Secure an AKS Cluster
Learn how Panorama can secure inbound traffic to an AKS
cluster.
To enable Panorama to connect to the load
balancers in an Azure Kubernetes Services (AKS) cluster, you must
enable the Azure plugin on Panorama to establish a connection with
your AKS cluster. Then, you must configure the device groups and templates
to which the firewalls belong so that Panorama can push configuration objects
and policy rules to your managed firewalls.
Before You Begin
To secure AKS you must first deploy the Azure Auto Scaling solution
available on GitHub.
- You must have AKS advanced networking to use the Palo Alto Networks AKS template.
- Design your AKS subnetsbeforeyou deploy AKS clusters. Review A Sample Hub-and-Spoke Topology to Secure AKS Clusters, and AKS Cluster Communication.
- The template creates a single AKS cluster (Service) as a sample. You must specify CIDR ranges for the VNet, VNet subnet, and the service. The CIDR ranges must not overlap
- Size your subnets to your requirements. Avoid unnecessarily large ranges, as they can affect performance.
- See User-Defined Routing. Specify specific UDR routes rather than broad subnet-specific routes.
- Plan how you want to peer your VNets. If you are peering AKS clusters, be sure you have read AKS Cluster Communication.
- Think about the ways in which you want to identify traffic.
- If you plan to use an address group on Outbound AKS traffic, see Add the Subnet Address Group to the Top-Level Policy.
- If you have service names or tags that are not unique across namespaces, use the label selector to filter both a tag and a namespace so that you get a unique result.
Use the Template to Deploy an AKS Cluster
The Azure AKS template is a sample that provisions
a cluster in a new VNet.
- On GitHub, go to PaloAltoNetworks/azure-aks and locate the build package in the repository.
- Unzip the build package. Edit the filesazuredeploy.jsonandparameters.jsonfor your own deployment, and save.
- Issue the following Azure CLI commands to deploy the template.az group deployment validate --resource-group RG_NAME --template-file azuredeploy.json --parameters @parameters.jsonaz group deployment create --name DEPLOYMENT_NAME --resource-group RG_NAME --template-file azuredeploy.json --parameters @parameters.json
- Deploy your applications or services on the AKS Cluster.
- Annotate your service YAML file so that the type is load balancer, and annotate it as service.beta.kubernetes.io/azure-load-balancer-internal: "true". For example:apiVersion: v1kind: Servicemetadata: name: azure-vote-front labels: service: "azure-vote-front" tier: "stagingapp"annotations: service.beta.kubernetes.io/azure-load-balancer-internal: "true"spec:type: LoadBalancerports: - port: 80 selector: app: azure-vote-front
- If you have not done so, create AKS cluster authentication before continuing.
- Deploy your service on your AKS cluster.For example, you can deploy your application through kubectl:kubectl apply -f myapplication.yaml
- Use kubectl to get the service IP for the deployed service.kubectl get services -o wideIn the EXTERNAL-IP column 10.240.0.97 is for the ILB, according to your annotation in Step a. Use the service IP to create a user defined route on Azure.
- Create a UDR rule to point your service to the Firewall ILB behind the Application Gateway.In Azure, go to your inbound spoke resource group, view the route table and add a new route based on the destination service IP. In the following screen, the value in the tov1serviceADDRESS PREFIXcolumn is the service IP.
Connect the AKS Cluster in Azure Plugin for Panorama
This task assumes you have deployed a Panorama orchestrated
deployment, and that you have created templates, template stacks and device groups.
See
the Panorama online help for more on filling out each form.
- Selectto view the monitoring definition you created when you configured the deployment. As shown below, ifPanoramaAzureDeploymentsAuto Program Routesis enabled, the firewall routes are programmed for you.
- In AKS, tag your Resource Groups. The tags are name/value pairs.
- Selectand choose a resource group.HomeResource groups
- SelectTagsand define name/value pairs. As shown in the following figure, the tag names must be inboundgrouprg and HubRG:
- inboundgrouprg—your spoke resource group name
- HubRG—your hub resource group name
The template takes the name of the Spoke resource group as a parameter, and tags the VNet and AKS cluster with the Spoke resource group name so that it can be discovered by the Panorama plugin for Azure.
The templates deploy resources in separate VNets. If you manually deploy the AKS cluster and service in the same VNet as the Spoke firewall set, you must manually create tags for the spoke resource group name. - In Panorama, selectPanoramaAzureSetup.
- On theGeneraltab, enable monitoring.
- On theNotify Groupstab,Adda notification group and select the device groups to be notified.
- On theService Principaltab,AddandValidatea service principal.Use the Service Principal you created for the orchestrated deployment.
- On theAKS Clustertab,Addan AKS cluster.
- Enter the exact name of the AKS cluster.
- Enter the API server address. To find the address in Azure, view your AKS service and select Overview.
- Upload the AKS credential JSON file (see Create AKS Cluster Authentication).
- Fill in the remaining fields andAddone or more tags.If you have service names or tags that are not unique across namespaces, use the label selector to filter both a tag and a namespace so that you get a unique result.
- SelectPanoramaAzureMonitoring Definition
- Add a Monitoring definition.
- Enter a name and description, and selectAKS Cluster Monitoring.
- Select anAKS Clusterand aNotify Group, checkEnable, and clickOK.
Set Up VNet Peering
If you plan to use an address
group to identify traffic, be sure to add the subnet address group to
your top-level Panorama plicy before you configure peering.
After
deploying an AKS cluster, set up VNet Peering from
the Inbound VNet to your cluster, and from your cluster to the Firewall
VNet.
Redirect Traffic to a Firewall ILB
You must manually create user defined routes
(UDRs) and routing rules to redirect traffic to a particular ILB.
For an example, see how the diagram in “How Does the Panorama Plugin for Azure Secure Kubernetes Services?” depicts
an inbound UDR.
- Create URL routing rules that redirect web traffic to the appropriate backend pool.
- Update the UDR rules for the application gateway subnet to add a route for the service CIDR, with the next hop being the Inbound Firewall Load Balancer from the Spoke firewall resource group.