Skip to content

Commit 33a881e

Browse files
Khushbu-ParekhKhushbu-Parekh
committed
Updated NPM user doc- Addressed PR comments by Patrick and Nick
1 parent b02b8f7 commit 33a881e

File tree

2 files changed

+65
-57
lines changed

2 files changed

+65
-57
lines changed

‎articles/aks/use-network-policies.md

Lines changed: 64 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -12,32 +12,32 @@ ms.date: 06/24/2022
1212

1313
When you run modern, microservices-based applications in Kubernetes, you often want to control which components can communicate with each other. The principle of least privilege should be applied to how traffic can flow between pods in an Azure Kubernetes Service (AKS) cluster. Let's say you likely want to block traffic directly to back-end applications. The *Network Policy* feature in Kubernetes lets you define rules for ingress and egress traffic between pods in a cluster.
1414

15-
This article shows you how to install the network policy engine and create Kubernetes network policies to control the flow of traffic between pods in AKS. Network policy could be used for Linux-based or Windows-based nodes and pods in AKS.
15+
This article shows you how to install the Network Policy engine and create Kubernetes network policies to control the flow of traffic between pods in AKS. Network Policy could be used for Linux-based or Windows-based nodes and pods in AKS.
1616

1717
## Before you begin
1818

1919
You need the Azure CLI version 2.0.61 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
2020

21-
## Overview of network policy
21+
## Overview of Network Policy
2222

2323
All pods in an AKS cluster can send and receive traffic without limitations, by default. To improve security, you can define rules that control the flow of traffic. Back-end applications are often only exposed to required front-end services, for example. Or, database components are only accessible to the application tiers that connect to them.
2424

25-
Network Policy is a Kubernetes specification that defines access policies for communication between Pods. Using Network Policies, you define an ordered set of rules to send and receive traffic and apply them to a collection of pods that match one or more label selectors.
25+
Network Policy is a Kubernetes specification that defines access policies for communication between Pods. Using network policies, you define an ordered set of rules to send and receive traffic and apply them to a collection of pods that match one or more label selectors.
2626

27-
These network policy rules are defined as YAML manifests. Network policies can be included as part of a wider manifest that also creates a deployment or service.
27+
These Network Policy rules are defined as YAML manifests. Network Policies can be included as part of a wider manifest that also creates a deployment or service.
2828

2929
## Network policy options in AKS
3030

31-
Azure provides two ways to implement network policy. You choose a network policy option when you create an AKS cluster. The policy option can't be changed after the cluster is created:
31+
Azure provides two ways to implement Network Policy. You choose a Network Policy option when you create an AKS cluster. The policy option can't be changed after the cluster is created:
3232

33-
* Azure's own implementation, called *Azure Network Policies*.
33+
* Azure's own implementation, called *Azure Network Policy Manager(NPM)*.
3434
* *Calico Network Policies*, an open-source network and network security solution founded by [Tigera][tigera].
3535

36-
Azure Network Policy for Linux uses Linux *IPTables* and Azure Network Policy for Windows uses *HNS ACLPolicies* to enforce the specified policies . Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as IPTable/HNS ACLPolicy filter rules.
36+
Azure NPM for Linux uses Linux *IPTables* and Azure NPM for Windows uses *Host Network Service(HNS) ACLPolicies* to enforce the specified policies. Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as IPTable/HNS ACLPolicy filter rules.
3737

38-
## Differences between Azure and Calico policies and their capabilities
38+
## Differences between Azure NPM and Calico Network Policy and their capabilities
3939

40-
| Capability | Azure | Calico |
40+
| Capability | Azure NPM | Calico Network Policy |
4141
|------------------------------------------|----------------------------|-----------------------------|
4242
| Supported platforms | Linux, Windows Server 2022 | Linux, Windows Server 2019 and 2022 |
4343
| Supported networking options | Azure CNI | Azure CNI (Linux, Windows Server 2019 and 2022) and kubenet (Linux) |
@@ -48,53 +48,36 @@ Azure Network Policy for Linux uses Linux *IPTables* and Azure Network Policy fo
4848

4949
## Limitations:
5050

51-
* NPNetwork Policy does not support IPv6. Otherwise, Network Policy fully supports the Network Policy spec in Linux.
52-
* In Windows, Network Policy does not support the following:
51+
*Azure Network Policy Manager(NPM) does not support IPv6. Otherwise, Azure NPM fully supports the network policy spec in Linux.
52+
* In Windows, Azure NPM does not support the following:
5353
* named ports
5454
* SCTP protocol
5555
* negative match label or namespace selectors (e.g. all labels except "debug=true")
56-
* potential latency issues for policy application
5756
* "except" CIDR blocks (a CIDR with exceptions)
5857

5958
>[!NOTE]
60-
> * The limitations listed above does have alternatives to it.
61-
> * Network Policy pod logs will record an error if an unsupported policy is created.
59+
> * Azure NPM pod logs will record an error if an unsupported policy is created.
6260
63-
## Create an AKS cluster and enable network policy
61+
## Create an AKS cluster and enable Network Policy
6462

6563
To see network policies in action, let's create an AKS cluster that supports network policy and then work on adding policies.
6664

6765
> [!IMPORTANT]
6866
>
6967
> The network policy feature can only be enabled when the cluster is created. You can't enable network policy on an existing AKS cluster.
7068
71-
To use Azure Network Policy, you must use the [Azure CNI plug-in][azure-cni]. Calico Network Policy could be used with either this same Azure CNI plug-in or with the Kubenet CNI plug-in.
69+
To use Azure NPM, you must use the [Azure CNI plug-in][azure-cni]. Calico Network Policy could be used with either this same Azure CNI plug-in or with the Kubenet CNI plug-in.
7270

7371
The following example script:
7472

75-
* Creates an AKS cluster with system-assigned identity and enables network policy.
76-
* The _Azure Network_ policy option is used. To use Calico as the network policy option instead, use the `--network-policy calico` parameter. Note: Calico could be used with either `--network-plugin azure` or `--network-plugin kubenet`.
73+
* Creates an AKS cluster with system-assigned identity and enables Network Policy.
74+
* The _Azure NPM_ option is used. To use Calico as the Network Policy option instead, use the `--network-policy calico` parameter. Note: Calico could be used with either `--network-plugin azure` or `--network-plugin kubenet`.
7775

7876
Instead of using a system-assigned identity, you can also use a user-assigned identity. For more information, see [Use managed identities](use-managed-identity.md).
7977

80-
### Preview Flag for Windows Sever 2022
78+
### Create an AKS cluster with Azure NPM enabled - Linux only
8179

82-
To enable Azure Network Policy on Windows Server 2022 node pools, please execute the following commands prior to creating a cluster:
83-
84-
```azurecli
85-
az extension add --name aks-preview
86-
az extension update --name aks-preview
87-
az feature register --namespace Microsoft.ContainerService --name AKSWindows2022Preview
88-
az feature register --namespace Microsoft.ContainerService --name WindowsNetworkPolicyPreview
89-
az provider register -n Microsoft.ContainerService
90-
```
91-
> [!IMPORTANT]
92-
> At this time, Azure network policies with Windows nodes is available on Windows Server 2022 only
93-
>
94-
95-
### Create an AKS cluster with Azure Network Policy
96-
97-
In this section, we will work on creating a cluster with Azure Network Policy enabled.
80+
In this section, we will work on creating a cluster with Linux node pools and Azure NPM enabled.
9881

9982
To begin, you should replace the values for *$RESOURCE_GROUP_NAME* and *$CLUSTER_NAME* variables.
10083

@@ -104,17 +87,9 @@ $CLUSTER_NAME=myAKSCluster
10487
$LOCATION=canadaeast
10588
```
10689

107-
In case, you are planning to create Windows Server 2022 node pools, you will need to replace values for *$WINDOWS_USERNAME*, *$WINDOWS_PASSWORD* and *$k8S_VERSION* variables in addition to the ones mentioned above.
108-
109-
```azurecli-interactive
110-
$WINDOWS_USERNAME=myWindowsUserName
111-
$WINDOWS_PASSWORD=myWindowsPassword
112-
$k8S_VERSION=myk8sVersion
113-
```
114-
115-
Create the AKS cluster and specify *azure* for the network plugin and network policy.
90+
Create the AKS cluster and specify *azure* for the `network-plugin` and `network-policy`.
11691

117-
Use the following command for cluster running with **only Linux** node pools:
92+
Use the following command for a cluster running with **Linux** node pools:
11893
```azurecli
11994
az aks create \
12095
--resource-group $RESOURCE_GROUP_NAME \
@@ -123,6 +98,34 @@ az aks create \
12398
--network-plugin azure \
12499
--network-policy azure
125100
```
101+
102+
### Create an AKS cluster with Azure NPM enabled - Windows Server 2022 (Preview)
103+
104+
In this section, we will work on creating a cluster with Windows node pools and Azure NPM enabled.
105+
106+
Please execute the following commands prior to creating a cluster:
107+
108+
```azurecli
109+
az extension add --name aks-preview
110+
az extension update --name aks-preview
111+
az feature register --namespace Microsoft.ContainerService --name AKSWindows2022Preview
112+
az feature register --namespace Microsoft.ContainerService --name WindowsNetworkPolicyPreview
113+
az provider register -n Microsoft.ContainerService
114+
115+
> [!NOTE]
116+
> At this time, Azure NPM with Windows nodes is available on Windows Server 2022 only
117+
>
118+
119+
Now, you should replace the values for *$RESOURCE_GROUP_NAME*, *$CLUSTER_NAME*, *$WINDOWS_USERNAME*, *$WINDOWS_PASSWORD* and *$k8S_VERSION* variables.
120+
121+
```azurecli-interactive
122+
$RESOURCE_GROUP_NAME=myResourceGroup-NP
123+
$CLUSTER_NAME=myAKSCluster
124+
$WINDOWS_USERNAME=myWindowsUserName
125+
$WINDOWS_PASSWORD=myWindowsPassword
126+
$k8S_VERSION=myk8sVersion
127+
$LOCATION=canadaeast
128+
```
126129
Use the following command for cluster running with **Windows Server 2022** node pools:
127130

128131
```azurecli
@@ -138,15 +141,15 @@ az aks create \
138141
--node-count 1
139142
```
140143

141-
It takes a few minutes to create the cluster. When the cluster is ready, configure `kubectl` to connect to your Kubernetes cluster by using the [az aks get-credentials][az-aks-get-credentials] command. This command downloads credentials and configures the Kubernetes CLI to use them:
144+
> [!NOTE]
145+
> You can still add Linux node pools to the cluster created using the above command, by default.
146+
>
142147
143-
```azurecli-interactive
144-
az aks get-credentials --resource-group $RESOURCE_GROUP_NAME --name $CLUSTER_NAME
145-
```
148+
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
146149

147150
### Create an AKS cluster for Calico network policies
148151

149-
Create the AKS cluster and specify *azure* for the network plugin, and *calico* for the network policy. Using *calico* as the network policy enables Calico networking on both Linux and Windows node pools.
152+
Create the AKS cluster and specify *azure* for the network plugin, and *calico* for the Network Policy. Using *calico* as the Network Policy enables Calico networking on both Linux and Windows node pools.
150153

151154
If you plan on adding Windows node pools to your cluster, include the `windows-admin-username` and `windows-admin-password` parameters with that meet the [Windows Server password requirements][windows-server-password].
152155

@@ -187,11 +190,16 @@ When the cluster is ready, configure `kubectl` to connect to your Kubernetes clu
187190
```azurecli-interactive
188191
az aks get-credentials --resource-group $RESOURCE_GROUP_NAME --name $CLUSTER_NAME
189192
```
190-
### Verify Network Policy Setup
193+
## Verify Network Policy Setup
194+
195+
It takes a few minutes to create the cluster. When the cluster is ready, configure `kubectl` to connect to your Kubernetes cluster by using the [az aks get-credentials][az-aks-get-credentials] command. This command downloads credentials and configures the Kubernetes CLI to use them:
191196

192-
Now that we have created a cluster, lets create a sample application and set traffic rules.
197+
```azurecli-interactive
198+
az aks get-credentials --resource-group $RESOURCE_GROUP_NAME --name $CLUSTER_NAME
199+
```
200+
To begin verification of network policy, we will create a sample application and set traffic rules.
193201

194-
First, let's create a namespace called *demo* to run the example pods:
202+
Firstly, let's create a namespace called *demo* to run the example pods:
195203

196204
```console
197205
kubectl create namespace demo
@@ -228,15 +236,15 @@ NAME READY STATUS RESTARTS AGE IP NODE NOMIN
228236
server 1/1 Running 0 30s 10.224.0.72 akswin22000001 <none> <none>
229237
```
230238

231-
#### Test Connectivity without Network Policy
239+
### Test Connectivity without Network Policy
232240

233241
In the client's shell, verify connectivity with the server by executing the following command. Replace *server-ip* by IP found in the output from executing previous command. There will be no output if the connection is successful:
234242

235243
```console
236244
/agnhost connect <server-ip>:80 --timeout=3s --protocol=tcp
237245
```
238246

239-
#### Test Connectivity with Network Policy
247+
### Test Connectivity with Network Policy
240248

241249
Create a file named demo-pods-policy.yaml and paste the following YAML manifest to add network policies:
242250

@@ -285,7 +293,7 @@ kubectl label pod client -n demo app=client
285293

286294
## Clean up resources
287295

288-
In this article, we created a namespace, two pods and applied a network policy. To clean up these resources, use the [kubectl delete][kubectl-delete] command and specify the resource name:
296+
In this article, we created a namespace, two pods and applied a Network Policy. To clean up these resources, use the [kubectl delete][kubectl-delete] command and specify the resource name:
289297

290298
```console
291299
kubectl delete namespace demo

‎articles/virtual-network/kubernetes-network-policies.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ See a [configuration for these alerts](#setup-alerts-for-alertmanager) below.
7878
2. Correlate cluster counts (e.g. ACLs) to execution times.
7979
3. Get the human-friendly name of an ipset in a given iptables rule (e.g. "azure-npm-487392" represents "podlabel-role:database").
8080

81-
### All Supported Metrics
81+
### All supported metrics
8282
The following is the list of supported metrics. Any `quantile` label has possible values `0.5`, `0.9`, and `0.99`. Any `had_error` label has possible values `false` and `true`, representing whether the operation succeeded or failed.
8383

8484
| Metric Name | Description | Prometheus Metric Type | Labels |

0 commit comments

Comments
 (0)