[Issue] OS.EnableFirewall in waagent.conf

[watermarking]

OS.EnableFirewall is enabled by default during boot at all VMs including AKS services.
Whenever the AKS container scales out, the iptables/nf_conntrack is loaded by default on new container in its scale set.
No good way to disable this firewall feature in AKS.
Could you consider to disable it ?

[larohra]

watermarking unfortunately we cant disable it by default for security reasons. That is the main reason why its available as a config flag so that if any customer wants to disable it they can do it for their VMs.

Not sure if you already tried this but if you create all your AKS containers from a base image, you can disable OS.EnableFirewall in the base image and all the new VMs should also have that flag disabled by default.