unnecessary storage service endpoint created on subnet?

[kewalaka]

What happened:

We pre-create a storage account with a private endpoint.

When creating an NFS share via a storage class & PVC, a service endpoint is created on the subnet.

What you expected to happen:

It's unclear to me why storage accounts that are accessed via private endpoint need a service endpoint provisioned?

The additional service endpoint then requires routes on the UDR if we wish to avoid situations where operators provision additional storage without private endpoints and traffic bypasses the next-hop firewall because the service endpoint routing is more specific.

Ideally, we want a policy in place to block service endpoints.

Anything else we need to know?:

Can workaround this by adding a route, but preference is to avoid unnecessary service endpoints.

[andyzhangx]

are your node pools on that subnet? @kewalaka

[kewalaka]

hi @andyzhangx - yes, the service endpoint has been made at the vnet and applies to all subnets in that vnet.

in my situation I have three subnets

1. nodes pools
2. api server
3. a base subnet where we place some private endpoints

[andyzhangx]

@kewalaka could you set subnetName: nodepoolSubnetName in storage class, then only that subnet would be created with service endpoint, thx.

[kewalaka]

true - does the node pool even need it though, if the target storage account has a private endpoint?

That's what I was meaning, the service endpoint seems redundant.

Or does the node pool require this for internal reasons?

[andyzhangx]

@kewalaka
what is your storage class config? if networkEndpointType: privateEndpoint is not set, the driver would update the subnet with service endpoint.