Azure Kubernetes Service (AKS) Network Operations

This document details various networking operations and considerations for Azure Kubernetes Service (AKS). Effective network configuration is crucial for the security, scalability, and performance of your Kubernetes applications.

Core Networking Concepts

AKS leverages Azure Virtual Networks (VNets) to provide a robust networking foundation for your clusters. Key concepts include:

VNet Integration: Deploying AKS clusters within an existing Azure VNet allows for network isolation and integration with other Azure services.
Kubernetes Networking Model: Understanding Pod-to-Pod communication, Service discovery, and Ingress within the Kubernetes paradigm.
IP Address Management (IPAM): How AKS assigns IP addresses to Pods, Services, and Nodes.

Network Plugins

AKS supports different network plugins to manage network policies and traffic flow:

Azure CNI: This plugin assigns an IP address from the VNet to each Pod directly, enabling VNet-native networking. This provides greater flexibility and compatibility with existing on-premises networks.
Kubenet: A simpler network plugin that uses Azure Virtual Network routing to connect Pods. It's suitable for smaller clusters or development environments.

Choosing a Network Plugin

The choice between Azure CNI and Kubenet depends on your specific requirements:

Azure CNI: Recommended for production workloads, scenarios requiring direct Pod IP address assignment from the VNet, and when integrating with existing network security appliances. It supports more advanced features like Network Policy enforcement.
Kubenet: Simpler to configure and manage, suitable for learning or scenarios where advanced networking features are not critical.

Network Security

Securing network traffic is paramount. AKS provides several mechanisms for network security:

Network Policies: Kubernetes Network Policies allow you to control the flow of traffic between Pods. AKS supports Network Policy enforcement via plugins like Azure CNI or Calico.
Azure Firewall: Integrate AKS with Azure Firewall for centralized network security management, including threat intelligence and intrusion detection.
Private Clusters: Configure AKS clusters to be private, meaning their API server endpoint is not exposed to the public internet, enhancing security.

Example: Network Policy Configuration


apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress

This example denies all incoming traffic to Pods in the `default` namespace by default.

Load Balancing and Ingress

Exposing your applications securely and efficiently is achieved through load balancing and Ingress controllers.

Azure Load Balancer: AKS integrates with Azure Load Balancer to provide high availability and scalability for your services.
Application Gateway Ingress Controller (AGIC): Deploy AGIC to leverage Azure Application Gateway as your Kubernetes Ingress, providing Layer 7 load balancing, SSL termination, and Web Application Firewall (WAF) capabilities.
External DNS: Automate the creation and management of DNS records for your services using External DNS.

Network Performance and Optimization

To ensure optimal performance, consider the following:

Network Throughput: Understand the network throughput limits of your AKS node SKUs.
Service Discovery: Utilize Kubernetes Services for reliable service discovery.
Accelerated Networking: Enable Accelerated Networking on your AKS nodes for improved network performance.

Note: When using Azure CNI, ensure that your subnet for Pods has sufficient IP address space to accommodate the expected number of Pods.

Tip: For advanced traffic management and security, consider using Azure Application Gateway with AGIC.

Troubleshooting Network Issues

Common network issues can often be diagnosed using Kubernetes tools and Azure monitoring:

`kubectl` commands: Use `kubectl logs`, `kubectl describe`, and `kubectl exec` to inspect Pods and Services.
Network Tools: Tools like `netshoot` can be deployed as a Pod to help diagnose network connectivity issues from within the cluster.
Azure Network Watcher: Utilize Azure Network Watcher for advanced network diagnostics and monitoring.

MSDN Documentation