Add some additional required nsgs for AKS functioning

Author: craddm

infra/aks-post-deployment/components/network_security_rules.py

@@ -169,6 +169,18 @@ def __init__(
                 destination_address_prefix=isolated_cluster_k8s_api_ip,
                 description="Allow k8s API access from access cluster API Proxy",
             ),
+            network.SecurityRuleArgs(
+                name="AllowAzureLoadBalancerInbound",
+                priority=400,
+                direction=network.SecurityRuleDirection.INBOUND,
+                access=network.SecurityRuleAccess.ALLOW,
+                protocol=network.SecurityRuleProtocol.ASTERISK,
+                source_port_range="*",
+                destination_port_range="*",
+                source_address_prefix="AzureLoadBalancer",
+                destination_address_prefix="*",
+                description="Allow Azure Load Balancer health probes",
+            ),
             network.SecurityRuleArgs(
                 name="DenyAccessVNetInBound",
                 priority=2000,
@@ -197,6 +209,66 @@ def __init__(
                 source_address_prefix=isolated_nodes_subnet_cidr,
                 destination_address_prefix=args.stack_outputs.harbor_ip_address,
             ),
+            network.SecurityRuleArgs(
+                name="AllowAzureFrontDoorOutBound",
+                priority=110,
+                direction=network.SecurityRuleDirection.OUTBOUND,
+                access=network.SecurityRuleAccess.ALLOW,
+                protocol=network.SecurityRuleProtocol.TCP,
+                source_port_range="*",
+                destination_port_range="443",
+                source_address_prefix=isolated_nodes_subnet_cidr,
+                destination_address_prefix="AzureFrontDoor.FirstParty",
+                description="Allow access to Azure Front Door, needed for node bootstrapping",
+            ),
+            # network.SecurityRuleArgs(
+            #     name="AllowNodesOutboundToSLB",
+            #     priority=140,
+            #     direction=network.SecurityRuleDirection.OUTBOUND,
+            #     access=network.SecurityRuleAccess.ALLOW,
+            #     protocol=network.SecurityRuleProtocol.TCP,
+            #     source_address_prefix=isolated_nodes_subnet_cidr,
+            #     destination_address_prefix="AzureLoadBalancer",
+            #     source_port_range="*",
+            #     destination_port_range="*",
+            #     description="Allow nodes to reach Azure Load Balancer",
+            # ),
+            network.SecurityRuleArgs(
+                name="AllowAccessToAzureFrontDoorOutbound",
+                priority=150,
+                direction=network.SecurityRuleDirection.OUTBOUND,
+                access=network.SecurityRuleAccess.ALLOW,
+                protocol=network.SecurityRuleProtocol.TCP,
+                source_address_prefix=isolated_nodes_subnet_cidr,
+                destination_address_prefix="AzureFrontDoor.Frontend",
+                source_port_range="*",
+                destination_port_range="443",
+                description="Allow nodes to reach required Microsoft Endpoints",
+            ),
+            network.SecurityRuleArgs(
+                name="AllowAccessToAzureCloudOutbound",
+                priority=160,
+                direction=network.SecurityRuleDirection.OUTBOUND,
+                access=network.SecurityRuleAccess.ALLOW,
+                protocol=network.SecurityRuleProtocol.TCP,
+                source_address_prefix=isolated_nodes_subnet_cidr,
+                destination_address_prefix="AzureCloud",
+                source_port_range="*",
+                destination_port_range="443",
+                description="Allow nodes to reach required Microsoft Endpoints",
+            ),
+            # network.SecurityRuleArgs(
+            #     name="AllowAccessToAzureContainerRegistryOutbound",
+            #     priority=160,
+            #     direction=network.SecurityRuleDirection.OUTBOUND,
+            #     access=network.SecurityRuleAccess.ALLOW,
+            #     protocol=network.SecurityRuleProtocol.TCP,
+            #     source_address_prefix=isolated_nodes_subnet_cidr,
+            #     destination_address_prefix="MicrosoftContainerRegistry",
+            #     source_port_range="*",
+            #     destination_port_range="443",
+            #     description="Allow nodes to reach required Microsoft Container Registry, necessary for system images",
+            # ),
             network.SecurityRuleArgs(
                 name="AllowAccessToStorageOutbound",
                 priority=200,