for any guidance, lead where to search for solution.


Actually, if you want to do something with the Vnet associated with the AKS, you should use the advanced network for AKS when you create it.

Of curse, you can use the Application Gateway for the AKS and block the access with the NSG. For more details about the steps, see Internal Loadbalancers with Application Gateway (AKS).

And you also can access the application in it from a specific subnet if you create the application with an internal load balancer.

Hope this will help you.

  • It's enough to create services with Internal type in Azure to protect your services from Internet, but your provided links do not solve my issue, I want to protect my cluster itself, if you look at kube config for Azure AKS it's a public dns name provided by Azure and everyone can access it. Of course it's protected with RBAC and etc, but if we run into some Auth exploit it can be vulnerable.. – Smeedoo Jan 15 at 7:07
  • But if the AKS cluster cannot access from the internet, how do you manage it? For AKS cluster, there is just the master node has the public IP while agent nodes don't have. – Charles Xu - MSFT Jan 15 at 7:16
  • I wa t to be able to manage it only from my internal lan/vpn. Services also will not be exposed to the internet. – Smeedoo Jan 15 at 10:58
  • If you just want to use the Kubernetes cluster in a private network, maybe AKS cannot suitable to you. I suggest you can just create the Kubernetes cluster with Azure VMs. – Charles Xu - MSFT Jan 15 at 11:25
  • Azure AKS is far less support and headache :) – Smeedoo Jan 15 at 11:40

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.