Examkin

Question

Difficulty: MediumConfigure Azure Kubernetes Service (AKS)

An administrator is planning to deploy a new Azure Kubernetes Service (AKS) cluster named `aks-finance`. The cluster must integrate with an on-premises network, and pods must be directly reachable from the on-premises network using their own IP addresses from the Azure Virtual Network (VNet) without any network address translation (NAT). The network security team has allocated a small subnet with a /24/24 prefix for the cluster nodes, but wants to ensure that pod deployments do not quickly exhaust the IP addresses in this node subnet.

Which two configuration options should the administrator select to meet these requirements? (Select two.)

  1. Configure the cluster to use the Azure CNI network plugin.Answer
  2. B
    Configure the cluster to use the Kubenet network plugin.
  3. Enable dynamic pod IP allocation to allocate pod IP addresses from a separate subnet.Answer
  4. D
    Configure the cluster to use Azure CNI Overlay.
  5. E
    Deploy the cluster nodes and pods in the same subnet with a standard Kubenet configuration and configure User-Defined Routes (UDRs) for on-premises routing.

Answer

Configure the cluster to use the Azure CNI network plugin and enable dynamic pod IP allocation to allocate pod IP addresses from a separate subnet.
To ensure pods have direct connectivity to the on-premises network without NAT, the Azure CNI network plugin must be used since it assigns VNet IPs directly to pods. To prevent the node subnet from being exhausted by pod IP allocations, dynamic pod IP allocation should be enabled. This allows nodes and pods to reside in different subnets, ensuring that the node subnet is not exhausted by the pod density.

Step-by-Step Solution

1
Identify the routing requirement for pods to be reachable from on-premises without NAT.
Determine that the Azure CNI network plugin must be used. Azure CNI provides native VNet IP addresses directly to pods, allowing them to be reachable from peered networks or on-premises networks without network address translation.
Kubenet and Azure CNI Overlay both use a private address space for pods and utilize NAT at the node level for outbound traffic, which prevents direct inbound routing to pods.
2
Address the subnet capacity constraint where nodes are allocated a small /24/24 subnet.
Select dynamic pod IP allocation to split nodes and pods into separate subnets.
By default, Azure CNI pre-allocates VNet IP addresses from the same subnet for every node and its maximum pods, leading to rapid IP exhaustion. Dynamic pod IP allocation allows pods to draw from a separate subnet, protecting the node subnet from exhaustion.

Key Concept

Azure CNI vs Kubenet, and Dynamic Pod IP Allocation in Azure Kubernetes Service (AKS)
Rate this question

Topics

Configure Azure Kubernetes Service (AKS)

More questions from this topic