You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/concepts-network.md
+33-39Lines changed: 33 additions & 39 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,17 +10,16 @@ ms.custom: fasttrack-edit
10
10
11
11
In a container-based, microservices approach to application development, application components work together to process their tasks. Kubernetes provides various resources enabling this cooperation:
12
12
13
-
* You can connect to and expose applications internally or externally.
14
-
* You can build highly available applications by load balancing your applications.
15
-
* You can restrict the flow of network traffic into or between pods and nodes to improve security.
16
-
* You can configure Ingress traffic for SSL/TLS termination or routing of multiple components for your more complex applications.
13
+
- You can connect to and expose applications internally or externally.
14
+
- You can build highly available applications by load balancing your applications.
15
+
- You can restrict the flow of network traffic into or between pods and nodes to improve security.
16
+
- You can configure Ingress traffic for SSL/TLS termination or routing of multiple components for your more complex applications.
17
17
18
18
This article introduces the core concepts that provide networking to your applications in AKS:
@@ -32,8 +31,6 @@ Kubernetes employs a virtual networking layer to manage access within and betwee
32
31
33
32
Regarding specific Kubernetes functionalities:
34
33
35
-
-**Services**: Services is used to logically group pods, allowing direct access to them through a specific IP address or DNS name on a designated port.
36
-
-**Service types**: Specifies the kind of Service you wish to create.
37
34
-**Load balancer**: You can use a load balancer to distribute network traffic evenly across various resources.
38
35
-**Ingress controllers**: These facilitate Layer 7 routing, which is essential for directing application traffic.
39
36
-**Egress traffic control**: Kubernetes allows you to manage and control outbound traffic from cluster nodes.
@@ -46,33 +43,32 @@ In the context of the Azure platform:
46
43
- As you open network ports to pods, Azure automatically configures the necessary network security group rules.
47
44
- Azure can also manage external DNS configurations for HTTP application routing as new Ingress routes are established.
48
45
49
-
## Services
50
46
51
47
To simplify the network configuration for application workloads, Kubernetes uses *Services* to logically group a set of pods together and provide network connectivity. You can specify a Kubernetes *ServiceType* to define the type of Service you want. For example, if you want to expose a Service on an external IP address outside of your cluster. For more information, see the Kubernetes documentation on [Publishing Services (ServiceTypes)][service-types].
52
48
53
49
The following ServiceTypes are available:
54
50
55
-
***ClusterIP**
51
+
-**ClusterIP**
56
52
57
53
ClusterIP creates an internal IP address for use within the AKS cluster. The ClusterIP Service is good for *internal-only applications* that support other workloads within the cluster. ClusterIP is the default used if you don't explicitly specify a type for a Service.
58
54
59
55
![Diagram showing ClusterIP traffic flow in an AKS cluster][aks-clusterip]
60
56
61
-
***NodePort**
57
+
-**NodePort**
62
58
63
59
NodePort creates a port mapping on the underlying node that allows the application to be accessed directly with the node IP address and port.
64
60
65
61
![Diagram showing NodePort traffic flow in an AKS cluster][aks-nodeport]
66
62
67
-
***LoadBalancer**
63
+
-**LoadBalancer**
68
64
69
65
LoadBalancer creates an Azure load balancer resource, configures an external IP address, and connects the requested pods to the load balancer backend pool. To allow customers' traffic to reach the application, load balancing rules are created on the desired ports.
70
66
71
67
![Diagram showing Load Balancer traffic flow in an AKS cluster][aks-loadbalancer]
72
68
73
69
For HTTP load balancing of inbound traffic, another option is to use an [Ingress controller](#ingress-controllers).
74
70
75
-
***ExternalName**
71
+
-**ExternalName**
76
72
77
73
Creates a specific DNS entry for easier application access.
78
74
@@ -86,11 +82,11 @@ Learn more about Services in the [Kubernetes docs][k8s-service].
86
82
87
83
In AKS, you can deploy a cluster that uses one of the following network models:
88
84
89
-
****Kubenet* networking**
85
+
-***Kubenet* networking**
90
86
91
87
The network resources are typically created and configured as the AKS cluster is deployed.
The AKS cluster is connected to existing virtual network resources and configurations.
96
92
@@ -147,14 +143,14 @@ It's possible to install in AKS a non-Microsoft CNI using the [Bring your own CN
147
143
148
144
Both kubenet and Azure CNI provide network connectivity for your AKS clusters. However, there are advantages and disadvantages to each. At a high level, the following considerations apply:
149
145
150
-
***kubenet**
146
+
-**kubenet**
151
147
152
-
* Conserves IP address space.
153
-
* Uses Kubernetes internal or external load balancers to reach pods from outside of the cluster.
154
-
* You manually manage and maintain user-defined routes (UDRs).
155
-
* Maximum of 400 nodes per cluster.
148
+
- Conserves IP address space.
149
+
- Uses Kubernetes internal or external load balancers to reach pods from outside of the cluster.
150
+
- You manually manage and maintain user-defined routes (UDRs).
151
+
- Maximum of 400 nodes per cluster.
156
152
157
-
***Azure CNI**
153
+
-**Azure CNI**
158
154
159
155
* Pods get full virtual network connectivity and can be directly reached via their private IP address from connected networks.
160
156
* Requires more IP address space.
@@ -185,13 +181,13 @@ For more information on Azure CNI and kubenet and to help determine which option
185
181
186
182
Whatever network model you use, both kubenet and Azure CNI can be deployed in one of the following ways:
187
183
188
-
* The Azure platform can automatically create and configure the virtual network resources when you create an AKS cluster.
189
-
* You can manually create and configure the virtual network resources and attach to those resources when you create your AKS cluster.
184
+
- The Azure platform can automatically create and configure the virtual network resources when you create an AKS cluster.
185
+
- You can manually create and configure the virtual network resources and attach to those resources when you create your AKS cluster.
190
186
191
187
Although capabilities like service endpoints or UDRs are supported with both kubenet and Azure CNI, the [support policies for AKS][support-policies] define what changes you can make. For example:
192
188
193
-
* If you manually create the virtual network resources for an AKS cluster, you're supported when configuring your own UDRs or service endpoints.
194
-
* If the Azure platform automatically creates the virtual network resources for your AKS cluster, you can't manually change those AKS-managed resources to configure your own UDRs or service endpoints.
189
+
- If you manually create the virtual network resources for an AKS cluster, you're supported when configuring your own UDRs or service endpoints.
190
+
- If the Azure platform automatically creates the virtual network resources for your AKS cluster, you can't manually change those AKS-managed resources to configure your own UDRs or service endpoints.
195
191
196
192
## Ingress controllers
197
193
@@ -232,11 +228,11 @@ The following table lists the different scenarios where you might use each ingre
232
228
233
229
The application routing addon is the recommended way to configure an Ingress controller in AKS. The application routing addon is a fully managed ingress controller for Azure Kubernetes Service (AKS) that provides the following features:
234
230
235
-
* Easy configuration of managed NGINX Ingress controllers based on Kubernetes NGINX Ingress controller.
231
+
- Easy configuration of managed NGINX Ingress controllers based on Kubernetes NGINX Ingress controller.
236
232
237
-
* Integration with Azure DNS for public and private zone management.
233
+
- Integration with Azure DNS for public and private zone management.
238
234
239
-
* SSL termination with certificates stored in Azure Key Vault.
235
+
- SSL termination with certificates stored in Azure Key Vault.
240
236
241
237
For more information about the application routing addon, see [Managed NGINX ingress with the application routing add-on](app-routing.md).
242
238
@@ -268,8 +264,8 @@ For more information, see [How network security groups filter network traffic][n
268
264
269
265
By default, all pods in an AKS cluster can send and receive traffic without limitations. For improved security, define rules that control the flow of traffic, like:
270
266
271
-
* Back-end applications are only exposed to required frontend services.
272
-
* Database components are only accessible to the application tiers that connect to them.
267
+
- Back-end applications are only exposed to required frontend services.
268
+
- Database components are only accessible to the application tiers that connect to them.
273
269
274
270
Network policy is a Kubernetes feature available in AKS that lets you control the traffic flow between pods. You can allow or deny traffic to the pod based on settings such as assigned labels, namespace, or traffic port. While network security groups are better for AKS nodes, network policies are a more suited, cloud-native way to control the flow of traffic for pods. As pods are dynamically created in an AKS cluster, required network policies can be automatically applied.
275
271
@@ -283,11 +279,11 @@ For associated best practices, see [Best practices for network connectivity and
283
279
284
280
For more information on core Kubernetes and AKS concepts, see the following articles:
285
281
286
-
*[Kubernetes / AKS clusters and workloads][aks-concepts-clusters-workloads]
287
-
*[Kubernetes / AKS access and identity][aks-concepts-identity]
288
-
*[Kubernetes / AKS security][aks-concepts-security]
289
-
*[Kubernetes / AKS storage][aks-concepts-storage]
290
-
*[Kubernetes / AKS scale][aks-concepts-scale]
282
+
-[Kubernetes / AKS clusters and workloads][aks-concepts-clusters-workloads]
283
+
-[Kubernetes / AKS access and identity][aks-concepts-identity]
284
+
-[Kubernetes / AKS security][aks-concepts-security]
title: Concepts - Services in Azure Kubernetes Services (AKS)
3
+
description: Learn about networking Services in Azure Kubernetes Service (AKS), including what services are in Kubernetes and what types of Services are available in AKS.
4
+
ms.topic: conceptual
5
+
ms.date: 04/03/2024
6
+
ms.custom: fasttrack-edit
7
+
---
8
+
9
+
# Kubernetes Services in AKS
10
+
11
+
Kubernetes Services are used to logically group pods and provide network connectivity by allowing direct access to them through a specific IP address or DNS name on a designated port. This allows you to expose your application workloads to other services within the cluster or to external clients without having to manually manage the network configuration for each pod hosting a workload.
12
+
13
+
You can specify a Kubernetes _ServiceType_ to define the type of Service you want, e.g., if you want to expose a Service on an external IP address outside of your cluster. For more information, see the Kubernetes documentation on [Publishing Services (ServiceTypes)][service-types].
14
+
15
+
The following ServiceTypes are available in AKS:
16
+
17
+
## ClusterIP
18
+
19
+
ClusterIP creates an internal IP address for use within the AKS cluster. The ClusterIP Service is good for _internal-only applications_ that support other workloads within the cluster. ClusterIP is used by default if you don't explicitly specify a type for a Service.
20
+
21
+
![Diagram showing ClusterIP traffic flow in an AKS cluster][aks-clusterip]
22
+
23
+
## NodePort
24
+
25
+
NodePort creates a port mapping on the underlying node that allows the application to be accessed directly with the node IP address and port.
26
+
27
+
![Diagram showing NodePort traffic flow in an AKS cluster][aks-nodeport]
28
+
29
+
## LoadBalancer
30
+
31
+
LoadBalancer creates an Azure load balancer resource, configures an external IP address, and connects the requested pods to the load balancer backend pool. To allow customers' traffic to reach the application, load balancing rules are created on the desired ports.
32
+
33
+
![Diagram showing Load Balancer traffic flow in an AKS cluster][aks-loadbalancer]
34
+
35
+
For HTTP load balancing of inbound traffic, another option is to use an [Ingress controller](#ingress-controllers).
36
+
37
+
## ExternalName
38
+
39
+
Creates a specific DNS entry for easier application access.
40
+
41
+
Either the load balancers and services IP address can be dynamically assigned, or you can specify an existing static IP address. You can assign both internal and external static IP addresses. Existing static IP addresses are often tied to a DNS entry.
42
+
43
+
You can create both _internal_ and _external_ load balancers. Internal load balancers are only assigned a private IP address, so they can't be accessed from the Internet.
44
+
45
+
Learn more about Services in the [Kubernetes docs][k8s-service].
0 commit comments