<p>One of the security warnings I have in Azure Advisor is:</p>
<blockquote>
<p>Authorized IP ranges should be defined on Kubernetes Services</p>
<p>Restrict access to the Kubernetes Service Management API by granting API access only to IP addresses in specific ranges. It is recommended to limit access to authorized IP ranges to ensure that only applications from allowed networks can access the cluster.</p>
</blockquote>
<p>Can read all about it here:</p>
<p><a href="https://learn.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges</a></p>
<p>The command to update an existing AKS cluster is the following:</p>
<pre><code>az aks update \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --api-server-authorized-ip-ranges  73.140.245.0/24
</code></pre>
<p>Or to remove any:</p>
<pre><code>az aks update \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --api-server-authorized-ip-ranges &quot;&quot;
</code></pre>
<p>Anyway, with this enabled, my deployment pipeline timesout because it can't connect to AKS. I've added the IP address that pops when it says it can't connect and still isn't able to connect.</p>
<p>So basically I'm relegated to removing the IP ranges when I need to run the pipeline and then adding it back on when it is done. Obviously not an ideal way of handling this.</p>
<p>How should I resolve this and does Azure have a more elegant way of whitelisting the IP from the pipeline in AKS?</p>

cjones
<p>Shiraz got me going in the right direction.</p>
<p>However, the only relevant part is this part:</p>
<p><a href="https://learn.microsoft.com/en-us/azure/devops/organizations/security/allow-list-ip-url?view=azure-devops#azure-pipelines-agents" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/devops/organizations/security/allow-list-ip-url?view=azure-devops#azure-pipelines-agents</a></p>
<p>Relevant being that my build and deployment agents are Microsoft hosted. The article Shiraz linked to primarily deals with on-premises Azure DevOps:</p>
<blockquote>
<p>Azure DevOps Services | Azure DevOps Server 2020 | Azure DevOps Server 2019 | TFS 2018 - TFS 2015</p>
</blockquote>
<p>At any rate, this is the relevant documentation for Microsoft hosted agents:</p>
<p><a href="https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=azure-devops&amp;tabs=yaml#networking" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=azure-devops&amp;tabs=yaml#networking</a></p>
<p>Basically, two options:</p>
<ol>
<li><p>Downloading the <a href="https://www.microsoft.com/en-us/download/details.aspx?id=56519" rel="nofollow noreferrer">weekly JSON Azure IP Ranges</a> and then adding every IP for your <em>geographic area</em> under the <code>AzureDevOps.{region}</code> sections. So if you are in the <code>CentralUS</code> region, it is not sufficient to just add that region. You have to add all the regions in the US because it could potentially us a different region when using the build and deployment agents.</p>
</li>
<li><p>Writing a simple program to parse the <code>json</code> file for you and gather all of the relevant IPs. The example the documentation uses:</p>
</li>
</ol>
<pre><code>using Newtonsoft.Json.Linq;
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;

namespace WeeklyFileIPRanges
{
    class Program
    {
        // Path to the locally saved weekly file
        const string weeklyFilePath = @&quot;C:\MyPath\ServiceTags_Public_20200504.json&quot;;

        static void Main(string[] args)
        {
            // United States geography has the following regions:
            // Central US, East US 2, East US, North Central US, 
            // South Central US, West Central US, West US, West US 2
            List&lt;string&gt; USGeographyRegions = new List&lt;string&gt;
            {
                &quot;centralus&quot;,
                &quot;eastus&quot;,
                &quot;eastus2&quot;,
                &quot;northcentralus&quot;,
                &quot;southcentralus&quot;,
                &quot;westcentralus&quot;,
                &quot;westus&quot;,
                &quot;westus2&quot;
            };

            // Load the weekly file
            JObject weeklyFile = JObject.Parse(File.ReadAllText(weeklyFilePath));
            JArray values = (JArray)weeklyFile[&quot;values&quot;];

            foreach (string region in USGeographyRegions)
            {
                string azureCloudRegion = $&quot;AzureCloud.{region}&quot;;
                Console.WriteLine(azureCloudRegion);

                var ipList =
                    from v in values
                    where (string)v[&quot;name&quot;] == azureCloudRegion
                    select v[&quot;properties&quot;][&quot;addressPrefixes&quot;];

                foreach (var ip in ipList.Children())
                {
                    Console.WriteLine(ip);
                }
            }
        }
    }
}
</code></pre>
<p>Then to add the IPs you would use something like:</p>
<pre><code>az aks update -g &lt;resource_group&gt; -n &lt;aks_deployment_name&gt; --api-server-authorized-ip-ranges [every,single,ip,address,for,the,geographic,area]
</code></pre>
<p>If anyone has a better way, I'll gladly accept that as the answer. There has to be one given that that is +1600 IPs for the US geo area and <code>--api-server-authorized-ip-ranges</code> will only take a maximum of 200.</p>
<p>At that point, it is just easier to erase the authorized IP addresses temporarily.</p>
<p>There is some promising stuff here though:</p>
<p><a href="https://stackoverflow.com/questions/53422395/how-to-get-the-ip-address-for-azure-devops-hosted-agents-to-add-to-the-white-lis">How to get the IP Address for Azure DevOps Hosted Agents to add to the white list</a></p>
