Firewall ports to be opened as part of Keda Deployment

[nidiculageorge]

Hi Team,

We need to identify which all ports and URLS need to be allowed in our azure firewall for Keda to communicate outside.

Could you please share the details of firewall URLS and Ports to be whitelisted in our azure firewall

[tomkerkhove]

@ahmelsayed @zroubalik Can you help on this?

I'll merge this in the docs afterwards

[ahmelsayed]

<-- originally posted on slack -->

How is it failing? are you getting a particular error?
egress from keda will depend on the triggers you have defined as it'll try to connect to each one you define. Some like SQL, redis, rabbitmq, etc specify their ports in the ScaledObject itself.

[nidiculageorge]

Hi @ahmelsayed

{"level":"info","ts":1614313669.8391643,"logger":"cmd","msg":"Go Version: go1.13.3"}
{"level":"info","ts":1614313669.8396757,"logger":"cmd","msg":"Go OS/Arch: linux/amd64"}
{"level":"info","ts":1614313669.8396797,"logger":"cmd","msg":"Version of operator-sdk: v0.11.0"}
{"level":"info","ts":1614313669.8396823,"logger":"cmd","msg":"Keda Commit: "}
{"level":"info","ts":1614313669.839852,"logger":"leader","msg":"Trying to become the leader."}
{"level":"error","ts":1614313669.8433106,"logger":"cmd","msg":"","error":"Get https://10.1.0.1:443/api?timeout=32s: EOF","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/go/pkg/mod/github.com/go-logr/[email protected]/zapr.go:128\nmain.main\n\tkeda/cmd/manager/main.go:89\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:203"}

When checked the logs for Keda we are getting the above error in Azure AKS .There is no triggers enabled as its just a keda pod thats running

[ahmelsayed]

I think that's the cluster's api-server. That's the only endpoint keda connects to on start up. I'm not very familiar with azure firewall, but I'd imagine there must be a way to allow pods to talk to the api server. Any operator would need that.

[nidiculageorge]

@ahmelsayed we havent added any restriction in the pods or namespace in which keda is deployed.Only Azure firewall is implemented in front of AKS with restriction in egress traffic and allowed the required rules for AKS to communicate outside.

For Keda is there any sepcific urls or ports to be allowed in Azure firewall

[anoopmash]

@ahmelsayed @tomkerkhove Thanks for the input.

[nidiculageorge]

@tomkerkhove @ahmelsayed

Thanks so much for the support. Issue has been resolved by adding a Network Rule in Azure firewall instead of Application Rule for API access.

(Source : AKS Subnet
Destination : AKS ClusterAPI Name
Port : 443)

Which removed the following error from the firewall

2/25/2021, 12:37:00.675 PM		N/A	N/A	Unknown Action	No rule matched	N/A	HTTPS request from 172.28.112.35:41380. Action: Deny. Reason: SNI TLS extension was missing.

[tomkerkhove]

Happy to help!

[tomkerkhove]

I'll try to update the docs asap.

[ahmelsayed]

Thanks Tom :)