Azure AKS connectivity to Data Centre over VPN

3/7/2018

I am building a Kubernetes Cluster on Azure (AKS). I have deployed it into a custom VNet using this document. By default, the VNet that gets created when AKS is provisioned is 10.0.0.0/8. All of our infrastructures are in 10.27.X.X space hence the need for the custom VNet.

As per the document the Custom VNet is created in a separate Resource Group, in our case Azure.Prod. In the same group, we have established the Virtual Network Gateway for the VPN back to our Data Centre.

Here is the details (obfuscated) of our config:

  • Resource group Azure.Prod
  • Resource group MC_Azure.Prod (created by AKS)
  • Virtual network 10.150.0.0/16 in Azure.Prod
  • Subnet 10.150.1.0/24
  • Virtual machine 10.150.1.4 in MC_Azure.Prod
  • Pod network 10.244.0.0/24
  • Data centre network 10.27.16.x/24

One of the containers needs to make a SQL Connection back to the Data Centre but it is failing. I am able to ping 10.150.1.4 from a machine in the data centre so have proved connectivity from DC to Azure.

I have added the following routes in the route table that was created by AKS, followed this article.

  • 10.27.16.0/24 > Virtual Network Gateway

On the machine in the Data Centre, I have created the following route

  • 10.244.0.0/24 > 10.27.16.3 (which is the GW on the DC NW, the device also terminates the VPN)

Any help appreciated!

-- B Buckland
azure
kubernetes
vpn

1 Answer

3/12/2018

Right, I finally got to the bottom of this, looks like the routes back to the data centre and also to the pods need to be replicated on the GatewaySubnet as well.

-- B Buckland
Source: StackOverflow