How to create an AKS cluster where nodes don't have outbound internet access?

Hi Balraj Kumar,

1. Even if your nodes only "seem" to need to pull images and contact the API server, underneath AKS nodes also require connectivity to Azure-managed control plane services for:

Health reporting (node heartbeat, kubelet telemetry)

Managed identity tokens acquisition (MSI endpoints hosted in Azure infra)

Cluster auto-upgrade checks

Node telemetry data pushing

Kubelet metrics ingestion

Azure CNI plugin communication (if you're using Azure CNI)

These services are bundled under the AzureKubernetesService service tag. Without it:

• Nodes can't start because their kubelet and agent processes can't complete initialization or authenticate properly to Azure services.
• Even with private ACR and no storage, those core platform services are essential to run and manage AKS nodes.

2. In Network Isolated AKS:

The control plane is deployed inside a Microsoft-managed VNet peered with your VNet.

The necessary Azure services for kubelet, telemetry, MSI, etc., are privately accessible over Azure’s internal backbone network.

Instead of reaching the public endpoints covered by AzureKubernetesService, the required services are made available as private, internal services inside that peered control plane subnet.

So:

No outbound to public IP needed

Private endpoints + internal Azure peering cover all communication channels

That’s why it works even with NSG denying all outbound to internet

3. Unfortunately, no — not fully possible with public AKS today.

Public AKS:

Requires public AzureKubernetesService endpoints because Azure doesn’t expose those same control services as private endpoints for public clusters.

Your API server is public, and so its control plane dependencies remain public.

Even if you disable internet via NSG, you still need to allow outbound to the AzureKubernetesService service tag for those essential operations.

Workaround without Azure Firewall:

Use UserDefinedRouting + NAT Gateway to centralize outbound

Deny all other internet via NSG

Allow outbound:

To private ACR endpoints

To AzureKubernetesService service tag

You can run kubectl from your local PC since API server is public

This avoids Azure Firewall but still gives you controlled, minimal outbound to only what AKS needs.

Please refer the document below:

https://learn.microsoft.com/en-us/azure/aks/outbound-rules-control-egress

https://learn.microsoft.com/en-us/azure/aks/egress-outboundtype

https://learn.microsoft.com/en-us/azure/aks/network-isolated?pivots=aks-managed-acr

https://learn.microsoft.com/en-us/azure/aks/concepts-network-isolated

If you found information helpful, please click "Upvote" on the post to let us know.

If you have any further queries feel free to reach out us.

Thank You.

Just a minor question - the service tag AzureKubernetesService is not available in the NSG. Then how do I allow this specific tag?

Hi Balraj Kumar,

AzureKubernetesService is available, but it’s not listed as a commonly used service tag for general NSG rules (like AzureCloud). You need to create a custom network rule using this tag.

This tag is essential to allow traffic from your AKS nodes to the Kubernetes control plane. If your AKS cluster is private, the nodes still need access to the AKS control plane, and that requires this tag.

Steps to add the AzureKubernetesService tag:

You should add this rule to your Network Security Group (NSG) that's associated with your AKS node pool subnet or VNet to allow traffic from the AKS nodes to Microsoft-managed control plane endpoints.

az network nsg rule create \
  --resource-group <your-resource-group> \
  --nsg-name <your-nsg-name> \
  --name Allow-AKS-API-Server \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes AzureKubernetesService \
  --source-port-ranges '*' \
  --destination-address-prefixes '*' \
  --destination-port-ranges 443

This will allow communication from your AKS nodes to the Kubernetes API server hosted in Microsoft’s infrastructure.

Without the AzureKubernetesService tag, your AKS nodes won't be able to communicate with the managed control plane. Even with private clusters, the control plane is still hosted by Microsoft and outside your VNet, which is why this tag is needed for nodes to reach it.

Please refer the document below:

https://learn.microsoft.com/en-us/azure/aks/outbound-rules-control-egress

If you found information helpful, please click "Upvote" on the post to let us know.

If you have any further queries feel free to reach out us.

Thank You.

Hi @Pramidha Yathipathi

I understand your point and the need of the rule using AzureKubernetesService tag in the NSG. The problem is that I do not see this tag at all in the Service Tag dropdown menu while adding the custom rule in the Azure portal.

This link also does not mention the availability of this tag https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview

I also tried the cli command you shared and I get this error -

(SecurityRuleInvalidAddressPrefix) Security rule /subscriptions/......./Allow-AKS-API-Server has invalid Address prefix.

Value provided: AzureKubernetesService

Code: SecurityRuleInvalidAddressPrefix

As I understand, nodes need outbound access and AzureCloud service tag is not enough and AzureKubernetesService service tag is also needed (if configure via firewall). But AzureKubernetesService tag is not directly available for use in NSG. As per your recommendation, you are suggesting to use a NAT gateway and force all egress through the NAT gateway. Won't it allow all kinds of outbound via the NAT gateway? How are we blocking unnecessary extra outbound other than those that come under AzureCloud & AzureKubernetesService tags? I wanted to have nodes only minimum outbound access, just enough to function it properly and no extra outbound access.