How to enable egress network policy for Windows Server 2022 pods?

Question

Hi,

Could you please help me out with the network policy configuration for Windows Server 2022 pods in AKS?

I followed the guide and all the steps listed here to no avail. https://learn.microsoft.com/en-us/azure/aks/use-network-policies#create-an-aks-cluster-with-azure-network-policy-manager-enabled---windows-server-2022-preview

The network policy that I used:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-instance-metadata
  namespace: default
spec:
  podSelector:
    matchLabels: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0 #Allow all other traffic 
        except:
        - 169.254.169.254/32 #Block metadata API

It works great on Linux pods but I struggle to make it work on Windows.

No matter what I tried so far I still can run

kubectl exec -it <windows-server-2022-pod> -n default -- powershell

and then get a successful response with all the data from this one

Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "http://169.254.169.254/metadata/instance?api-version=2021-02-01" | ConvertTo-Json -Depth 64

What could be the issue here?

Answer 1

Hi Nikita Krivets ,

Thanks for reaching out to Microsoft Q&A forum.

Based on your query stated above, you are using Azure Network Policy Manager for both Windows and Linux. Both platforms support ingress and egress policies, but the lack of certain features in Windows can lead to discrepancies.

In Linux : Azure NPM uses Linux Iptables to enforce network policies. This allows for a rich set of features, including complex rule definitions for both ingress and egress traffic.

In Windows : Azure Network Policy Manager(NPM) for Windows uses Host Network Service (HNS) ACL Policies. But, the limitations of HNS is as it does not support using CIDR blocks with exceptions (e.g., specifying a range of IPs while excluding certain addresses).

In Windows, below are the limitations of Azure NPM:

https://learn.microsoft.com/en-us/azure/aks/use-network-policies

To enforce egress network policy for Windows Server 2022 pods:

Define egress policies by using pod selectors instead of relying on CIDR ranges, particularly for Windows Server 2022 pods in Azure Kubernetes Service (AKS) with Azure Network Policy Manager (NPM) and HNS ACLs.

https://kubernetes.io/docs/concepts/services-networking/network-policies/

If the information is helpful, please consider by clicking the "Upvote".

If you have any further queries, please let us know we are glad to help you.

Answer 2

So essentially a solution would be to calculate all CIDR without a single IP and put them in the egress policy.