You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Concepts - Services in Azure Kubernetes Services (AKS)
3
+
description: Learn about networking Services in Azure Kubernetes Service (AKS), including what services are in Kubernetes and what types of Services are available in AKS.
4
+
ms.topic: conceptual
5
+
ms.date: 04/08/2024
6
+
ms.custom: fasttrack-edit
7
+
---
8
+
9
+
# Kubernetes Services in AKS
10
+
11
+
Kubernetes Services are used to logically group pods and provide network connectivity by allowing direct access to them through a specific IP address or DNS name on a designated port. This allows you to expose your application workloads to other services within the cluster or to external clients without having to manually manage the network configuration for each pod hosting a workload.
12
+
13
+
You can specify a Kubernetes _ServiceType_ to define the type of Service you want, e.g., if you want to expose a Service on an external IP address outside of your cluster. For more information, see the Kubernetes documentation on [Publishing Services (ServiceTypes)][service-types].
14
+
15
+
The following ServiceTypes are available in AKS:
16
+
17
+
## ClusterIP
18
+
19
+
ClusterIP creates an internal IP address for use within the AKS cluster. The ClusterIP Service is good for _internal-only applications_ that support other workloads within the cluster. ClusterIP is used by default if you don't explicitly specify a type for a Service.
20
+
21
+
![Diagram showing ClusterIP traffic flow in an AKS cluster.][aks-clusterip]
22
+
23
+
## NodePort
24
+
25
+
NodePort creates a port mapping on the underlying node that allows the application to be accessed directly with the node IP address and port.
26
+
27
+
![Diagram showing NodePort traffic flow in an AKS cluster.][aks-nodeport]
28
+
29
+
## LoadBalancer
30
+
31
+
LoadBalancer creates an Azure load balancer resource, configures an external IP address, and connects the requested pods to the load balancer backend pool. To allow customers' traffic to reach the application, load balancing rules are created on the desired ports.
32
+
33
+
![Diagram showing Load Balancer traffic flow in an AKS cluster.][aks-loadbalancer]
34
+
35
+
For HTTP load balancing of inbound traffic, another option is to use an [Ingress controller][ingress-controllers].
36
+
37
+
## ExternalName
38
+
39
+
Creates a specific DNS entry for easier application access.
40
+
41
+
Either the load balancers and services IP address can be dynamically assigned, or you can specify an existing static IP address. You can assign both internal and external static IP addresses. Existing static IP addresses are often tied to a DNS entry.
42
+
43
+
You can create both _internal_ and _external_ load balancers. Internal load balancers are only assigned a private IP address, so they can't be accessed from the Internet.
44
+
45
+
Learn more about Services in the [Kubernetes docs][k8s-service].
Copy file name to clipboardExpand all lines: articles/aks/concepts-network.md
+29-73Lines changed: 29 additions & 73 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,25 +5,23 @@ ms.topic: conceptual
5
5
ms.date: 03/26/2024
6
6
author: schaffererin
7
7
ms.author: schaffererin
8
-
9
8
ms.custom: fasttrack-edit
10
9
---
11
10
12
11
# Networking concepts for applications in Azure Kubernetes Service (AKS)
13
12
14
13
In a container-based, microservices approach to application development, application components work together to process their tasks. Kubernetes provides various resources enabling this cooperation:
15
14
16
-
* You can connect to and expose applications internally or externally.
17
-
* You can build highly available applications by load balancing your applications.
18
-
* You can restrict the flow of network traffic into or between pods and nodes to improve security.
19
-
* You can configure Ingress traffic for SSL/TLS termination or routing of multiple components for your more complex applications.
15
+
- You can connect to and expose applications internally or externally.
16
+
- You can build highly available applications by load balancing your applications.
17
+
- You can restrict the flow of network traffic into or between pods and nodes to improve security.
18
+
- You can configure Ingress traffic for SSL/TLS termination or routing of multiple components for your more complex applications.
20
19
21
20
This article introduces the core concepts that provide networking to your applications in AKS:
@@ -35,8 +33,6 @@ Kubernetes employs a virtual networking layer to manage access within and betwee
35
33
36
34
Regarding specific Kubernetes functionalities:
37
35
38
-
-**Services**: Services is used to logically group pods, allowing direct access to them through a specific IP address or DNS name on a designated port.
39
-
-**Service types**: Specifies the kind of Service you wish to create.
40
36
-**Load balancer**: You can use a load balancer to distribute network traffic evenly across various resources.
41
37
-**Ingress controllers**: These facilitate Layer 7 routing, which is essential for directing application traffic.
42
38
-**Egress traffic control**: Kubernetes allows you to manage and control outbound traffic from cluster nodes.
@@ -49,51 +45,15 @@ In the context of the Azure platform:
49
45
- As you open network ports to pods, Azure automatically configures the necessary network security group rules.
50
46
- Azure can also manage external DNS configurations for HTTP application routing as new Ingress routes are established.
51
47
52
-
## Services
53
-
54
-
To simplify the network configuration for application workloads, Kubernetes uses *Services* to logically group a set of pods together and provide network connectivity. You can specify a Kubernetes *ServiceType* to define the type of Service you want. For example, if you want to expose a Service on an external IP address outside of your cluster. For more information, see the Kubernetes documentation on [Publishing Services (ServiceTypes)][service-types].
55
-
56
-
The following ServiceTypes are available:
57
-
58
-
***ClusterIP**
59
-
60
-
ClusterIP creates an internal IP address for use within the AKS cluster. The ClusterIP Service is good for *internal-only applications* that support other workloads within the cluster. ClusterIP is the default used if you don't explicitly specify a type for a Service.
61
-
62
-
![Diagram showing ClusterIP traffic flow in an AKS cluster][aks-clusterip]
63
-
64
-
***NodePort**
65
-
66
-
NodePort creates a port mapping on the underlying node that allows the application to be accessed directly with the node IP address and port.
67
-
68
-
![Diagram showing NodePort traffic flow in an AKS cluster][aks-nodeport]
69
-
70
-
***LoadBalancer**
71
-
72
-
LoadBalancer creates an Azure load balancer resource, configures an external IP address, and connects the requested pods to the load balancer backend pool. To allow customers' traffic to reach the application, load balancing rules are created on the desired ports.
73
-
74
-
![Diagram showing Load Balancer traffic flow in an AKS cluster][aks-loadbalancer]
75
-
76
-
For HTTP load balancing of inbound traffic, another option is to use an [Ingress controller](#ingress-controllers).
77
-
78
-
***ExternalName**
79
-
80
-
Creates a specific DNS entry for easier application access.
81
-
82
-
Either the load balancers and services IP address can be dynamically assigned, or you can specify an existing static IP address. You can assign both internal and external static IP addresses. Existing static IP addresses are often tied to a DNS entry.
83
-
84
-
You can create both *internal* and *external* load balancers. Internal load balancers are only assigned a private IP address, so they can't be accessed from the Internet.
85
-
86
-
Learn more about Services in the [Kubernetes docs][k8s-service].
87
-
88
48
## Azure virtual networks
89
49
90
50
In AKS, you can deploy a cluster that uses one of the following network models:
91
51
92
-
****Kubenet* networking**
52
+
-***Kubenet* networking**
93
53
94
54
The network resources are typically created and configured as the AKS cluster is deployed.
The AKS cluster is connected to existing virtual network resources and configurations.
99
59
@@ -150,14 +110,14 @@ It's possible to install in AKS a non-Microsoft CNI using the [Bring your own CN
150
110
151
111
Both kubenet and Azure CNI provide network connectivity for your AKS clusters. However, there are advantages and disadvantages to each. At a high level, the following considerations apply:
152
112
153
-
***kubenet**
113
+
-**kubenet**
154
114
155
-
* Conserves IP address space.
156
-
* Uses Kubernetes internal or external load balancers to reach pods from outside of the cluster.
157
-
* You manually manage and maintain user-defined routes (UDRs).
158
-
* Maximum of 400 nodes per cluster.
115
+
- Conserves IP address space.
116
+
- Uses Kubernetes internal or external load balancers to reach pods from outside of the cluster.
117
+
- You manually manage and maintain user-defined routes (UDRs).
118
+
- Maximum of 400 nodes per cluster.
159
119
160
-
***Azure CNI**
120
+
-**Azure CNI**
161
121
162
122
* Pods get full virtual network connectivity and can be directly reached via their private IP address from connected networks.
163
123
* Requires more IP address space.
@@ -188,13 +148,13 @@ For more information on Azure CNI and kubenet and to help determine which option
188
148
189
149
Whatever network model you use, both kubenet and Azure CNI can be deployed in one of the following ways:
190
150
191
-
* The Azure platform can automatically create and configure the virtual network resources when you create an AKS cluster.
192
-
* You can manually create and configure the virtual network resources and attach to those resources when you create your AKS cluster.
151
+
- The Azure platform can automatically create and configure the virtual network resources when you create an AKS cluster.
152
+
- You can manually create and configure the virtual network resources and attach to those resources when you create your AKS cluster.
193
153
194
154
Although capabilities like service endpoints or UDRs are supported with both kubenet and Azure CNI, the [support policies for AKS][support-policies] define what changes you can make. For example:
195
155
196
-
* If you manually create the virtual network resources for an AKS cluster, you're supported when configuring your own UDRs or service endpoints.
197
-
* If the Azure platform automatically creates the virtual network resources for your AKS cluster, you can't manually change those AKS-managed resources to configure your own UDRs or service endpoints.
156
+
- If you manually create the virtual network resources for an AKS cluster, you're supported when configuring your own UDRs or service endpoints.
157
+
- If the Azure platform automatically creates the virtual network resources for your AKS cluster, you can't manually change those AKS-managed resources to configure your own UDRs or service endpoints.
198
158
199
159
## Ingress controllers
200
160
@@ -235,11 +195,11 @@ The following table lists the different scenarios where you might use each ingre
235
195
236
196
The application routing addon is the recommended way to configure an Ingress controller in AKS. The application routing addon is a fully managed ingress controller for Azure Kubernetes Service (AKS) that provides the following features:
237
197
238
-
* Easy configuration of managed NGINX Ingress controllers based on Kubernetes NGINX Ingress controller.
198
+
- Easy configuration of managed NGINX Ingress controllers based on Kubernetes NGINX Ingress controller.
239
199
240
-
* Integration with Azure DNS for public and private zone management.
200
+
- Integration with Azure DNS for public and private zone management.
241
201
242
-
* SSL termination with certificates stored in Azure Key Vault.
202
+
- SSL termination with certificates stored in Azure Key Vault.
243
203
244
204
For more information about the application routing addon, see [Managed NGINX ingress with the application routing add-on](app-routing.md).
245
205
@@ -271,8 +231,8 @@ For more information, see [How network security groups filter network traffic][n
271
231
272
232
By default, all pods in an AKS cluster can send and receive traffic without limitations. For improved security, define rules that control the flow of traffic, like:
273
233
274
-
* Back-end applications are only exposed to required frontend services.
275
-
* Database components are only accessible to the application tiers that connect to them.
234
+
- Back-end applications are only exposed to required frontend services.
235
+
- Database components are only accessible to the application tiers that connect to them.
276
236
277
237
Network policy is a Kubernetes feature available in AKS that lets you control the traffic flow between pods. You can allow or deny traffic to the pod based on settings such as assigned labels, namespace, or traffic port. While network security groups are better for AKS nodes, network policies are a more suited, cloud-native way to control the flow of traffic for pods. As pods are dynamically created in an AKS cluster, required network policies can be automatically applied.
278
238
@@ -286,23 +246,19 @@ For associated best practices, see [Best practices for network connectivity and
286
246
287
247
For more information on core Kubernetes and AKS concepts, see the following articles:
288
248
289
-
*[Kubernetes / AKS clusters and workloads][aks-concepts-clusters-workloads]
290
-
*[Kubernetes / AKS access and identity][aks-concepts-identity]
291
-
*[Kubernetes / AKS security][aks-concepts-security]
292
-
*[Kubernetes / AKS storage][aks-concepts-storage]
293
-
*[Kubernetes / AKS scale][aks-concepts-scale]
249
+
-[Kubernetes / AKS clusters and workloads][aks-concepts-clusters-workloads]
250
+
-[Kubernetes / AKS access and identity][aks-concepts-identity]
251
+
-[Kubernetes / AKS security][aks-concepts-security]
0 commit comments