Skip to content

Commit 506f3a8

Browse files
denreadenrea
authored
Merge pull request #232499 from schaffererin/AKScustomclusteregress
Editing pass for consistent formatting
2 parents 75ba08c + 9233842 commit 506f3a8

File tree

1 file changed

+63
-67
lines changed

1 file changed

+63
-67
lines changed

‎articles/aks/egress-outboundtype.md

Lines changed: 63 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -5,133 +5,129 @@ author: asudbring
55
ms.subservice: aks-networking
66
ms.author: allensu
77
ms.topic: how-to
8-
ms.date: 06/29/2020
8+
ms.date: 03/28/2023
99

1010
#Customer intent: As a cluster operator, I want to define my own egress paths with user-defined routes. Since I define this up front I do not want AKS provided load balancer configurations.
1111
---
1212

1313
# Customize cluster egress with outbound types in Azure Kubernetes Service (AKS)
1414

15-
Egress from an AKS cluster can be customized to fit specific scenarios. By default, AKS will provision a Standard SKU Load Balancer to be set up and used for egress. However, the default setup may not meet the requirements of all scenarios if public IPs are disallowed or additional hops are required for egress.
15+
You can customize egress for an AKS cluster to fit specific scenarios. By default, AKS will provision a standard SKU load balancer to be set up and used for egress. However, the default setup may not meet the requirements of all scenarios if public IPs are disallowed or additional hops are required for egress.
1616

17-
This article covers the various types of outbound connectivity that are available in AKS Clusters.
17+
This article covers the various types of outbound connectivity that are available in AKS clusters.
18+
19+
> [!NOTE]
20+
> You can now update the `outboundType` after cluster creation. This feature is in preview. See [Updating `outboundType after cluster creation (preview)](#updating-outboundtype-after-cluster-creation-preview).
1821
1922
## Limitations
20-
* Outbound type can only be defined at cluster create time and can't be updated afterwards.
21-
* Reconfiguring outbound type is now supported in preview; see below.
22-
* Setting `outboundType` requires AKS clusters with a `vm-set-type` of `VirtualMachineScaleSets` and `load-balancer-sku` of `Standard`.
2323

24-
## Overview of outbound types in AKS
24+
* Setting `outboundType` requires AKS clusters with a `vm-set-type` of `VirtualMachineScaleSets` and `load-balancer-sku` of `Standard`.
2525

26-
An AKS cluster can be configured with three different categories of outbound type: load balancer, NAT gateway, or user-defined routing.
26+
## Outbound types in AKS
2727

28-
> [!IMPORTANT]
29-
> Outbound type impacts only the egress traffic of your cluster. For more information, see [setting up ingress controllers](ingress-basic.md).
28+
You can configure an AKS cluster using the following outbound types: load balancer, NAT gateway, or user-defined routing. The outbound type impacts only the egress traffic of your cluster. For more information, see [setting up ingress controllers](ingress-basic.md).
3029

3130
> [!NOTE]
32-
> You can use your own [route table][byo-route-table] with UDR and kubenet networking. Make sure your cluster identity (service principal or managed identity) has Contributor permissions to the custom route table.
31+
> You can use your own [route table][byo-route-table] with UDR and [kubenet networking](../aks/configure-kubenet.md). Make sure your cluster identity (service principal or managed identity) has Contributor permissions to the custom route table.
3332
34-
### Outbound type of loadBalancer
33+
### Outbound type of `loadBalancer`
3534

36-
If `loadBalancer` is set, AKS completes the following configuration automatically. The load balancer is used for egress through an AKS assigned public IP. An outbound type of `loadBalancer` supports Kubernetes services of type `loadBalancer`, which expect egress out of the load balancer created by the AKS resource provider.
35+
The load balancer is used for egress through an AKS-assigned public IP. An outbound type of `loadBalancer` supports Kubernetes services of type `loadBalancer`, which expect egress out of the load balancer created by the AKS resource provider.
3736

38-
The following configuration is done by AKS.
39-
* A public IP address is provisioned for cluster egress.
40-
* The public IP address is assigned to the load balancer resource.
41-
* Backend pools for the load balancer are set up for agent nodes in the cluster.
37+
If `loadBalancer` is set, AKS automatically completes the following configuration:
4238

43-
Below is a network topology deployed in AKS clusters by default, which use an `outboundType` of `loadBalancer`.
39+
* A public IP address is provisioned for cluster egress.
40+
* The public IP address is assigned to the load balancer resource.
41+
* Backend pools for the load balancer are set up for agent nodes in the cluster.
4442

4543
![Diagram shows ingress I P and egress I P, where the ingress I P directs traffic to a load balancer, which directs traffic to and from an internal cluster and other traffic to the egress I P, which directs traffic to the Internet, M C R, Azure required services, and the A K S Control Plane.](media/egress-outboundtype/outboundtype-lb.png)
4644

47-
For more information, see [using a standard load balancer in AKS](load-balancer-standard.md) for more information.
45+
For more information, see [using a standard load balancer in AKS](load-balancer-standard.md).
4846

4947
### Outbound type of `managedNatGateway` or `userAssignedNatGateway`
5048

51-
If `managedNatGateway` or `userAssignedNatGateway` are selected for `outboundType`, AKS relies on [Azure Networking NAT gateway](../virtual-network/nat-gateway/manage-nat-gateway.md) for cluster egress.
52-
53-
- `managedNatGateway` is used when using managed virtual networks, and tells AKS to provision a NAT gateway and attach it to the cluster subnet.
54-
- `userAssignedNatGateway` is used when using bring-your-own virtual networking, and requires that a NAT gateway has been provisioned before cluster creation.
49+
If `managedNatGateway` or `userAssignedNatGateway` are selected for `outboundType`, AKS relies on [Azure Networking NAT gateway](../virtual-network/nat-gateway/manage-nat-gateway.md) for cluster egress.
5550

56-
NAT gateway has significantly improved handling of SNAT ports when compared to Standard Load Balancer.
51+
* Select `managedNatGateway` when using managed virtual networks. AKS will provision a NAT gateway and attach it to the cluster subnet.
52+
* Select `userAssignedNatGateway` when using bring-your-own virtual networking. This option requires that you have provisioned a NAT gateway before cluster creation.
5753

58-
For more information, see [using NAT Gateway with AKS](nat-gateway.md) for more information.
54+
For more information, see [using NAT gateway with AKS](nat-gateway.md).
5955

60-
### Outbound type of userDefinedRouting
56+
### Outbound type of `userDefinedRouting`
6157

6258
> [!NOTE]
63-
> Using outbound type is an advanced networking scenario and requires proper network configuration.
59+
> The `userDefinedRouting` outbound type is an advanced networking scenario and requires proper network configuration.
6460
6561
If `userDefinedRouting` is set, AKS won't automatically configure egress paths. The egress setup must be done by you.
6662

67-
The AKS cluster must be deployed into an existing virtual network with a subnet that has been previously configured because when not using standard load balancer (SLB) architecture, you must establish explicit egress. As such, this architecture requires explicitly sending egress traffic to an appliance like a firewall, gateway, proxy or to allow the Network Address Translation (NAT) to be done by a public IP assigned to the standard load balancer or appliance.
63+
You must deploy the AKS cluster into an existing virtual network with a subnet that has been previously configured. Since you're not using a standard load balancer (SLB) architecture, you must establish explicit egress. This architecture requires explicitly sending egress traffic to an appliance like a firewall, gateway, proxy or to allow NAT to be done by a public IP assigned to the standard load balancer or appliance.
6864

69-
For more information, see [configuring cluster egress via user-defined routing](egress-udr.md) for more information.
65+
For more information, see [configuring cluster egress via user-defined routing](egress-udr.md).
7066

71-
## Updating `outboundType` after cluster creation (PREVIEW)
67+
## Updating `outboundType` after cluster creation (preview)
7268

7369
Changing the outbound type after cluster creation will deploy or remove resources as required to put the cluster into the new egress configuration.
7470

7571
Migration is only supported between `loadBalancer`, `managedNATGateway` (if using a managed virtual network), and `userDefinedNATGateway` (if using a custom virtual network).
7672

7773
> [!WARNING]
78-
> Changing the outbound type on a cluster is disruptive to network connectivity and will result in a change of the cluster's egress IP address. If any firewall rules have been configured to restrict traffic from the cluster, they will need to be updated to match the new egress IP address.
74+
> Changing the outbound type on a cluster is disruptive to network connectivity and will result in a change of the cluster's egress IP address. If any firewall rules have been configured to restrict traffic from the cluster, you need to update them to match the new egress IP address.
7975
8076
[!INCLUDE [preview features callout](includes/preview/preview-callout.md)]
8177

82-
### Install the aks-preview Azure CLI extension
78+
### Install the `aks-preview` Azure CLI extension
8379

8480
`aks-preview` version 0.5.113 is required.
8581

86-
To install the `aks-preview` extension, run the following command:
87-
88-
```azurecli
89-
az extension add --name aks-preview
90-
```
82+
* Install and update the `aks-preview` extension.
9183

92-
Run the following command to update to the latest version of the extension released:
84+
```azurecli
85+
# Install aks-preview extension
86+
az extension add --name aks-preview
9387
94-
```azurecli
95-
az extension update --name aks-preview
96-
```
88+
# Update aks-preview extension
89+
az extension update --name aks-preview
90+
```
9791
98-
### Register the 'AKS-OutBoundTypeMigrationPreview' feature flag
92+
### Register the `AKS-OutBoundTypeMigrationPreview` feature flag
9993
100-
Register the `AKS-OutBoundTypeMigrationPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:
94+
1. Register the `AKS-OutBoundTypeMigrationPreview` feature flag using the [`az feature register`][az-feature-register] command. It takes a few minutes for the status to show *Registered*.
10195
102-
```azurecli-interactive
103-
az feature register --namespace "Microsoft.ContainerService" --name "AKS-OutBoundTypeMigrationPreview"
104-
```
96+
```azurecli-interactive
97+
az feature register --namespace "Microsoft.ContainerService" --name "AKS-OutBoundTypeMigrationPreview"
98+
```
10599
106-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:
100+
2. Verify the registration status using the [`az feature show`][az-feature-show] command.
107101
108-
```azurecli-interactive
109-
az feature show --namespace "Microsoft.ContainerService" --name "AKS-OutBoundTypeMigrationPreview"
110-
```
102+
```azurecli-interactive
103+
az feature show --namespace "Microsoft.ContainerService" --name "AKS-OutBoundTypeMigrationPreview"
104+
```
111105
112-
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
106+
3. When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider using the [`az provider register`][az-provider-register] command.
113107
114-
```azurecli-interactive
115-
az provider register --namespace Microsoft.ContainerService
116-
```
108+
```azurecli-interactive
109+
az provider register --namespace Microsoft.ContainerService
110+
```
117111
118-
### Update a cluster to use a new outbound type
112+
### Update cluster to use a new outbound type
119113
120-
Run the following command to change a cluster's outbound configuration:
114+
* Update the outbound configuration of your cluster using the [`az aks update`][az-aks-update] command.
121115
122-
```azurecli-interactive
123-
az aks update -g <resourceGroup> -n <clusterName> --outbound-type <loadBalancer|managedNATGateway|userAssignedNATGateway>
124-
```
116+
```azurecli-interactive
117+
az aks update -g <resourceGroup> -n <clusterName> --outbound-type <loadBalancer|managedNATGateway|userAssignedNATGateway>
118+
```
125119
126120
## Next steps
127121
128-
- [Configure standard load balancing in an AKS cluster](load-balancer-standard.md)
129-
- [Configure NAT gateway in an AKS cluster](nat-gateway.md)
130-
- [Configure user-defined routing in an AKS cluster](egress-udr.md)
131-
- [NAT gateway documentation](./nat-gateway.md)
132-
- [Azure networking UDR overview](../virtual-network/virtual-networks-udr-overview.md).
133-
- [Manage route tables](../virtual-network/manage-route-table.md).
122+
* [Configure standard load balancing in an AKS cluster](load-balancer-standard.md)
123+
* [Configure NAT gateway in an AKS cluster](nat-gateway.md)
124+
* [Configure user-defined routing in an AKS cluster](egress-udr.md)
125+
* [NAT gateway documentation](./nat-gateway.md)
126+
* [Azure networking UDR overview](../virtual-network/virtual-networks-udr-overview.md)
127+
* [Manage route tables](../virtual-network/manage-route-table.md)
134128
135129
<!-- LINKS - internal -->
136-
[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials
137-
[byo-route-table]: configure-kubenet.md#bring-your-own-subnet-and-route-table-with-kubenet
130+
[az-feature-register]: /cli/azure/feature#az_feature_register
131+
[az-feature-show]: /cli/azure/feature#az_feature_show
132+
[az-provider-register]: /cli/azure/provider#az_provider_register
133+
[az-aks-update]: /cli/azure/aks#az_aks_update

0 commit comments

Comments
 (0)