Hi!

I’m delighted to share that I was recently invited to host a webinar in French covering the essential topics of Cloud Native Security and Kubernetes. If you’re interested in gaining insights, best practices, and valuable feedback on deploying and safeguarding your Kubernetes environment, I highly recommend giving it a watch.

Audio podcast available on the Electro-Monkeys channel: https://podcasts.audiomeans.fr/electro-monkeys-0c9902cdaea8/cloud-native-security-and-kubernetes-be5f8d36

Maxime.

Hi!

Azure Kubernetes Service (AKS) clusters, regardless of whether they’re deployed in a managed or custom virtual network, require specific outbound dependencies to operate effectively. Previously, in environments where internet access had to be routed through HTTP proxies, this presented a challenge. Nodes lacked the means to bootstrap the essential configuration, environment variables, and certificates needed to connect to internet services.

With this newly introduced feature, AKS clusters now support HTTP proxies. This provides a user-friendly interface for cluster operators to manage network traffic required by AKS in environments dependent on proxies, ensuring a secure and smooth operation.

Example of Json HTTP Proxy Config File:

{
  "httpProxy": "string",
  "httpsProxy": "string",
  "noProxy": [
    "string"
  ],
  "trustedCa": "string"
}

Create a new AKS cluster with HTTP proxy configured on the nodes:

az aks create -n $clusterName -g $resourceGroup --http-proxy-config aks-proxy-config.json

Update an existing HTTP proxy:

az aks update -n $clusterName -g $resourceGroup --http-proxy-config aks-proxy-config-2.json

Note: ods must be rotated for the apps to pick it up. For components under kubernetes, like containerd and the node itself, this won’t take effect until a node image upgrade is performed.

The following scenarios are not supported:

1. Varied proxy configurations for each node pool
2. User/password authentication
3. Custom Certificate Authorities (CAs) for API server communication
4. Windows-based clusters
5. Node pools utilizing Virtual Machine Availability Sets (VMAS)
6. Employing ‘*’ as a wildcard appended to a domain suffix for noProxy

Additionally, it’s important to note that by default, both httpProxy and httpsProxy, as well as trustedCa, are unset.

Resource: https://learn.microsoft.com/en-us/azure/aks/http-proxy#updating-proxy-configurations

Maxime.