Azure Kubernetes Service (AKS) / Azure DNS Private Resolver / VNet Peering: AKS cannot connect to resources in the peered VNet

Hello Le Van Khoa,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your AKS pods/nodes cannot connect to resources in the peered VNet, while ordinary VMs in the same AKS VNet can connect successfully.

The issue is that AKS traffic does not necessarily use the same source IP path as the working VM. Depending on the AKS network mode, traffic from pods to a peered VNet may appear as the AKS node subnet IP or as the pod subnet IP. Therefore, the target-side NSG, firewall, route table, private endpoint rules, or application allowlist must allow the actual AKS source, not only the subnet used by the successful test VM. - https://learn.microsoft.com/en-us/azure/aks/concepts-network-azure-cni-overlay, and https://learn.microsoft.com/en-us/azure/aks/concepts-network-cni-overview gives more insight.

What you can do to fix is to:

• Confirm the AKS network mode and identify whether the target should allow the AKS node subnet or pod subnet.
• Test DNS resolution from inside a pod, not only from a VM.
• If DNS fails, configure AKS CoreDNS to forward the private DNS zone to the Azure DNS Private Resolver inbound endpoint.
• If DNS resolves but connectivity fails, allow the AKS node subnet, and the pod subnet if using flat Azure CNI, on the target NSG/firewall/private endpoint path.
• Validate effective routes and NSG rules on the AKS node NIC and target-side subnet.
• Escalate to Azure Support via Azure portal or Priority Customer Support only if the configuration is correct and packet/DNS evidence shows platform-side failure.

After allowing the correct AKS source subnet and ensuring CoreDNS forwards the private namespace to the Azure DNS Private Resolver inbound endpoint, the AKS pods should resolve the private FQDN and connect to the private resource through the peered VNet without needing public access or unnecessary architecture changes. Azure DNS Private Resolver supports forwarding queries through inbound endpoints, and AKS CoreDNS customization is the supported way to add custom DNS forwarding for pods. - https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets, https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview, and https://learn.microsoft.com/en-us/azure/aks/coredns-custom.

Use the associated resource links above and below for more reading and steps:

• DNS in Azure Kubernetes Service
• Azure DNS Private Resolver endpoints and rulesets

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Hello @Le Van Khoa,

Thank you for using Q & A forum.

The Azure DNS Private Resolver must be accessible from the AKS subnet and properly linked to both VNets involved in the peering. You can verify this by checking the resolver’s configuration and ensuring it can resolve the names of resources in the peered VNet. Use commands like nslookup <hostname> to test DNS resolution from AKS nodes/pods.

Next, the network security groups (NSGs) associated with both the AKS VNet and the peered VNet. Make sure there are no NSG rules blocking traffic from AKS to the resources in the peered VNet. Sometimes, specific rules may inadvertently restrict access, leading to connectivity failures. You can review the NSG rules in the Azure portal to ensure that the necessary ports and protocols are allowed.

Lastly, remember that VNet peering allows for network-layer connectivity but does not automatically enable DNS name resolution. If the DNS settings are not configured correctly, AKS nodes/pods may struggle to resolve the private DNS names of resources in the peered VNet. Review the DNS configurations and ensure they are set up to facilitate name resolution across the peered VNets. Following these steps should help in diagnosing and resolving the connectivity issue.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.