Skip to content

Commit 257525c

Browse files
American-DipperAmerican-Dipper
authored
Merge pull request #252767 from schaffererin/configurekubeproxyupdate
Freshness pass: Configure kube-proxy in AKS (Preview)
2 parents 0790709 + 563360c commit 257525c

File tree

1 file changed

+84
-90
lines changed

1 file changed

+84
-90
lines changed

‎articles/aks/configure-kube-proxy.md

Lines changed: 84 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,143 +1,137 @@
11
---
2-
title: Configure kube-proxy (iptables/IPVS) (preview)
2+
title: Configure kube-proxy (iptables/IPVS) (Preview)
33
titleSuffix: Azure Kubernetes Service
44
description: Learn how to configure kube-proxy to utilize different load balancing configurations with Azure Kubernetes Service (AKS).
55
ms.subservice: aks-networking
66
ms.custom: devx-track-azurecli, devx-track-linux
77
ms.topic: how-to
8-
ms.date: 10/25/2022
8+
ms.date: 09/25/2023
99
ms.author: allensu
1010
author: asudbring
1111
#Customer intent: As a cluster operator, I want to utilize a different kube-proxy configuration.
1212
---
1313

14-
# Configure `kube-proxy` in Azure Kubernetes Service (AKS) (preview)
14+
# Configure `kube-proxy` in Azure Kubernetes Service (AKS) (Preview)
1515

16-
`kube-proxy` is a component of Kubernetes that handles routing traffic for services within the cluster. There are two backends available for Layer 3/4 load balancing in upstream `kube-proxy` - iptables and IPVS.
16+
`kube-proxy` is a component of Kubernetes that handles routing traffic for services within the cluster. There are two backends available for Layer 3/4 load balancing in upstream `kube-proxy`: iptables and IPVS.
1717

18-
- iptables is the default backend utilized in the majority of Kubernetes clusters. It is simple and well supported, but is not as efficient or intelligent as IPVS.
19-
- IPVS utilizes the Linux Virtual Server, a layer 3/4 load balancer built into the Linux kernel. IPVS provides a number of advantages over the default iptables configuration, including state awareness, connection tracking, and more intelligent load balancing.
18+
- **iptables** is the default backend utilized in the majority of Kubernetes clusters. It's simple and well-supported, but not as efficient or intelligent as IPVS.
19+
- **IPVS** uses the Linux Virtual Server, a layer 3/4 load balancer built into the Linux kernel. IPVS provides a number of advantages over the default iptables configuration, including state awareness, connection tracking, and more intelligent load balancing. IPVS *doesn't support Azure Network Policy*.
2020

21-
The AKS managed `kube-proxy` DaemonSet can also be disabled entirely if that is desired to support [bring-your-own CNI][aks-byo-cni].
21+
For more information, see the [Kubernetes documentation on kube-proxy](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/).
2222

23-
## Prerequisites
24-
25-
* Azure CLI with aks-preview extension 0.5.105 or later.
26-
* If using ARM or the REST API, the AKS API version must be 2022-08-02-preview or later.
27-
28-
## Install the aks-preview Azure CLI extension
23+
> [!NOTE]
24+
> If you want, you can disable the AKS-managed `kube-proxy` DaemonSet to support [bring-your-own CNI][aks-byo-cni].
2925
3026
[!INCLUDE [preview features callout](includes/preview/preview-callout.md)]
3127

32-
To install the aks-preview extension, run the following command:
33-
34-
```azurecli-interactive
35-
az extension add --name aks-preview
36-
```
28+
## Before you begin
3729

38-
Run the following command to update to the latest version of the extension released:
30+
- If using the Azure CLI, you need the `aks-preview` extension. See [Install the `aks-preview` Azure CLI extension](#install-the-aks-preview-azure-cli-extension).
31+
- If using ARM or the REST API, the AKS API version must be *2022-08-02-preview or later*.
32+
- You need to register the `KubeProxyConfigurationPreview` feature flag. See [Register the `KubeProxyConfigurationPreview` feature flag](#register-the-kubeproxyconfigurationpreview-feature-flag).
3933

40-
```azurecli-interactive
41-
az extension update --name aks-preview
42-
```
34+
### Install the `aks-preview` Azure CLI extension
4335

44-
## Register the 'KubeProxyConfigurationPreview' feature flag
36+
1. Install the `aks-preview` extension using the [`az extension add`][az-extension-add] command.
4537

46-
Register the `KubeProxyConfigurationPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:
38+
```azurecli-interactive
39+
az extension add --name aks-preview
40+
```
4741
48-
```azurecli-interactive
49-
az feature register --namespace "Microsoft.ContainerService" --name "KubeProxyConfigurationPreview"
50-
```
42+
2. Update to the latest version of the extension using the [`az extension update`][az-extension-update] command.
5143
52-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:
44+
```azurecli-interactive
45+
az extension update --name aks-preview
46+
```
5347
54-
```azurecli-interactive
55-
az feature show --namespace "Microsoft.ContainerService" --name "KubeProxyConfigurationPreview"
56-
```
48+
### Register the `KubeProxyConfigurationPreview` feature flag
5749
58-
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
50+
1. Register the `KubeProxyConfigurationPreview` feature flag using the [`az feature register`][az-feature-register] command.
5951
60-
```azurecli-interactive
61-
az provider register --namespace Microsoft.ContainerService
62-
```
52+
```azurecli-interactive
53+
az feature register --namespace "Microsoft.ContainerService" --name "KubeProxyConfigurationPreview"
54+
```
6355
64-
## Configurable options
56+
It takes a few minutes for the status to show *Registered*.
6557
66-
The full `kube-proxy` configuration structure can be found in the [AKS Cluster Schema][aks-schema-kubeproxyconfig].
58+
2. Verify the registration status using the [`az feature show`][az-feature-show] command.
6759
68-
- `enabled` - whether or not to deploy the `kube-proxy` DaemonSet. Defaults to true.
69-
- `mode` - can be set to `IPTABLES` or `IPVS`. Defaults to `IPTABLES`.
70-
- `ipvsConfig` - if `mode` is `IPVS`, this object contains IPVS-specific configuration properties.
71-
- `scheduler` - which connection scheduler to utilize. Supported values:
72-
- `LeastConnection` - sends connections to the backend pod with the fewest connections
73-
- `RoundRobin` - distributes connections evenly between backend pods
74-
- `tcpFinTimeoutSeconds` - the value used for timeout after a FIN has been received in a TCP session
75-
- `tcpTimeoutSeconds` - the value used for timeout length for idle TCP sessions
76-
- `udpTimeoutSeconds` - the value used for timeout length for idle UDP sessions
60+
```azurecli-interactive
61+
az feature show --namespace "Microsoft.ContainerService" --name "KubeProxyConfigurationPreview"
62+
```
7763
78-
> [!NOTE]
79-
> IPVS load balancing operates in each node independently and is still only aware of connections flowing through the local node. This means that while `LeastConnection` results in more even load under higher number of connections, when low numbers of connections (# connects < 2 * node count) occur traffic may still be relatively unbalanced.
80-
81-
## Utilize `kube-proxy` configuration in a new or existing AKS cluster using Azure CLI
64+
3. When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider using the [`az provider register`][az-provider-register] command.
8265
83-
`kube-proxy` configuration is a cluster-wide setting. No action is needed to update your services.
84-
85-
>[!WARNING]
86-
> Changing the kube-proxy configuration may cause a slight interruption in cluster service traffic flow.
66+
```azurecli-interactive
67+
az provider register --namespace Microsoft.ContainerService
68+
```
8769
88-
To begin, create a JSON configuration file with the desired settings:
70+
## `kube-proxy` configuration options
8971
90-
### Create a configuration file
72+
You can view the full `kube-proxy` configuration structure in the [AKS Cluster Schema][aks-schema-kubeproxyconfig].
9173
92-
```json
93-
{
94-
"enabled": true,
95-
"mode": "IPVS",
96-
"ipvsConfig": {
97-
"scheduler": "LeastConnection",
98-
"TCPTimeoutSeconds": 900,
99-
"TCPFINTimeoutSeconds": 120,
100-
"UDPTimeoutSeconds": 300
101-
}
102-
}
103-
```
74+
- **`enabled`**: Determines deployment of the `kube-proxy` DaemonSet. Defaults to `true`.
75+
- **`mode`**: You can set to either `IPTABLES` or `IPVS`. Defaults to `IPTABLES`.
76+
- **`ipvsConfig`**: If `mode` is `IPVS`, this object contains IPVS-specific configuration properties.
77+
- **`scheduler`**: Determines which connection scheduler to use. Supported values include:
78+
- **`LeastConnection`**: Sends connections to the backend pod with the fewest connections.
79+
- **`RoundRobin`**: Evenly distributes connections between backend pods.
80+
- **`tcpFinTimeoutSeconds`**: Sets the timeout length value after a TCP session receives a FIN.
81+
- **`tcpTimeoutSeconds`**: Sets the timeout length value for idle TCP sessions.
82+
- **`udpTimeoutSeconds`**: Sets the timeout length value for idle UDP sessions.
10483
105-
### Deploy a new cluster
106-
107-
Deploy your cluster using `az aks create` and pass in the configuration file:
108-
109-
```bash
110-
az aks create -g <resourceGroup> -n <clusterName> --kube-proxy-config kube-proxy.json
111-
```
112-
113-
### Update an existing cluster
114-
115-
Configure your cluster using `az aks update` and pass in the configuration file:
84+
> [!NOTE]
85+
> IPVS load balancing operates in each node independently and is only aware of connections flowing through the local node. This means that while `LeastConnection` results in a more even load under a higher number of connections, when a low amount of connections (# connects < 2 * node count) occur, traffic may be relatively unbalanced
11686
117-
```bash
118-
az aks update -g <resourceGroup> -n <clusterName> --kube-proxy-config kube-proxy.json
119-
```
87+
## Use `kube-proxy` in a new or existing AKS cluster
12088
121-
### Limitations
89+
`kube-proxy` configuration is a cluster-wide setting. You don't need to update your services.
12290
123-
When using kube-proxy IPVS, the following restrictions apply:
91+
> [!WARNING]
92+
> Changing the kube-proxy configuration may cause a slight interruption in cluster service traffic flow.
12493
125-
- Azure Network Policy is not supported.
94+
1. Create a configuration file with the desired `kube-proxy` configuration. For example, the following configuration enables IPVS with the `LeastConnection` scheduler and sets the TCP timeout to 900 seconds.
95+
96+
```json
97+
{
98+
"enabled": true,
99+
"mode": "IPVS",
100+
"ipvsConfig": {
101+
"scheduler": "LeastConnection",
102+
"TCPTimeoutSeconds": 900,
103+
"TCPFINTimeoutSeconds": 120,
104+
"UDPTimeoutSeconds": 300
105+
}
106+
}
107+
```
108+
109+
2. Create a new cluster or update an existing cluster with the configuration file using the [`az aks create`][az-aks-create] or [`az aks update`][az-aks-update] command with the `--kube-proxy-config` parameter set to the configuration file.
110+
111+
```azurecli-interactive
112+
# Create a new cluster
113+
az aks create -g <resourceGroup> -n <clusterName> --kube-proxy-config kube-proxy.json
114+
115+
# Update an existing cluster
116+
az aks update -g <resourceGroup> -n <clusterName> --kube-proxy-config kube-proxy.json
117+
```
126118
127119
## Next steps
128120
129-
Learn more about utilizing the Standard Load Balancer for inbound traffic at the [AKS Standard Load Balancer documentation](load-balancer-standard.md).
130-
131-
Learn more about using Internal Load Balancer for Inbound traffic at the [AKS Internal Load Balancer documentation](internal-lb.md).
121+
This article covered how to configure `kube-proxy` in Azure Kubernetes Service (AKS). To learn more about load balancing in AKS, see the following articles:
132122
133-
Learn more about Kubernetes services at the [Kubernetes services documentation][kubernetes-services].
123+
- [Use a standard public load balancer in AKS](load-balancer-standard.md)
124+
- [Use an internal load balancer in AKS](internal-lb.md)
134125
135126
<!-- LINKS - External -->
136-
[kubernetes-services]: https://kubernetes.io/docs/concepts/services-networking/service/
137127
[aks-schema-kubeproxyconfig]: /azure/templates/microsoft.containerservice/managedclusters?pivots=deployment-language-bicep#containerservicenetworkprofilekubeproxyconfig
138128
139129
<!-- LINKS - Internal -->
140130
[aks-byo-cni]: use-byo-cni.md
141131
[az-provider-register]: /cli/azure/provider#az-provider-register
142132
[az-feature-register]: /cli/azure/feature#az-feature-register
143133
[az-feature-show]: /cli/azure/feature#az-feature-show
134+
[az-extension-add]: /cli/azure/extension#az-extension-add
135+
[az-extension-update]: /cli/azure/extension#az-extension-update
136+
[az-aks-create]: /cli/azure/aks#az-aks-create
137+
[az-aks-update]: /cli/azure/aks#az-aks-update

0 commit comments

Comments
 (0)