Skip to content

Commit 8b6b9f2

Browse files
schaffererinschaffererin
committed
spacing issues
1 parent 7e8211d commit 8b6b9f2

File tree

1 file changed

+52
-54
lines changed

1 file changed

+52
-54
lines changed

‎articles/aks/limit-egress-traffic.md

Lines changed: 52 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -96,13 +96,13 @@ Provision a virtual network with two separate subnets: one for the cluster and o
9696
9797
You need to configure Azure Firewall inbound and outbound rules. The main purpose of the firewall is to enable organizations to configure granular ingress and egress traffic rules into and out of the AKS cluster.
9898
99-
![Firewall and UDR](media/limit-egress-traffic/firewall-udr.png)
100-
10199
> [!IMPORTANT]
102100
>
103101
> If your cluster or application creates a large number of outbound connections directed to the same or a small subset of destinations, you might require more firewall frontend IPs to avoid maxing out the ports per frontend IP.
104102
>
105-
> For more information on how to create an Azure Firewall with multiple IPs, see [Create an Azure Firewall with multiple public IP addresses using Bicep](../firewall/quick-create-multiple-ip-bicep.md)
103+
> For more information on how to create an Azure Firewall with multiple IPs, see [Create an Azure Firewall with multiple public IP addresses using Bicep](../firewall/quick-create-multiple-ip-bicep.md).
104+
105+
![Firewall and UDR](media/limit-egress-traffic/firewall-udr.png)
106106
107107
1. Create a standard SKU public IP resource using the [`az network public-ip create`][az-network-public-ip-create] command. This resource will be used as the Azure Firewall frontend address.
108108
@@ -122,13 +122,11 @@ You need to configure Azure Firewall inbound and outbound rules. The main purpos
122122
az network firewall create -g $RG -n $FWNAME -l $LOC --enable-dns-proxy true
123123
```
124124
125-
The IP address created earlier can now be assigned to the firewall frontend.
125+
Setting up the public IP address to the Azure Firewall may take a few minutes. Once it's ready, the IP address created earlier can be assigned to the firewall front end.
126126
127-
> [!NOTE]
128-
>
129-
> Setting up the public IP address to the Azure Firewall may take a few minutes.
130-
>
131-
> To leverage FQDN on network rules, we need DNS proxy enabled. When DNS proxy is enabled when, the firewall listens on port 53 and forwards DNS requests to the DNS server specified above. This allows the firewall to translate the FQDN automatically.
127+
> [!NOTE]
128+
>
129+
> To leverage FQDN on network rules, we need DNS proxy enabled. When DNS proxy is enabled, the firewall listens on port 53 and forwards DNS requests to the DNS server specified above. This allows the firewall to translate the FQDN automatically.
132130
133131
4. Create an Azure Firewall IP configuration using the [`az network firewall ip-config create`][az-network-firewall-ip-config-create] command.
134132
@@ -143,9 +141,9 @@ The IP address created earlier can now be assigned to the firewall frontend.
143141
FWPRIVATE_IP=$(az network firewall show -g $RG -n $FWNAME --query "ipConfigurations[0].privateIpAddress" -o tsv)
144142
```
145143
146-
> [!NOTE]
147-
>
148-
> If you use secure access to the AKS API server with [authorized IP address ranges](./api-server-authorized-ip-ranges.md), you need to add the firewall public IP into the authorized IP range.
144+
> [!NOTE]
145+
>
146+
> If you use secure access to the AKS API server with [authorized IP address ranges](./api-server-authorized-ip-ranges.md), you need to add the firewall public IP into the authorized IP range.
149147
150148
### Create a UDR with a hop to Azure Firewall
151149
@@ -253,48 +251,48 @@ If you don't have user-assigned identites, follow the steps in this section. If
253251
az identity create --name myIdentity --resource-group myResourceGroup
254252
```
255253
256-
The output should resemble the following:
257-
258-
```output
259-
{
260-
"clientId": "<client-id>",
261-
"clientSecretUrl": "<clientSecretUrl>",
262-
"id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity",
263-
"location": "westus2",
264-
"name": "myIdentity",
265-
"principalId": "<principal-id>",
266-
"resourceGroup": "myResourceGroup",
267-
"tags": {},
268-
"tenantId": "<tenant-id>",
269-
"type": "Microsoft.ManagedIdentity/userAssignedIdentities"
270-
}
271-
```
254+
The output should resemble the following example output:
255+
256+
```output
257+
{
258+
"clientId": "<client-id>",
259+
"clientSecretUrl": "<clientSecretUrl>",
260+
"id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity",
261+
"location": "westus2",
262+
"name": "myIdentity",
263+
"principalId": "<principal-id>",
264+
"resourceGroup": "myResourceGroup",
265+
"tags": {},
266+
"tenantId": "<tenant-id>",
267+
"type": "Microsoft.ManagedIdentity/userAssignedIdentities"
268+
}
269+
```
272270
273271
2. Create a kubelet managed identity using the [`az identity create`][az-identity-create] command.
274272
275273
```azurecli
276274
az identity create --name myKubeletIdentity --resource-group myResourceGroup
277275
```
278276

279-
The output should resemble the following:
280-
281-
```output
282-
{
283-
"clientId": "<client-id>",
284-
"clientSecretUrl": "<clientSecretUrl>",
285-
"id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myKubeletIdentity",
286-
"location": "westus2",
287-
"name": "myKubeletIdentity",
288-
"principalId": "<principal-id>",
289-
"resourceGroup": "myResourceGroup",
290-
"tags": {},
291-
"tenantId": "<tenant-id>",
292-
"type": "Microsoft.ManagedIdentity/userAssignedIdentities"
293-
}
294-
```
277+
The output should resemble the following example output:
295278

296-
> [!NOTE]
297-
> For creating and using your own VNet and route table where the resources are outside of the worker node resource group, the CLI will add the role assignment automatically. If you're using an ARM template or other client, you need to use the Principal ID of the cluster managed identity to perform a [role assignment][add role to identity].
279+
```output
280+
{
281+
"clientId": "<client-id>",
282+
"clientSecretUrl": "<clientSecretUrl>",
283+
"id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myKubeletIdentity",
284+
"location": "westus2",
285+
"name": "myKubeletIdentity",
286+
"principalId": "<principal-id>",
287+
"resourceGroup": "myResourceGroup",
288+
"tags": {},
289+
"tenantId": "<tenant-id>",
290+
"type": "Microsoft.ManagedIdentity/userAssignedIdentities"
291+
}
292+
```
293+
294+
> [!NOTE]
295+
> If you create your own VNet and route table where the resources are outside of the worker node resource group, the CLI will add the role assignment automatically. If you're using an ARM template or other client, you need to use the Principal ID of the cluster managed identity to perform a [role assignment][add role to identity].
298296
299297
### Create an AKS cluster with user-assigned identities
300298

@@ -576,15 +574,15 @@ To configure inbound connectivity, you need to write a DNAT rule to the Azure Fi
576574
kubectl get services
577575
```
578576
579-
The IP address will be listed in the `EXTERNAL-IP` column.
577+
The IP address will be listed in the `EXTERNAL-IP` column, as shown in the following example output:
580578
581-
```bash
582-
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
583-
kubernetes ClusterIP 10.41.0.1 <none> 443/TCP 10h
584-
voting-analytics ClusterIP 10.41.88.129 <none> 8080/TCP 9m
585-
voting-app LoadBalancer 10.41.185.82 20.39.18.6 80:32718/TCP 9m
586-
voting-storage ClusterIP 10.41.221.201 <none> 3306/TCP 9m
587-
```
579+
```bash
580+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
581+
kubernetes ClusterIP 10.41.0.1 <none> 443/TCP 10h
582+
voting-analytics ClusterIP 10.41.88.129 <none> 8080/TCP 9m
583+
voting-app LoadBalancer 10.41.185.82 20.39.18.6 80:32718/TCP 9m
584+
voting-storage ClusterIP 10.41.221.201 <none> 3306/TCP 9m
585+
```
588586
589587
2. Get the service IP using the `kubectl get svc voting-app` command.
590588

0 commit comments

Comments
 (0)