Network setup for accessing Azure Redis service from Azure AKS

2
votes

We have an application that runs on an Ubuntu VM. This application connects to Azure Redis, Azure Postgres and Azure CosmosDB(mongoDB) services.

I am currently working on moving this application to Azure AKS and intend to access all the above services from the cluster. The services will continue to be external and will not reside inside the cluster.

I am trying to understand how the network/firewall of both the services and aks should be configured so that pods inside the cluster can access the above services or any Azure service in general.

I tried the following:

  • Created a configMap containing the connection params(public ip/address, username/pwd, port, etc) of all the services and used this configMap in the deployment resource.
  • Hardcoded the connection params of all the services as env vars inside the container image
  • In the firewall/inbound rules of the services, I added the AKS API ip, individual node ips

None of the above worked. Did I miss anything? What else should be configured?

I tested the setup locally on minikube with all the services running on my local machine and it worked fine.

2
azurekubernetesazure-aks

2 Answers

1
votes

I am currently working on moving this application to Azure AKS and intend to access all the above services from the cluster.

I assume that you would like to make all services to access each other and all the services are in AKS cluster? If so, I advise you configure the internal load balancer in AKS cluster.

Internal load balancing makes a Kubernetes service accessible to applications running in the same virtual network as the Kubernetes cluster.

You can take a try and follow the following document: Use an internal load balancer with Azure Kubernetes Service (AKS). In the end, good luck to you!

0
votes

Outbound traffic in azure is SNAT-translated as stated in this article. If you already have a service in your AKS cluster, the outbound connection from all pods in your cluster will come thru the first LoadBalancer type service IP; I strongly suggest you create one for the sole purpose to have a consistent outbound IP. You can also pre-create a Public IP and use it as stated in this article using the LoadBalancerIP spec.

On a side note, rather than a ConfigMap, due to the sensitiveness of the connection string, I'd suggest you create a Secret and pass that down to your Deployment to be mounted or exported as environment variable.