|
| 1 | +############################################## |
| 2 | +# Script to sync Azure Firewall DNAT rules |
| 3 | +# to AKS services exposed via an Internal |
| 4 | +# Azure Load Balancer. |
| 5 | +# |
| 6 | +# Jose Moreno, 2025 |
| 7 | +############################################## |
| 8 | + |
| 9 | + |
| 10 | +# Constants - consider moving some of these to parameters |
| 11 | +$resourceGroup = "akstest" |
| 12 | +$aksName = "aks" |
| 13 | +$azfwPolicyResourceGroup = "akstest" |
| 14 | +$azfwPolicyName = "myazfwpolicy" |
| 15 | +$azfwRCG = "DNAT_rcg" |
| 16 | +$azfwRC = "DNAT-rc" |
| 17 | +$azfwPublicIP = "1.2.3.4" |
| 18 | +$ruleSuffixLength = 5 |
| 19 | +$randomCharacters = 'abcdefghijklmnopqrstuvwxyz0123456789'.ToCharArray() |
| 20 | + |
| 21 | +# Ensures you do not inherit an AzContext in your runbook |
| 22 | +$null = Disable-AzContextAutosave -Scope Process |
| 23 | +# Connect using a Managed Service Identity |
| 24 | +try { |
| 25 | + Write-Output "Authenticating to Azure..." |
| 26 | + Connect-AzAccount -Identity |
| 27 | +} |
| 28 | +catch { |
| 29 | + Write-Output "There is no system-assigned user identity. Aborting." |
| 30 | + exit |
| 31 | +} |
| 32 | + |
| 33 | +########################### |
| 34 | +# START # |
| 35 | +########################### |
| 36 | + |
| 37 | +# Getting AKS information about the node RG and the load balancer |
| 38 | +try { |
| 39 | + $aks = Get-AzAksCluster -Name $aksName -ResourceGroupName $resourceGroup |
| 40 | + if ($null -ne $aks.Name) { |
| 41 | + Write-Output "AKS cluster $($aks.Name) found successfully in resource group $($resourceGroup)." |
| 42 | + } |
| 43 | + else { |
| 44 | + Write-Output "AKS cluster $($aksName) could not be found, aborting" |
| 45 | + exit |
| 46 | + } |
| 47 | +} |
| 48 | +catch { |
| 49 | + Write-Output "AKS cluster $($aksName) could not be found, aborting" |
| 50 | + exit |
| 51 | +} |
| 52 | +$aksALBs = Get-AzLoadBalancer -resourcegroup $aks.NodeResourceGroup |
| 53 | +Write-Output "$($aksALBs.Length) Load Balancers found in node resource group $($aks.NodeResourceGroup)." |
| 54 | +# Make sure the Azure Firewall policy and the RCG/RC exist |
| 55 | +try { |
| 56 | + $policy = Get-AzFirewallPolicy -Name $azfwPolicyName -ResourceGroupName $azfwPolicyResourceGroup |
| 57 | + if ($null -ne $policy.Name) { |
| 58 | + Write-Output "Azure Firewall Policy $($policy.Name) found successfully in resource group $($azfwPolicyResourceGroup)." |
| 59 | + } |
| 60 | + else { |
| 61 | + Write-Output "Azure Firewall Policy $($azfwPolicyName) could not be found in resource group $($azfwPolicyResourceGroup), aborting" |
| 62 | + exit |
| 63 | + } |
| 64 | +} |
| 65 | +catch { |
| 66 | + Write-Output "Azure Firewall Policy $($azfwPolicyName) could not be found in resource group $($azfwPolicyResourceGroup), aborting" |
| 67 | + exit |
| 68 | +} |
| 69 | +try { |
| 70 | + $rcg = Get-AzFirewallPolicyRuleCollectionGroup -Name $azfwRCG -AzureFirewallPolicyName $azfwPolicyName -ResourceGroupName $azfwPolicyResourceGroup |
| 71 | + if ($null -ne $rcg.Name) { |
| 72 | + Write-Output "Rule Collection Group $($rcg.Name) in Azure Firewall Policy $($policy.Name) found successfully." |
| 73 | + } |
| 74 | + else { |
| 75 | + Write-Output "Rule Collection Group $($azfwRCG) could not be found in Azure Policy $($azfwPolicyName), aborting" |
| 76 | + exit |
| 77 | + } |
| 78 | +} |
| 79 | +catch { |
| 80 | + Write-Output "Rule Collection Group $($azfwRCG) could not be found in Azure Policy $($azfwPolicyName), aborting" |
| 81 | + exit |
| 82 | +} |
| 83 | +try { |
| 84 | + $rc = $rcg.properties.GetRuleCollectionByName($azfwRC) |
| 85 | + Write-Output "Rule Collection $($rc.Name) in RCG $($rcg.Name) in Azure Firewall Policy $($policy.Name) found successfully with $($rc.Rules.Length) existing rules." |
| 86 | +} |
| 87 | +catch { |
| 88 | + Write-Output "Rule Collection $($azfwRC) could not be found in Rule Collection Group $($azfwRCG) in Azure Policy $($azfwPolicyName), aborting" |
| 89 | + exit |
| 90 | +} |
| 91 | +$azfwRules = $rc.Rules |
| 92 | +# Process the ALBs found in the node resource group |
| 93 | +$ALBrules = @() |
| 94 | +$ALBIPAddress = "" |
| 95 | +foreach ($ALB in $aksALBs) { |
| 96 | + if ($ALB.Name -eq "kube-apiserver") { |
| 97 | + Write-Output "System ALB $($ALB.Name) found in node resource group $($aks.NodeResourceGroup), skipping" |
| 98 | + } |
| 99 | + elseif ($null -ne $ALB.FrontendIpConfigurations[0].PrivateIpAddress) { |
| 100 | + $ALBIPAddress = $ALB.FrontendIpConfigurations[0].PrivateIpAddress |
| 101 | + Write-Output "Internal ALB $($ALB.Name) found in node resource group $($aks.NodeResourceGroup) with private IP address $($ALBIPAddress), processing rules..." |
| 102 | + $ALBrules = $ALB.LoadBalancingRules |
| 103 | + foreach ($rule in $ALBrules) { |
| 104 | + # Find the frontend IP for the rule |
| 105 | + $FrontendConfigFound = $false |
| 106 | + $FrontendIP = "" |
| 107 | + foreach ($FrontendIPConfig in $ALB.FrontendIpConfigurations) { |
| 108 | + if ($FrontendIPConfig.Id -eq $rule.FrontendIPConfiguration.Id) { |
| 109 | + $FrontendIP = $FrontendIPConfig.PrivateIpAddress |
| 110 | + $FrontendConfigFound = $true |
| 111 | + } |
| 112 | + } |
| 113 | + # Output |
| 114 | + if ($FrontendConfigFound) { |
| 115 | + Write-Output "Rule $($rule.Name) found, frontend IP is $($FrontendIP), frontend port is $($rule.FrontendPort)." |
| 116 | + # Look for an existing rule in the firewall's RC matching this ALB rule |
| 117 | + $ruleMatchFound = $false |
| 118 | + foreach ($azfwRule in $azfwRules) { |
| 119 | + if ($azfwRule.TranslatedPort -eq $rule.FrontendPort -And $azfwRule.TranslatedAddress -eq $FrontendIP) { |
| 120 | + $ruleMatchFound = $true |
| 121 | + Write-Output "Found matching rule $($azfwRule.Name) in the Azure Firewall rule collection." |
| 122 | + } |
| 123 | + } |
| 124 | + if (-Not $ruleMatchFound) { |
| 125 | + # DestinationPort = TranslatedPort ? |
| 126 | + Write-Output ("Adding rule for $($FrontendIP):$($rule.FrontendPort), since no existing rule found in the firewall") |
| 127 | + $randomSuffix = -join ($randomCharacters | Get-Random -Count $ruleSuffixLength) |
| 128 | + $newrule = New-AzFirewallPolicyNatRule -Name $($rule.Name + '-' + $randomSuffix) -Protocol "TCP" -SourceAddress "*" -DestinationAddress $azfwPublicIP -DestinationPort $rule.FrontendPort -TranslatedAddress $FrontendIP -TranslatedPort $rule.FrontendPort |
| 129 | + $rc.Rules.Add($newrule) |
| 130 | + Write-Output "Rule collection now has $($rc.Rules.Length.Length) rules." # For some reason the .Rules property is not a flat array |
| 131 | + } |
| 132 | + } |
| 133 | + else { |
| 134 | + Write-Output "Could not find frontend IP address for rule $($rule.Name), skipping." |
| 135 | + } |
| 136 | + } |
| 137 | + } else { |
| 138 | + Write-Output "Public ALB ${$ALB.Name} found in node resource group $($aks.NodeResourceGroup), skippping." |
| 139 | + } |
| 140 | +} |
| 141 | +# Go over the Firewall DNAT rules and remove anything that is not in the ALB rules |
| 142 | +$rulesToRemove = @() |
| 143 | +foreach ($azfwRule in $azfwRules) { |
| 144 | + $ruleMatchFound = $false |
| 145 | + Write-Output "Verifying whether Azure Firewall Rule $($azfwRule.Name) ($($azfwRule.TranslatedAddress):$($azfwRule.TranslatedPort)) has a corresponding rule in the AKS Load Balancer" |
| 146 | + foreach ($albRule in $ALBrules) { |
| 147 | + # Find the frontend IP for the rule |
| 148 | + $FrontendConfigFound = $false |
| 149 | + $FrontendIP = "" |
| 150 | + foreach ($FrontendIPConfig in $ALB.FrontendIpConfigurations) { |
| 151 | + if ($FrontendIPConfig.Id -eq $albRule.FrontendIPConfiguration.Id) { |
| 152 | + $FrontendIP = $FrontendIPConfig.PrivateIpAddress |
| 153 | + $FrontendConfigFound = $true |
| 154 | + } |
| 155 | + } |
| 156 | + if ($FrontendConfigFound) { |
| 157 | + if ($azfwRule.TranslatedPort -eq $albRule.FrontendPort -And $azfwRule.TranslatedAddress -eq $FrontendIP) { |
| 158 | + $ruleMatchFound = $true |
| 159 | + Write-Output "Found matching rule $($albRule.Name) ($($FrontendIP):$($albRule.FrontendPort)) in the Azure Load Balancer." |
| 160 | + } else { |
| 161 | + Write-Output "No match for ALB rule $($albRule.Name) ($($FrontendIP):$($albRule.FrontendPort))" |
| 162 | + } |
| 163 | + } else { |
| 164 | + Write-Output "Could not find frontend IP address for rule $($albRule.Name), skipping." |
| 165 | + } |
| 166 | + } |
| 167 | + if (-Not $ruleMatchFound) { |
| 168 | + Write-Output ("Removing rule $($azfwRule.Name) from rule collection, since no matching rule found in the AKS Load Balancer.") |
| 169 | + $rulesToRemove += $azfwRule.Name |
| 170 | + } |
| 171 | + else { |
| 172 | + Write-Output "Keeping rule $($azfwRule.Name), since a corresponding rule exists in the AKS Load Balancer." |
| 173 | + } |
| 174 | +} |
| 175 | +foreach ($rule in $rulesToRemove) { |
| 176 | + $rc.RemoveRuleByName($rule) |
| 177 | +} |
| 178 | +Write-Output "Rule collection now has $($rc.Rules.Length.Length) rules." |
| 179 | +# Apply changes |
| 180 | +try { |
| 181 | + Set-AzFirewallPolicyRuleCollectionGroup -Name $azfwRCG -FirewallPolicyObject $policy -Priority $rcg.Properties.Priority -RuleCollection $rc |
| 182 | + Write-Output "Firewall policy updated successfully." |
| 183 | +} catch { |
| 184 | + Write-Error "Failed to update firewall policy: $($_.Exception.Message)" |
| 185 | +} |
| 186 | + |
0 commit comments