<p>We have a request to expose certain pods in an AKS environment to the internet for 3rd party use.</p>
<p>Currently we have a private AKS cluster with a managed standard SKU load balancer in front using the advanced azure networking (basically Calico) where each Pod gets its own private IP from the Vnet IP space. All private IPs currently route through a firewall via user defined route in order to reach the internet, and vice versa. Traffic between on prem routes over a VPN connection through the azure virtual wan. I don’t want to change any existing routing behavior unless 100% necessary.</p>
<p>My question is, how do you expose an existing private AKS cluster’s specific Pods to be accessible from the internet? The entire cluster does not need to be exposed to the internet. The issue I foresee is the ephemeral Pods and ever changing IPs making simple NATing in the firewalls not an option. I’ve also thought about simply making a new AKS cluster with a public load balancer. The issue here though is security as it must still go through the firewalls and likely could with existing user defined routes</p>
<p>What is the recommended way to setup the architecture where certain Pods in AKS can be accessible over the internet, while still allowing those Pods to access the Pods over the private network. I want to avoid exposing all Pods to the internet</p>

dcvl
<p>There are a couple of options that you can use in order to expose your application to</p>
<p>outside your network, such as: Service:</p>
<blockquote>
<ul>
<li><p><a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer"><code>NodePort</code></a>: Exposes the Service on each Node’s IP at a static port (the  <code>NodePort</code>). A  <code>ClusterIP</code>  Service, to which the  <code>NodePort</code>  Service routes, is automatically created. You’ll be able to contact the  <code>NodePort</code>  Service, from outside the cluster, by requesting  <code>&lt;NodeIP&gt;:&lt;NodePort&gt;</code>.</p>
</li>
<li><p><a href="https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer" rel="nofollow noreferrer"><code>LoadBalancer</code></a>: Exposes the Service externally using a cloud provider’s load balancer.  <code>NodePort</code>  and  <code>ClusterIP</code>  Services, to which the external load balancer routes, are automatically created.</p>
</li>
</ul>
</blockquote>
<p>Also, there is another option that is use an <strong><code>ingress</code></strong>, IMO this is the best way to expose HTTP applications externally, because it's possible to create rules by path and host, and gives you much more flexibility than services. For ingress <strong>only</strong> HTTP/HTTPS is supported, if you need TCP then go to Services</p>
<p>I'd recommend you take a look in this links to understand in deep how services and ingress works:</p>
<p><a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">Kubernetes Services</a></p>
<p><a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Kubernetes Ingress</a></p>
<p><a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">NGINX Ingress</a></p>
<p><a href="https://learn.microsoft.com/en-us/azure/aks/concepts-network" rel="nofollow noreferrer">AKS network concepts</a></p>
