Microsoft’s Azure Container Networking team is excited to announce new enhancements to Advanced Container Networking Services. Following the success of advanced network observability, which provides deep insights into network traffic within Azure Kubernetes Service (AKS) clusters, we’re introducing fully qualified domain name (FQDN) filtering as a new security feature.

What is Advanced Container Networking Services?

Advanced Container Networking Services is a new product offering, designed to address the observability and security challenges of modern containerized applications. By offering unparalleled network visibility, and robust security features, Advanced Container Networking Services allows users to confidently manage, secure, and observe the network traffic of Azure Kubernetes Service clusters.

Advanced Container Networking Services key capabilities:

• Advanced network observability: Unlock deep insights into network activity at the pod, namespace, or workload level using highly performant eBPF technology. Key capabilities include:
  • Monitoring of traffic to identify bottlenecks and performance issues using Azure managed Prometheus and Grafana dashboards. Trace packet flows across your cluster for detailed analysis and debugging.
  • Visualize service dependencies and interactions for optimal configuration and performance.
• FQDN Filtering with highly available (HA) DNS proxy: Enforce network policies based on domain names leveraging eBPF and the high availability (HA) DNS proxy guarantees continuous DNS resolution.

This blog will focus on the new FQDN filtering and HA DNS proxy capabilities on Azure Container Networking Interface, powered by Cilium clusters. Learn more about advanced network observability and network flow logging capabilities of Advanced Container Networking Services.

Overview of FQDN filtering and HA DNS proxy

In the rapidly evolving landscape of containerized environments, maintaining robust network security while managing the complexity of dynamic infrastructure is a significant challenge. Traditional security methods, which rely heavily on IP-based filtering, often struggle to keep pace with the frequent changes in IP addresses inherent to these environments. This not only makes policy management cumbersome but also increases the risk of errors that can compromise security.

FQDN filtering offers a modern solution to these challenges by allowing organizations to manage network policies based on domain names instead of IP addresses. This approach streamlines policy management, reducing the administrative burden by eliminating the need for constant updates and ensuring that security protocols are consistently applied across the network. By focusing on domain names, FQDN filtering provides a more intuitive and user-friendly method of controlling network traffic, allowing organizations to enforce security policies with greater precision and flexibility.

The introduction of FQDN filtering within Advanced Container Networking Services marks a significant enhancement in network security. This feature not only simplifies the management of complex network environments but also strengthens security by ensuring that only authorized domains can access the network. As a result, organizations can achieve a higher level of control over their network traffic, reducing the risk of unauthorized access and potential security breaches.

However, the true power of this approach is realized when combined with the HA DNS proxy. In a dynamic and distributed environment, ensuring continuous operation is paramount. The HA DNS proxy ensures that DNS resolution remains uninterrupted, even in the face of component failures or during routine maintenance.

This combination of FQDN filtering and HA DNS proxy within Advanced Container Networking Services provides a resilient and forward-thinking solution for securing containerized environments. It empowers organizations to maintain robust security standards, even as their network infrastructure grows and evolves, ensuring that they can confidently manage and protect their digital assets in an increasingly complex landscape.

Benefits

Simplified policy management

The dynamic nature of FQDN-based policies simplifies security management by eliminating the need to constantly track and update IP addresses, which can change frequently. This dynamic policy adjustment capability reduces administrative overhead and minimizes the potential for errors in policy enforcement. Furthermore, FQDN filtering streamlines the integration of security policies with third-party services and APIs. By relying on domain names rather than complex IP mappings, organizations can more easily integrate and maintain their security protocols, ensuring that policies remain consistent and manageable across various platforms.

Enhanced security compliance

FQDN filtering significantly enhances security compliance by enabling granular access control, allowing organizations to implement precise policies that permit or block specific domains. This capability is especially crucial for industries like finance and healthcare, where strict regulatory compliance is mandatory. Moreover, FQDN filtering supports the adoption of a Zero Trust security model. By restricting network traffic to trusted domains only, it reduces the attack surface and mitigates risks from unauthorized access, providing an additional layer of security.

Resilient policy enforcement

Resilient policy enforcement is a critical aspect of Advanced Container Networking Services, particularly with the introduction of FQDN filtering and the HA DNS proxy. In dynamic and distributed environments, maintaining consistent policy enforcement is essential to ensure network security and stability. The HA DNS proxy plays a pivotal role by ensuring that DNS resolution continues seamlessly even when the Cilium agent is unavailable. This resilience in policy enforcement means that FQDN-based security policies remain effective, minimizing the risk of network vulnerabilities during maintenance or unexpected downtimes. By ensuring that policies are consistently applied, regardless of underlying infrastructure changes, resilient policy enforcement enhances the overall reliability and security of containerized environments.

Learn more about Advanced Container Networking Services in Azure

Read more in the Advanced Container Networking Services documentation and try it out on your clusters today.

• Learn about how to configure FQDN filtering.
• Learn more about how to use Cilium network policies.
• Learn more about Azure Kubernetes Service.
• Discover more about Azure CNI powered by Cilium.

We would love to hear from you! Please take a minute and give us some feedback.

The post Advanced Container Networking Services: Enhancing security and observability in AKS appeared first on Microsoft Azure Blog.