Restrict access to ARO to specific IPs

Question

Restrict access to ARO to specific IPs

Ahmed-edisondt 0

Hi;

I have installed ARO with API server visibility=Public, and I would like to restrict access to specific IPs only (API access on port 6443 and Console access on port 443).

I tried to add NSG inbound rule on the Public IPs, but I could not because of the deny assignment I have on the default NSG that manage the public IP addresses.

Is there any way I can restrict the cluster access to specific IP without rebuilding the cluster?

Error:

=========

"Failed to create security rule 'rule-name'.

Error: The client 'user.com' with object id '34b0f3bf-8b021054' has permission to perform action 'Microsoft.Network/networkSecurityGroups/securityRules/write' on scope

'aro-name/providers/Microsoft.Network/networkSecurityGroups/aro-cluster-pxxxp-nsg/securityRules/rulename'>aro-cluster-pxxxp-nsg/rulename';

however, the access is denied because of the deny assignment with name '37dbbxx-xxx-e3c7cc1' and Id '37dbbxx-xxx-e3c7cc1'

at scope '/subscriptions/1f959xxxx5173561f5/resourcegroups/aro-name'."

Thank you

Durga Reshma Malthi 11,600 Reputation points Microsoft External Staff Moderator

2025-07-22T17:14:55.8633333+00:00

Hi Ahmed-edisondt

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries

1 answer

Your answer

Durga Reshma Malthi 11,600 Reputation points Microsoft External Staff Moderator

2025-07-22T17:14:55.8633333+00:00

Hi Ahmed-edisondt

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries

Answer 1

Hi Ahmed-edisondt

No, you cannot directly modify the NSG associated with an ARO public endpoint due to the deny assignment. However, you can still restrict IP access without recreating the cluster by configuring an ARO-supported IP allow list via the cluster API server and console ingress profiles.

Restrict API Server Access (Port 6443) by using the Azure CLI to update allowed IPs:

az aro update \
  --name <cluster-name> \
  --resource-group <resource-group> \
  --apiserver-authorized-ip-ranges <comma-separated-IP-ranges>

Restrict Console Access (Port 443) by updating the ingress profile with allowed IPs:

Get the aro-provided ingress profile name:

az aro show \
  --name <cluster-name> \
  --resource-group <resource-group> \
  --query ingressProfiles

Update the ingressProfiles using az aro update.

Hope this helps!

Please Let me know if you have any queries.