Any need of firewall if IP are restricted?

Question

Hello,

We are using azure kubernetes service over 443 port. We have enabled the IP range restricted Vnet due to which the services are only accessible from our organization. It is kind of an intranet and nothing is exposed over internet. In addition, a token validation service is hosted separately to authenticate the clients before redirecting the request to actual api’s hosted in other pods.

In such case, do we need any firewall or App Gateway WAF. Generally, firewalls are installed to protect from web injection attacks. But we don’t have any website or any database and not even any storage for file saving. Tensorflow Api’s are hosted in separate containers, they evaluate the request at runtime and return the response. Everything is volatile here.

Do we still need firewall. Kindly suggest.

Answer 1

@TanulBhasin-0866 Apologies for the delay in response and all the inconvienice caused because of the issue.

For management and operational purposes, nodes in an AKS cluster need to access certain ports and fully qualified domain names (FQDNs). These endpoints are required for the nodes to communicate with the API server, or to download and install core Kubernetes cluster components and node security updates. For example, the cluster needs to pull base system container images from Microsoft Container Registry (MCR).

The AKS outbound dependencies are almost entirely defined with FQDNs, which don't have static addresses behind them. The lack of static addresses means that Network Security Groups can't be used to lock down the outbound traffic from an AKS cluster.

By default, AKS clusters have unrestricted outbound (egress) internet access. This level of network access allows nodes and services you run to access external resources as needed. If you wish to restrict egress traffic, a limited number of ports and addresses must be accessible to maintain healthy cluster maintenance tasks. The simplest solution to securing outbound addresses lies in use of a firewall device that can control outbound traffic based on domain names. Azure Firewall, for example, can restrict outbound HTTP and HTTPS traffic based on the FQDN of the destination. You can also configure your preferred firewall and security rules to allow these required ports and addresses.

You can refer to this article for more information on this use case.

In the above case you might consider use of Firewall or Gateway.

In your case as far as I can understand you have everything internal so you can make use of Azure Network policies to control the flow within the pod.

The Network Policy feature in Kubernetes lets you define rules for ingress and egress traffic between pods in a cluster.

This article shows you how to install the network policy engine and create Kubernetes network policies to control the flow of traffic between pods in AKS. Network policy should only be used for Linux-based nodes and pods in AKS.
All pods in an AKS cluster can send and receive traffic without limitations, by default. To improve security, you can define rules that control the flow of traffic. Back-end applications are often only exposed to required front-end services, for example. Or, database components are only accessible to the application tiers that connect to them.

Network Policy is a Kubernetes specification that defines access policies for communication between Pods. Using Network Policies, you define an ordered set of rules to send and receive traffic and apply them to a collection of pods that match one or more label selectors.

These network policy rules are defined as YAML manifests. Network policies can be included as part of a wider manifest that also creates a deployment or service.

Hope it helps!!!

Please 'Accept as answer' if it helped, so that it can help others in the community looking for help on similar topics.