Skip to content

Commit b023382

Browse files
Updated NPM user doc- Removed the preview details
1 parent bf934cd commit b023382

File tree

2 files changed

+4
-74
lines changed

2 files changed

+4
-74
lines changed

articles/aks/use-network-policies.md

Lines changed: 3 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -33,31 +33,19 @@ Azure provides two ways to implement Network Policy. You choose a Network Policy
3333
* Azure's own implementation, called *Azure Network Policy Manager (NPM)*.
3434
* *Calico Network Policies*, an open-source network and network security solution founded by [Tigera][tigera].
3535

36-
Azure NPM for Linux uses Linux *IPTables* and Azure NPM for Windows uses *Host Network Service (HNS) ACLPolicies* to enforce the specified policies. Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as IPTable/HNS ACLPolicy filter rules.
36+
Azure NPM for Linux uses Linux *IPTables* to enforce the specified policies. Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as IPTable filter rules.
3737

3838
## Differences between Azure NPM and Calico Network Policy and their capabilities
3939

4040
| Capability | Azure NPM | Calico Network Policy |
4141
|------------------------------------------|----------------------------|-----------------------------|
42-
| Supported platforms | Linux, Windows Server 2022 | Linux, Windows Server 2019 and 2022 |
42+
| Supported platforms | Linux | Linux, Windows Server 2019 and 2022 |
4343
| Supported networking options | Azure CNI | Azure CNI (Linux, Windows Server 2019 and 2022) and kubenet (Linux) |
4444
| Compliance with Kubernetes specification | All policy types supported | All policy types supported |
4545
| Additional features | None | Extended policy model consisting of Global Network Policy, Global Network Set, and Host Endpoint. For more information on using the `calicoctl` CLI to manage these extended features, see [calicoctl user reference][calicoctl]. |
4646
| Support | Supported by Azure support and Engineering team | Calico community support. For more information on additional paid support, see [Project Calico support options][calico-support]. |
4747
| Logging | Logs available with **kubectl log -n kube-system <network-policy-pod>** command | For more information, see [Calico component logs][calico-logs] |
4848

49-
## Limitations:
50-
51-
Azure Network Policy Manager(NPM) does not support IPv6. Otherwise, Azure NPM fully supports the network policy spec in Linux.
52-
* In Windows, Azure NPM does not support the following:
53-
* named ports
54-
* SCTP protocol
55-
* negative match label or namespace selectors (e.g. all labels except "debug=true")
56-
* "except" CIDR blocks (a CIDR with exceptions)
57-
58-
>[!NOTE]
59-
> * Azure NPM pod logs will record an error if an unsupported policy is created.
60-
6149
## Create an AKS cluster and enable Network Policy
6250

6351
To see network policies in action, let's create an AKS cluster that supports network policy and then work on adding policies.
@@ -75,7 +63,7 @@ The following example script:
7563

7664
Instead of using a system-assigned identity, you can also use a user-assigned identity. For more information, see [Use managed identities](use-managed-identity.md).
7765

78-
### Create an AKS cluster with Azure NPM enabled - Linux only
66+
### Create an AKS cluster with Azure NPM enabled
7967

8068
In this section, we will work on creating a cluster with Linux node pools and Azure NPM enabled.
8169

@@ -99,64 +87,6 @@ az aks create \
9987
--network-policy azure
10088
```
10189

102-
### Create an AKS cluster with Azure NPM enabled - Windows Server 2022 (Preview)
103-
104-
In this section, we will work on creating a cluster with Windows node pools and Azure NPM enabled.
105-
106-
Please execute the following commands prior to creating a cluster:
107-
108-
```azurecli
109-
az extension add --name aks-preview
110-
az extension update --name aks-preview
111-
az feature register --namespace Microsoft.ContainerService --name AKSWindows2022Preview
112-
az feature register --namespace Microsoft.ContainerService --name WindowsNetworkPolicyPreview
113-
az provider register -n Microsoft.ContainerService
114-
```
115-
116-
> [!NOTE]
117-
> At this time, Azure NPM with Windows nodes is available on Windows Server 2022 only
118-
>
119-
120-
Now, you should replace the values for *$RESOURCE_GROUP_NAME*, *$CLUSTER_NAME* and *$WINDOWS_USERNAME* variables.
121-
122-
```azurecli-interactive
123-
$RESOURCE_GROUP_NAME=myResourceGroup-NP
124-
$CLUSTER_NAME=myAKSCluster
125-
$WINDOWS_USERNAME=myWindowsUserName
126-
$LOCATION=canadaeast
127-
```
128-
129-
Create a username to use as administrator credentials for your Windows Server containers on your cluster. The following command prompts you for a username. Set it to `$WINDOWS_USERNAME`(remember that the commands in this article are entered into a BASH shell).
130-
131-
```azurecli-interactive
132-
echo "Please enter the username to use as administrator credentials for Windows Server containers on your cluster: " && read WINDOWS_USERNAME
133-
```
134-
135-
Use the following command to create a cluster :
136-
137-
```azurecli
138-
az aks create \
139-
--resource-group $RESOURCE_GROUP_NAME \
140-
--name $CLUSTER_NAME \
141-
--node-count 1 \
142-
--windows-admin-username $WINDOWS_USERNAME \
143-
--network-plugin azure \
144-
--network-policy azure
145-
```
146-
147-
It takes a few minutes to create the cluster. By default, your cluster is created with only a Linux node pool. If you would like to use Windows node pools, you can add one. For example:
148-
149-
```azurecli
150-
az aks nodepool add \
151-
--resource-group $RESOURCE_GROUP_NAME \
152-
--cluster-name $CLUSTER_NAME \
153-
--os-type Windows \
154-
--name npwin \
155-
--node-count 1
156-
```
157-
158-
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
159-
16090
### Create an AKS cluster for Calico network policies
16191

16292
Create the AKS cluster and specify *azure* for the network plugin, and *calico* for the Network Policy. Using *calico* as the Network Policy enables Calico networking on both Linux and Windows node pools.

articles/virtual-network/kubernetes-network-policies.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Network Policies provides micro-segmentation for pods just like Network Security
2626

2727
![Kubernetes network policies overview](./media/kubernetes-network-policies/kubernetes-network-policies-overview.png)
2828

29-
Azure NPM implementation works in conjunction with the Azure CNI that provides VNet integration for containers. NPM is supported only on Linux and Windows Server 2022 today. The implementation enforces traffic filtering by configuring allow and deny IP rules in Linux IPTables or Windows HNS ACLPolicies based on the defined policies. These rules are grouped together using Linux IPSets or Windows HNS SetPolicies.
29+
Azure NPM implementation works in conjunction with the Azure CNI that provides VNet integration for containers. NPM is supported only on Linux today. The implementation enforces traffic filtering by configuring allow and deny IP rules in Linux IPTables based on the defined policies. These rules are grouped together using Linux IPSets.
3030

3131
## Planning security for your Kubernetes cluster
3232
When implementing security for your cluster, use network security groups (NSGs) to filter traffic entering and leaving your cluster subnet (North-South traffic). Use Azure NPM for traffic between pods in your cluster (East-West traffic).

0 commit comments

Comments
 (0)