You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/use-network-policies.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,12 +25,12 @@ The network policy rules are defined as YAML manifests. Network policies can be
25
25
26
26
Azure provides three Network Policy engines for enforcing network policies:
27
27
28
-
**Cilium* for AKS clusters that use [Azure CNI Powered by Cilium](./azure-cni-powered-by-cilium.md).
29
-
**Azure Network Policy Manager*.
30
-
**Calico*, an open-source network and network security solution founded by [Tigera][tigera].
28
+
*_Cilium_ for AKS clusters that use [Azure CNI Powered by Cilium](./azure-cni-powered-by-cilium.md).
29
+
*_Azure Network Policy Manager_.
30
+
*_Calico_, an open-source network and network security solution founded by [Tigera][tigera].
31
31
32
32
Cilium is our recommended Network Policy engine. Cilium enforces network policy on the traffic using Linux Berkeley Packet Filter (BPF), which is generally more efficient than "IPTables". See more details in [Azure CNI Powered by Cilium documentation](./azure-cni-powered-by-cilium.md).
33
-
To enforce the specified policies, Azure Network Policy Manager for Linux uses Linux *IPTables*. Azure Network Policy Manager for Windows uses *Host Network Service (HNS) ACLPolicies*. Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as `IPTable` or `HNS ACLPolicy` filter rules.
33
+
To enforce the specified policies, Azure Network Policy Manager for Linux uses Linux _IPTables_. Azure Network Policy Manager for Windows uses _Host Network Service (HNS) ACLPolicies_. Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as `IPTable` or `HNS ACLPolicy` filter rules.
34
34
35
35
36
36
## Differences between Network Policy engines: Cilium, Azure NPM, and Calico
@@ -136,13 +136,13 @@ Register the `WindowsNetworkPolicyPreview` feature flag by using the [az feature
136
136
az feature register --namespace "Microsoft.ContainerService" --name "WindowsNetworkPolicyPreview"
137
137
```
138
138
139
-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:
139
+
It takes a few minutes for the status to show _Registered_. Verify the registration status by using the [az feature show][az-feature-show] command:
140
140
141
141
```azurecli-interactive
142
142
az feature show --namespace "Microsoft.ContainerService" --name "WindowsNetworkPolicyPreview"
143
143
```
144
144
145
-
When the status reflects *Registered*, refresh the registration of the `Microsoft.ContainerService` resource provider by using the [az provider register][az-provider-register] command:
145
+
When the status reflects _Registered_, refresh the registration of the `Microsoft.ContainerService` resource provider by using the [az provider register][az-provider-register] command:
146
146
147
147
```azurecli-interactive
148
148
az provider register --namespace Microsoft.ContainerService
@@ -370,10 +370,10 @@ Requirements:
370
370
- Azure CLI version 2.54 or later
371
371
- AKS REST API version 2023-08-02-preview or later
372
372
373
-
Notes:
374
-
- The uninstall process does _not_ remove Custom Resource Definitions (CRDs) and Custom Resources (CRs) used by Calico. These CRDs and CRs all have names ending with either "projectcalico.org" or "tigera.io".
375
-
These CRDs and associated CRs can be manually deleted _after_ Calico is successfully uninstalled (deleting the CRDs before removing Calico breaks the cluster).
376
-
- The upgrade will not remove any NetworkPolicy resources in the cluster, but after the uninstall these policies are no longer enforced.
373
+
> [!NOTE]
374
+
> - The uninstall process does _**not**_ remove Custom Resource Definitions (CRDs) and Custom Resources (CRs) used by Calico. These CRDs and CRs all have names ending with either "projectcalico.org" or "tigera.io".
375
+
> These CRDs and associated CRs can be manually deleted _after_ Calico is successfully uninstalled (deleting the CRDs before removing Calico breaks the cluster).
376
+
> - The upgrade will not remove any NetworkPolicy resources in the cluster, but after the uninstall these policies are no longer enforced.
377
377
378
378
> [!WARNING]
379
379
> The upgrade process triggers each node pool to be re-imaged simultaneously. Upgrading each node pool separately isn't supported. Any disruptions to cluster networking are similar to a node image upgrade or [Kubernetes version upgrade](./upgrade-cluster.md) where each node in a node pool is re-imaged.
0 commit comments