You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/use-network-policies.md
+3-73Lines changed: 3 additions & 73 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,31 +33,19 @@ Azure provides two ways to implement Network Policy. You choose a Network Policy
33
33
* Azure's own implementation, called *Azure Network Policy Manager (NPM)*.
34
34
**Calico Network Policies*, an open-source network and network security solution founded by [Tigera][tigera].
35
35
36
-
Azure NPM for Linux uses Linux *IPTables*and Azure NPM for Windows uses *Host Network Service (HNS) ACLPolicies*to enforce the specified policies. Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as IPTable/HNS ACLPolicy filter rules.
36
+
Azure NPM for Linux uses Linux *IPTables* to enforce the specified policies. Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as IPTable filter rules.
37
37
38
38
## Differences between Azure NPM and Calico Network Policy and their capabilities
| Supported platforms | Linux, Windows Server 2022 | Linux, Windows Server 2019 and 2022 |
42
+
| Supported platforms | Linux | Linux, Windows Server 2019 and 2022 |
43
43
| Supported networking options | Azure CNI | Azure CNI (Linux, Windows Server 2019 and 2022) and kubenet (Linux) |
44
44
| Compliance with Kubernetes specification | All policy types supported | All policy types supported |
45
45
| Additional features | None | Extended policy model consisting of Global Network Policy, Global Network Set, and Host Endpoint. For more information on using the `calicoctl` CLI to manage these extended features, see [calicoctl user reference][calicoctl]. |
46
46
| Support | Supported by Azure support and Engineering team | Calico community support. For more information on additional paid support, see [Project Calico support options][calico-support]. |
47
47
| Logging | Logs available with **kubectl log -n kube-system <network-policy-pod>** command | For more information, see [Calico component logs][calico-logs]|
48
48
49
-
## Limitations:
50
-
51
-
Azure Network Policy Manager(NPM) does not support IPv6. Otherwise, Azure NPM fully supports the network policy spec in Linux.
52
-
* In Windows, Azure NPM does not support the following:
53
-
* named ports
54
-
* SCTP protocol
55
-
* negative match label or namespace selectors (e.g. all labels except "debug=true")
56
-
* "except" CIDR blocks (a CIDR with exceptions)
57
-
58
-
>[!NOTE]
59
-
> * Azure NPM pod logs will record an error if an unsupported policy is created.
60
-
61
49
## Create an AKS cluster and enable Network Policy
62
50
63
51
To see network policies in action, let's create an AKS cluster that supports network policy and then work on adding policies.
@@ -75,7 +63,7 @@ The following example script:
75
63
76
64
Instead of using a system-assigned identity, you can also use a user-assigned identity. For more information, see [Use managed identities](use-managed-identity.md).
77
65
78
-
### Create an AKS cluster with Azure NPM enabled - Linux only
66
+
### Create an AKS cluster with Azure NPM enabled
79
67
80
68
In this section, we will work on creating a cluster with Linux node pools and Azure NPM enabled.
81
69
@@ -99,64 +87,6 @@ az aks create \
99
87
--network-policy azure
100
88
```
101
89
102
-
### Create an AKS cluster with Azure NPM enabled - Windows Server 2022 (Preview)
103
-
104
-
In this section, we will work on creating a cluster with Windows node pools and Azure NPM enabled.
105
-
106
-
Please execute the following commands prior to creating a cluster:
107
-
108
-
```azurecli
109
-
az extension add --name aks-preview
110
-
az extension update --name aks-preview
111
-
az feature register --namespace Microsoft.ContainerService --name AKSWindows2022Preview
112
-
az feature register --namespace Microsoft.ContainerService --name WindowsNetworkPolicyPreview
113
-
az provider register -n Microsoft.ContainerService
114
-
```
115
-
116
-
> [!NOTE]
117
-
> At this time, Azure NPM with Windows nodes is available on Windows Server 2022 only
118
-
>
119
-
120
-
Now, you should replace the values for *$RESOURCE_GROUP_NAME*, *$CLUSTER_NAME* and *$WINDOWS_USERNAME* variables.
121
-
122
-
```azurecli-interactive
123
-
$RESOURCE_GROUP_NAME=myResourceGroup-NP
124
-
$CLUSTER_NAME=myAKSCluster
125
-
$WINDOWS_USERNAME=myWindowsUserName
126
-
$LOCATION=canadaeast
127
-
```
128
-
129
-
Create a username to use as administrator credentials for your Windows Server containers on your cluster. The following command prompts you for a username. Set it to `$WINDOWS_USERNAME`(remember that the commands in this article are entered into a BASH shell).
130
-
131
-
```azurecli-interactive
132
-
echo "Please enter the username to use as administrator credentials for Windows Server containers on your cluster: " && read WINDOWS_USERNAME
133
-
```
134
-
135
-
Use the following command to create a cluster :
136
-
137
-
```azurecli
138
-
az aks create \
139
-
--resource-group $RESOURCE_GROUP_NAME \
140
-
--name $CLUSTER_NAME \
141
-
--node-count 1 \
142
-
--windows-admin-username $WINDOWS_USERNAME \
143
-
--network-plugin azure \
144
-
--network-policy azure
145
-
```
146
-
147
-
It takes a few minutes to create the cluster. By default, your cluster is created with only a Linux node pool. If you would like to use Windows node pools, you can add one. For example:
148
-
149
-
```azurecli
150
-
az aks nodepool add \
151
-
--resource-group $RESOURCE_GROUP_NAME \
152
-
--cluster-name $CLUSTER_NAME \
153
-
--os-type Windows \
154
-
--name npwin \
155
-
--node-count 1
156
-
```
157
-
158
-
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
159
-
160
90
### Create an AKS cluster for Calico network policies
161
91
162
92
Create the AKS cluster and specify *azure* for the network plugin, and *calico* for the Network Policy. Using *calico* as the Network Policy enables Calico networking on both Linux and Windows node pools.
Azure NPM implementation works in conjunction with the Azure CNI that provides VNet integration for containers. NPM is supported only on Linux and Windows Server 2022 today. The implementation enforces traffic filtering by configuring allow and deny IP rules in Linux IPTables or Windows HNS ACLPolicies based on the defined policies. These rules are grouped together using Linux IPSets or Windows HNS SetPolicies.
29
+
Azure NPM implementation works in conjunction with the Azure CNI that provides VNet integration for containers. NPM is supported only on Linux today. The implementation enforces traffic filtering by configuring allow and deny IP rules in Linux IPTables based on the defined policies. These rules are grouped together using Linux IPSets.
30
30
31
31
## Planning security for your Kubernetes cluster
32
32
When implementing security for your cluster, use network security groups (NSGs) to filter traffic entering and leaving your cluster subnet (North-South traffic). Use Azure NPM for traffic between pods in your cluster (East-West traffic).
0 commit comments