如何阻止AKS Pod的互联网访问？默认拒绝出口网络策略可行性咨询

Hey there! Let's break down whether your proposed NetworkPolicy is the right fit for blocking internet access from your AKS pods, and what adjustments you might need to make.

First, what your current policy does #

Your default-deny policy is technically correct for blocking all egress traffic from every pod in your cluster:

• podSelector: {} matches every pod in the target namespace (or all namespaces if applied cluster-wide)
• policyTypes: [- Egress] tells Kubernetes this policy governs outbound traffic
• Since no explicit egress rules are defined, Kubernetes defaults to denying all outbound traffic from the matched pods

But here's the critical catch: this will block all outbound traffic—including the internal cluster communications your pods need to function properly.

Common issues with a full egress block #

Most AKS pods rely on internal cluster services to run, and your current policy will break these essential workflows:

• DNS resolution: Pods can't reach CoreDNS (in the kube-system namespace) to resolve even internal service names, making inter-pod communication impossible.
• Cluster API access: Pods that interact with the Kubernetes API Server (like operators, monitoring tools, or deployment controllers) will fail to connect.
• Internal service traffic: Any traffic between pods in your cluster (e.g., a frontend pod talking to a backend pod) will be blocked entirely.

A better approach: Block internet, keep internal traffic #

If your goal is only to block internet access (not all outbound traffic), modify the policy to allow necessary internal communications while denying external internet traffic. Here's a practical example:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-internet-access
spec:
  podSelector: {} # Matches all pods in the namespace
  policyTypes:
  - Egress
  egress:
    # Allow access to CoreDNS for DNS resolution
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # Allow traffic to your AKS cluster's internal pod CIDR (update this value!)
    - to:
        - ipBlock:
            cidr: 10.0.0.0/16 # Replace with your actual cluster pod CIDR
    # Optional: Add rules for other critical internal services (e.g., Azure Storage endpoints if needed)

Key notes for this setup: #

1. Get your cluster's pod CIDR: Use Azure CLI to retrieve your AKS cluster's pod CIDR with:

   az aks show --resource-group <your-resource-group> --name <your-aks-cluster> --query 'networkProfile.podCidr'
   

2. Verify NetworkPolicy support: AKS requires either the Azure CNI or Calico network plugin to enforce NetworkPolicies. If you're using the default kubenet plugin, NetworkPolicies won't work—you'll need to switch plugins first.
3. Add exceptions for specific pods: If some pods do need internet access, create a separate NetworkPolicy with a podSelector targeting those pods, and add egress rules allowing external traffic. Kubernetes applies the most specific rules first, so these exceptions will override the default restrict policy.

Final verdict #

Your original policy will block internet access, but it's too restrictive for most AKS environments. Use the modified policy above to preserve critical internal cluster functionality while achieving your goal of blocking internet access from pods.

内容的提问来源于stack exchange，提问作者Vishal Vishwakarma