<p>I'm working with Azure Kubernetes Service (AKS) and want to ensure that my network security is in line with industry standards and best practices. By default, AKS generates a set of network security group without specific rules, but I'd like to add additional rules to improve security.</p>
<p>What are the common security rules that should be added to AKS's default network security rules to enhance security and ensure compliance with industry standards? and any other best practices for securing an AKS cluster.</p>
<p>I'd appreciate any guidance or examples on how to implement these rules effectively within an AKS cluster.</p>
<p>Denying All Inbound by Default would block access to images' repositories.
Would you allow port 443 for image pull from Docker hub for example?</p>

cloudspawn
<p>You can add network security group to allow outbound traffic https 443 like below:</p>
<p><img src="https://i.imgur.com/tnACYeP.png" alt="enter image description here" /></p>
<p>You can allow traffic for SSH, HTTP, HTTPS, and other protocols that are required for your applications to function like below.</p>
<p><img src="https://i.imgur.com/jb99see.png" alt="enter image description here" /></p>
<p>In Aks cluster configuration under networking allow inbound traffic from specific Ip address. This will allow you to restrict access to your AKS cluster to specific clients, such as your on-premises network or other trusted Azure resources.</p>
<p><img src="https://i.imgur.com/y8EF2xs.png" alt="enter image description here" /></p>
<p>Deny all inbound traffic by default and only allow traffic that is explicitly required for your applications to function. This will prevent unauthorized access to your cluster.</p>
<p>Allowing port 443 for image pull from Docker hub, it is recommended to allow only the necessary ports and addresses required to control egress traffic in Kubernetes.</p>
<p><em><strong>Reference</strong></em>:</p>
<p><a href="https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/aks/outbound-rules-control-egress.md" rel="nofollow noreferrer">azure-docs/articles/aks/outbound-rules-control-egress.md at main · MicrosoftDocs/azure-docs · GitHub</a></p>
