Skip to content

Commit 684384f

Browse files
phealyphealy
committed
add host port auto assign documentation, split node public ip to separate page
1 parent cc2ca6c commit 684384f

File tree

2 files changed

+328
-209
lines changed

2 files changed

+328
-209
lines changed

‎articles/aks/use-multiple-node-pools.md

Lines changed: 2 additions & 209 deletions
Original file line numberDiff line numberDiff line change
@@ -721,215 +721,6 @@ az deployment group create \
721721

722722
It may take a few minutes to update your AKS cluster depending on the node pool settings and operations you define in your Resource Manager template.
723723

724-
## Assign a public IP per node for your node pools
725-
726-
AKS nodes don't require their own public IP addresses for communication. However, scenarios may require nodes in a node pool to receive their own dedicated public IP addresses. A common scenario is for gaming workloads, where a console needs to make a direct connection to a cloud virtual machine to minimize hops. This scenario can be achieved on AKS by using Node Public IP.
727-
728-
First, create a new resource group.
729-
730-
```azurecli-interactive
731-
az group create --name myResourceGroup2 --location eastus
732-
```
733-
734-
Create a new AKS cluster and attach a public IP for your nodes. Each of the nodes in the node pool receives a unique public IP. You can verify this by looking at the Virtual Machine Scale Set instances.
735-
736-
```azurecli-interactive
737-
az aks create -g MyResourceGroup2 -n MyManagedCluster -l eastus --enable-node-public-ip
738-
```
739-
740-
For existing AKS clusters, you can also add a new node pool, and attach a public IP for your nodes.
741-
742-
```azurecli-interactive
743-
az aks nodepool add -g MyResourceGroup2 --cluster-name MyManagedCluster -n nodepool2 --enable-node-public-ip
744-
```
745-
746-
### Use a public IP prefix
747-
748-
There are a number of [benefits to using a public IP prefix][public-ip-prefix-benefits]. AKS supports using addresses from an existing public IP prefix for your nodes by passing the resource ID with the flag `node-public-ip-prefix` when creating a new cluster or adding a node pool.
749-
750-
First, create a public IP prefix using [az network public-ip prefix create][az-public-ip-prefix-create]:
751-
752-
```azurecli-interactive
753-
az network public-ip prefix create --length 28 --location eastus --name MyPublicIPPrefix --resource-group MyResourceGroup3
754-
```
755-
756-
View the output, and take note of the `id` for the prefix:
757-
758-
```output
759-
{
760-
...
761-
"id": "/subscriptions/<subscription-id>/resourceGroups/myResourceGroup3/providers/Microsoft.Network/publicIPPrefixes/MyPublicIPPrefix",
762-
...
763-
}
764-
```
765-
766-
Finally, when creating a new cluster or adding a new node pool, use the flag `node-public-ip-prefix` and pass in the prefix's resource ID:
767-
768-
```azurecli-interactive
769-
az aks create -g MyResourceGroup3 -n MyManagedCluster -l eastus --enable-node-public-ip --node-public-ip-prefix /subscriptions/<subscription-id>/resourcegroups/MyResourceGroup3/providers/Microsoft.Network/publicIPPrefixes/MyPublicIPPrefix
770-
```
771-
772-
### Use public IP tags on node public IPs (PREVIEW)
773-
774-
Public IP tags can be utilized on node public IPs to utilize the [Azure Routing Preference](/azure/virtual-network/ip-services/routing-preference-overview.md) feature.
775-
776-
[!INCLUDE [preview features callout](includes/preview/preview-callout.md)]
777-
778-
#### Install the aks-preview Azure CLI extension
779-
780-
Version 0.5.115 of the aks-preview extension is required.
781-
782-
To install the aks-preview extension, run the following command:
783-
784-
```azurecli
785-
az extension add --name aks-preview
786-
```
787-
788-
Run the following command to update to the latest version of the extension released:
789-
790-
```azurecli
791-
az extension update --name aks-preview
792-
```
793-
794-
#### Register the 'NodePublicIPTagsPreview' feature flag
795-
796-
Register the `NodePublicIPTagsPreview` feature flag by using the [`az feature register`][az-feature-register] command, as shown in the following example:
797-
798-
```azurecli-interactive
799-
az feature register --namespace "Microsoft.ContainerService" --name "NodePublicIPTagsPreview"
800-
```
801-
802-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:
803-
804-
```azurecli-interactive
805-
az feature show --namespace "Microsoft.ContainerService" --name "NodePublicIPTagsPreview"
806-
```
807-
808-
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
809-
810-
```azurecli-interactive
811-
az provider register --namespace Microsoft.ContainerService
812-
```
813-
814-
#### Create a new cluster using routing preference internet
815-
816-
```azurecli-interactive
817-
az aks create -n <clusterName> -l <location> -g <resourceGroup> \
818-
--enable-node-public-ip \
819-
--node-public-ip-tags RoutingPreference=Internet
820-
```
821-
822-
#### Add a node pool with routing preference internet
823-
824-
```azurecli-interactive
825-
az aks nodepool add --cluster-name <clusterName> -n <nodepoolName> -l <location> -g <resourceGroup> \
826-
--enable-node-public-ip \
827-
--node-public-ip-tags RoutingPreference=Internet
828-
```
829-
830-
### Locate public IPs for nodes
831-
832-
You can locate the public IPs for your nodes in various ways:
833-
834-
* Use the Azure CLI command [az vmss list-instance-public-ips][az-list-ips].
835-
* Use [PowerShell or Bash commands][vmss-commands].
836-
* You can also view the public IPs in the Azure portal by viewing the instances in the Virtual Machine Scale Set.
837-
838-
> [!Important]
839-
> The [node resource group][node-resource-group] contains the nodes and their public IPs. Use the node resource group when executing commands to find the public IPs for your nodes.
840-
841-
```azurecli
842-
az vmss list-instance-public-ips -g MC_MyResourceGroup2_MyManagedCluster_eastus -n YourVirtualMachineScaleSetName
843-
```
844-
845-
### Allow host port connections and add node pools to application security groups
846-
847-
AKS nodes utilizing node public IPs that host services on their host address need to have an NSG rule added to allow the traffic. Adding the desired ports in the node pool configuration will create the appropriate allow rules in the cluster network security group.
848-
849-
If a network security group is in place on the subnet with a cluster using bring-your-own virtual network, an allow rule must be added to that network security group. This can be limited to the nodes in a given node pool by adding the node pool to an [application security group](/azure/virtual-network/network-security-groups-overview#application-security-groups) (ASG). A managed ASG will be created by default in the managed resource group if allowed host ports are specified. Nodes can also be added to one or more custom ASGs by specifying the resource ID of the NSG(s) in the nodepool parameters.
850-
851-
#### Host port specification format
852-
853-
When specifying the list of ports to allow, use a comma-separate list with entries in the format of `port/protocol` or `startPort-endPort/protocol`.
854-
855-
Examples:
856-
857-
- 80/tcp
858-
- 80/tcp,443/tcp
859-
- 53/udp,80/tcp
860-
- 50000-60000/tcp
861-
862-
[!INCLUDE [preview features callout](includes/preview/preview-callout.md)]
863-
864-
#### Install the aks-preview Azure CLI extension
865-
866-
Version 0.5.110 of the aks-preview extension is required.
867-
868-
To install the aks-preview extension, run the following command:
869-
870-
```azurecli
871-
az extension add --name aks-preview
872-
```
873-
874-
Run the following command to update to the latest version of the extension released:
875-
876-
```azurecli
877-
az extension update --name aks-preview
878-
```
879-
880-
#### Register the 'NodePublicIPNSGControlPreview' feature flag
881-
882-
Register the `NodePublicIPNSGControlPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:
883-
884-
```azurecli-interactive
885-
az feature register --namespace "Microsoft.ContainerService" --name "NodePublicIPNSGControlPreview"
886-
```
887-
888-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:
889-
890-
```azurecli-interactive
891-
az feature show --namespace "Microsoft.ContainerService" --name "NodePublicIPNSGControlPreview"
892-
```
893-
894-
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
895-
896-
```azurecli-interactive
897-
az provider register --namespace Microsoft.ContainerService
898-
```
899-
900-
#### Create a new cluster with allowed ports and application security groups
901-
902-
```azurecli-interactive
903-
az aks create \
904-
--resource-group <resourceGroup> \
905-
--name <clusterName> \
906-
--nodepool-name <nodepoolName> \
907-
--nodepool-allowed-host-ports 80/tcp,443/tcp,53/udp,40000-60000/tcp,40000-50000/udp\
908-
--nodepool-asg-ids "<asgId>,<asgId>"
909-
```
910-
911-
#### Add a new node pool with allowed ports and application security groups
912-
913-
```azurecli-interactive
914-
az aks nodepool add \
915-
--resource-group <resourceGroup> \
916-
--cluster-name <clusterName> \
917-
--name <nodepoolName> \
918-
--nodepool-allowed-host-ports 80/tcp,443/tcp,53/udp,40000-60000/tcp,40000-50000/udp\
919-
--nodepool-asg-ids "<asgId>,<asgId>"
920-
```
921-
922-
#### Update the allowed ports and application security groups for a node pool
923-
924-
```azurecli-interactive
925-
az aks nodepool update \
926-
--resource-group <resourceGroup> \
927-
--cluster-name <clusterName> \
928-
--name <nodepoolName> \
929-
--nodepool-allowed-host-ports 80/tcp,443/tcp,53/udp,40000-60000/tcp,40000-50000/udp\
930-
--nodepool-asg-ids "<asgId>,<asgId>"
931-
```
932-
933724
## Clean up resources
934725

935726
In this article, you created an AKS cluster that includes GPU-based nodes. To reduce unnecessary cost, you may want to delete the *gpunodepool*, or the whole AKS cluster.
@@ -962,6 +753,8 @@ az group delete --name myResourceGroup2 --yes --no-wait
962753

963754
* Use [proximity placement groups][reduce-latency-ppg] to reduce latency for your AKS applications.
964755

756+
* Use [instance-level public IP addresses](use-node-public-ips.md) to make your nodes able to serve traffic directly.
757+
965758
<!-- EXTERNAL LINKS -->
966759

967760
[kubernetes-drain]: https://kubernetes.io/docs/tasks/administer-cluster/safely-drain-node/

0 commit comments

Comments
 (0)