amargherio / aks-egress-checker

A container image used to validate required egress connectivity in AKS!

AKS network egress checker

What it does

This application loads in a set of required egress definitions for AKS and tests egress connectivity to them from within your cluster!

Egress connectivity is a common support topic for AKS - especially when the network path has route tables, default routes, network security groups, and firewalls or NVAs in play. It's easy to have an oversight where rules are changed in one place but the team responsible for managing AKS clusters isn't aware of the change.

By setting up the YAML with the correct parameters and a list of egress groups to test for, you can continually validate that your cluster is in compliance with the required egress for a given configuration.

Building from source

I provide some pre-built container images that can be used for deployments. If you'd rather build the image with less dependencies or a different base (Ubuntu Jammy is where it's at here), you can clone this repo, change the images used in the Dockerfile (including the Rust builder image if you're adventurous) and build new images to push as you please!

The current supported architecture for the Rust binary is linux_amd64 but building multi-arch binaries is on the roadmap at some point (along with the correct container images for non-x86_64 architectures).

Egress support

Egress Group	Network/Application?	Required or optional?	Check status	All egress checked?
Azure Global	Network	Required	Enabled	Partial
Azure Global	Application	Required	Enabled	Partial
Azure Global	Application	Optional	Enabled	Full coverage
Azure China 21Vianet	Network	Optional	Disabled	Partial
Azure China 21Vianet	Application	Optional	Disabled	Partial
Azure US Government	Network	Optional	Enabled	Partial
Azure US Government	Application	Optional	Enabled	Partial
AKS Node OS updates	Application	Optional	Enabled	Partial
GPU-enabled clusters	Application	Optional	Enabled	Full coverage
Windows Server	Application	Optional	Enabled	Partial
Microsoft Defender	Application	Optional	Enabled	Partial
Azure Monitor	Network	Optional	Enabled	Partial
Azure Monitor	Application	Optional	Enabled	Partial
Azure Policy	Application	Optional	Enabled	Partial
Azure Policy 21Vianet	Application	Optional	Enabled	Partial
Azure Policy US Gov	Application	Optional	Enabled	Partial
AKS Cluster Extensions	Application	Optional	Enabled	Partial
AKS Cluster Extensions US Gov	Application	Optional	Enabled	Partial

Interested in contributing?

See the contributor's guide for information!

aks-egress-checker's Issues

Threading performance improvements

Based on the outcome and findings of #2 there's potential room for performance improvement. I'm not sure if adding explicit threads or running more egress group checks in parallel would improve execution times, but it's something to audit.

Unwrap and clone usage

There's currently a lot of .unwrap() calls that would end up killing an execution of the checker - those need to be addressed and handled more appropriately.

Clone is also used quite a bit to handle passing data between async functions - maybe a mutex/Arc is the more appropriate way to handle this but I shouldn't be cloning large objects without some solid justification.

Profiling and performance optimization

This shouldn't require a ton of resources to run, but there needs to be a better understanding on resource utilization and performance. Specifically...

• Network IO
• CPU utilization
• Any disk IO or space requirements
• Memory utilization

Disk IO and space requirements should be minimal - in the containerized form, it's mostly log output.

Memory is a bit trickier since the parsed egress requirements are all stored in memory along with test results prior to generating output - this could be significant enough to account for.

CPU utilization - not sure what to expect here.

Replatform container images onto Mariner

Microsoft support for Mariner is huge and this should leverage that support.

The builder image may have to be customized to run Rust, but the deployable image's base is a pretty insignificant change.

Improve test coverage

There's no test coverage and that needs to change. Tests are needed for at least the egress data parsing and the FQDN parsing/building logic to make sure that's all solid.

There's some tricky bits here around mocking IMDS responses and calls for region and VM data that's used for building some connection strings.