agrajm

apiVersion: v1
kind: Service
metadata:
  name: spboot-svc
  namespace: spboot-app
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
  type: LoadBalancer
  selector:

agrajm

resource "azurerm_subnet" "akssubnet" {
  name = var.aks-subnet-name
  ...
  
  lifecycle {
    ignore_changes = [enforce_private_link_endpoint_network_policies]
  }
}

agrajm

  resource "azurerm_kubernetes_cluster" "aks" {
  ...
    
  network_profile {
    ...
    network_plugin = "azure"    # for Azure CNI 
    # Default value is LoadBalancer. Changed to userDefinedRouting to force all egress traffic through Firewall 
    outbound_type = "userDefinedRouting"
  }

agrajm

# Route table: UDR for AKS Subnet to force traffic via Firewall
resource "azurerm_route_table" "rt" {
  name                = var.rt_name
  location            = azurerm_resource_group.core.location
  resource_group_name = azurerm_resource_group.core.name
  disable_bgp_route_propagation = false

  route {
    name                   = "kubenetfw_fw_r"
    address_prefix         = "0.0.0.0/0"

agrajm

apiVersion: v1
kind: Pod
metadata:
  name: dnsutils
  namespace: default
spec:
  containers:
    - name: dnsutils
      image: gcr.io/kubernetes-e2e-test-images/dnsutils:1.3
      command:

agrajm

# Private Endpoint
resource "azurerm_private_endpoint" "sqlplink" {
  name                = "pe-sql-spboot"
  location            = azurerm_resource_group.core.location
  resource_group_name = azurerm_resource_group.core.name
  subnet_id           = azurerm_subnet.privateepsubnet.id

  private_service_connection {
    name                           = "sqlprivatelink"
    is_manual_connection           = "false"

agrajm

apiVersion: v1
kind: Pod
metadata:
  name: nginx-unprivileged
spec:
  containers:
    - name: nginx-unprivileged
      image: mcr.microsoft.com/oss/nginx/nginx:1.15.5-alpine

agrajm

apiVersion: v1
kind: Pod
metadata:
  name: nginx-privileged
spec:
  containers:
    - name: nginx-privileged
      image: mcr.microsoft.com/oss/nginx/nginx:1.15.5-alpine
      securityContext:
        privileged: true

agrajm

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAzureContainerNoPrivilege
metadata:
  name: container-no-privilege
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]

agrajm

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sazurecontainernoprivilege
spec:
  crd:
    spec:
      names:
        kind: K8sAzureContainerNoPrivilege
        listKind: K8sAzureContainerNoPrivilegeList