Reach an Azure VMs from a pod in Azure K8s cluster located in a different VNet

Question

I've a pod running an application that needs to connect to another Vm to download some files. The Vm and the Aks are on different VNets. I've already peered those VNets and the link seems connected. However, the communication still does not happen. Is there something else I should consider?

Additional Info:

• The network plugin is Azure CNI
• The cluster is not private for test purpose
• The NSGs have the default rules

Answer 1

When VMs and AKS cluster are in different VNets, Vnet peering is required, and you've already set up VNet peering.

Check the NSG rules applied to both the AKS subnet and the VM's subnet. Although you're using the default rules, ensure the NSG associated with the VM's subnet allows inbound ICMP traffic. By default, NSGs allow outbound ICMP but may block inbound ICMP. You'll need to add an inbound security rule to allow ICMP (protocol number 1) from the AKS subnet.

But I have a strong feeling your VM's firewall is the main root cause for connection failure. Check the firewall settings within the VM to ensure that it is turned off.

Here, I deployed a storefront app on my aks and as you can see pods are up

and the app is accessible.

So, if your AKS cluster is in one VNet (let's call it VNet A), and your VM is in another VNet (VNet B), they will not be able to communicate by default, because these are separate network segments within Azure.

To enable communication between them, you would set up VNet peering between VNet A and VNet B.

This would allow resources, like your AKS pods and VM, to communicate across the VNets which I did as shown above and disabled the internal firewall inside the VM and now both pod and vm is able to communicate with each other as you can see below-

So three things-

• vnet peering
• check nsg rules allowed or not
• disable firewall inside vm

Reference-

• https://learn.microsoft.com/en-us/azure/aks/use-network-policies#network-policy-options-in-aks

• https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal

• https://support.microsoft.com/en-us/windows/turn-microsoft-defender-firewall-on-or-off-ec0844f7-aebd-0583-67fe-601ecf5d774f