<p>I have created an Ingress service that forwards TCP port 22 to a service in my cluster. As is, every inbound traffic is allowed.</p>

<p>What I would like to know is if it is possible to define NSG rules to prevent access to a certain subnet only. I was able to define that rule using the Azure interface. However, every time that Ingress service is edited, those Network Security Group rules get reverted.</p>

<p>Thanks!</p>

morka
<p>I think there would be some misunderstanding about the NSG in AKS. So first let us take a look at the network of the AKS, Kubernetes uses Services to logically group a set of pods together and provide network connectivity. See the <a href="https://learn.microsoft.com/en-us/azure/aks/concepts-network#services" rel="nofollow noreferrer">AKS Service</a> for more details. And when you create services, the Azure platform automatically configures any network security group rules that are needed.</p>

<blockquote>
  <p>Don't manually configure network security group rules to filter
  traffic for pods in an AKS cluster.</p>
</blockquote>

<p>See <a href="https://learn.microsoft.com/en-us/azure/aks/concepts-network#network-security-groups" rel="nofollow noreferrer">NSG in AKS</a> for more details. So in this situation, you do not need to manage the rule in the NSG manually.</p>

<p>But don't worry, you can also manage the rules for your pods manually as you want. See <a href="https://learn.microsoft.com/en-us/azure/aks/use-network-policies" rel="nofollow noreferrer">Secure traffic between pods using network policies in Azure Kubernetes Service</a>. You can install the Calico network policy engine and create Kubernetes network policies to control the flow of traffic between pods in AKS. Although it just is the preview version, it also can help you with what you want. But remember, the Network policy can only be enabled when the cluster is created.</p>
