Inbound rule for agentpool (aks-nodepool) via ARM template

{
                        "name": "agentpool",
                        "osDiskSizeGB": "[parameters('osDiskSizeGB')]",
                        "count": "[parameters('agentCount')]",
                        "enableAutoScaling": true,
                        "vmsize": "[parameters('agentpoolVmSize')]",
                        "osType": "Linux",
                        "osSKU": "Ubuntu",
                        "minCount": "[parameters('minCount')]",
                        "maxCount": "[parameters('maxCount')]",
                        "type": "VirtualMachineScaleSets",
                        "mode": "System",
                        "maxPods": 110,
                        "availabilityZones": [],
                        "nodeLabels": {},
                        "enableNodePublicIP": true,
                        "tags": {},
                        "vnetSubnetID": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('aksSubnetName'))]"
                    },

As i am already creating a agentpool node and whatever script you provided is creating one more nsg and not adding rule to the exsisting one .
I am creating a managed cluster and 2 nodes agentpool and gpunode, from ARM Template,
I want to allow certain ports in agentpool node.How can i proceed?

Hi Aditya Pai
To add an inbound rule to the NSG of a VMSS, you can use the Microsoft.Network/networkSecurityGroups resource type in your ARM template. Here are the steps to add an inbound rule to the NSG:

{
   "type": "Microsoft.Network/networkSecurityGroups",
   "apiVersion": "2021-02-01",
   "name": "[variables('nsgName')]",
   "location": "[parameters('location')]",
   "properties": {
      "securityRules": [
         {
            "name": "allow-8080",
            "properties": {
               "protocol": "Tcp",
               "sourcePortRange": "*",
               "destinationPortRange": "8080",
               "sourceAddressPrefix": "*",
               "destinationAddressPrefix": "*",
               "access": "Allow",
               "priority": 100,
               "direction": "Inbound"
            }
         }
      ]
   }
}

Replace variables('nsgName') with the name of your NSG, and 8080 with the port number you want to allow traffic on. You can also customize the rule name, priority, and direction as needed.

Repeat step 2 for each port you want to allow traffic on.

Once you have added the inbound security rules to the NSG, they will take effect immediately and allow traffic on the specified port(s) to your VMSS instances.

I hope this helps! Let me know if you have any further question

Hi @Prrudram-MSFT ,We are deploying managedCluster from ARM template, inside a AKS subnet.
There are 2 nodes we are deploying in the cluster.

1.Agentpool
2.GPUnode
When we are deploying, agentpool-vmss is having 2 NSGs,one is with subnet-level and one is which is attached to network interface.
As the one with subnet level,we have allowed couple of ports.
But the nsg attached to network interface we are not able to allow ports.
As assuming we will not be having that nsgname which is attached to networkInterface and it will be created dynamically,how can we allow ports on that agentpool level.

Also,
The snippet you provided is in resource section and one more nsg will be created over it,
and that nsg will not be useful, as i am facing issue on nsg attached to NetworkInterface of VMSS.

Looking forward to hear from you.Help us out on how we can proceed.
If I'm wrong please correct,and provide a valid solution which will help.

Hello Aditya Pai

I will have to test this scenario to get the exact workflow, It will take sometime for me to get back. In the interim, If you would like and be able to reach out support to know if there is any existing template that they can help with that might help you get going faster. I looked up didn't find any.