<p>We have a requirement to connect a K8s POD to an Azure VPN Gateway in a secure manner. This is what our network topology is:</p>
<p><a href="https://i.stack.imgur.com/sH8cx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sH8cx.png" alt="enter image description here" /></a></p>
<p>Firstly is this possible to achieve and secondly how would we go about creating this peering? If peering isn't the best option then what would you recommend to solve this problem? TIA</p>
<p>We have created the VPN gateway, VNET, and a local network and confirmed that they can communicate in both directions. The problem is how we bring this into K8s.</p>

<p>I tried to reproduce the same in my environment I have created a virtual network gateway vnet local network gateway like below:</p>
<p><img src="https://i.imgur.com/FlsYk8w.png" alt="enter image description here" /></p>
<p>In virtual network added gateway subnet like below:</p>
<p><img src="https://i.imgur.com/GFa00tv.png" alt="enter image description here" /></p>
<p>created local network gateway :</p>
<p><img src="https://i.imgur.com/psawSTt.png" alt="enter image description here" /></p>
<p>On-premise try to configure  <a href="https://www.mcse.gen.tr/demand-dial-ile-site-to-site-vpn/" rel="nofollow noreferrer">Routing and remote access role</a> in tools -&gt; select custom configuration -&gt;Vpn access, Lan routing -&gt;finish</p>
<p>in network interface select -&gt; New demand-dial interface -&gt; in vpn type select IPEv2 and in the destination address screen provide public IP of virtual network gateway</p>
<p><img src="https://i.imgur.com/r4Qa8OC.png" alt="enter image description here" /></p>
<p>Now, try to create a connection like below:</p>
<p><img src="https://i.imgur.com/z0U9zK6.png" alt="enter image description here" /></p>
<p><img src="https://i.imgur.com/ChSmpUf.png" alt="enter image description here" /></p>
<p>Now, I have created an aks cluster with pod like below:</p>
<p><img src="https://i.imgur.com/DzX6129.png" alt="enter image description here" /></p>
<p>To communicate with pod make sure to use <em><strong>Azure Container Networking Interface (CNI)</strong></em> every pod gets an IP address from the subnet and can be accessed directly each pod receives an IP address and can directly communicate with other pods and services.
you can  AKS nodes based on the maximum number of pod can support. Advanced network features and scenarios such as Virtual Nodes or Network Policies (either Azure or Calico) are supported with Azure CNI.</p>
<p>When using Azure CNI, Every pod is assigned a VNET route-able private IP from the subnet. So, <em><strong>Gateway should be able reach the pods directly.</strong></em> <a href="https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/aks/configure-kubenet.md#virtual-network-peering-and-expressroute-connections" rel="nofollow noreferrer">Refer</a></p>
<p><img src="https://i.imgur.com/GZVumUM.png" alt="enter image description here" /></p>
<ul>
<li>You can use AKS's advanced features such as virtual nodes or Azure Network Policy. Use  <a href="https://docs.projectcalico.org/v3.9/security/calico-network-policy" rel="nofollow noreferrer">Calico network policies</a>. network policy allows an traffic between pods within a cluster and communicated</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: backend-policy
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
</code></pre>
<p><img src="https://i.imgur.com/OawP8Dy.png" alt="enter image description here" /></p>
<p>To more in detail <em><strong>refer</strong></em> this link:</p>
<p><a href="https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/aks/configure-kubenet.md" rel="nofollow noreferrer">Azure configure-kubenet - GitHub</a></p>
<p><a href="https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-network" rel="nofollow noreferrer">Network connectivity and secure in  Azure Kubernetes Service | Microsoft</a></p>
