Examkin

Question

Difficulty: MediumConfigure Azure Kubernetes Service (AKS)

An administrator is planning the network configuration for a new Azure Kubernetes Service (AKS) cluster named aks-retail. The cluster will be deployed into an existing virtual network with an address space of 10.100.0.0/1610.100.0.0/16. The virtual network is peered with an on-premises network that uses the 172.16.0.0/12172.16.0.0/12 address space. Due to limited available IP addresses in the 10.100.0.0/1610.100.0.0/16 range, the administrator decides to configure the cluster using Azure CNI Overlay. Which two network configuration requirements must the administrator meet when deploying this cluster?

  1. The Pod CIDR range used for the overlay network must not overlap with 10.100.0.0/1610.100.0.0/16 or 172.16.0.0/12172.16.0.0/12.Answer
  2. The DNS service IP address must be an IP address within the Service CIDR range configured for the cluster.Answer
  3. C
    The Service CIDR range must be a subnet within the 10.100.0.0/1610.100.0.0/16 address space of the virtual network.
  4. D
    The network plugin mode must be configured as kubenet to enable the overlay network behavior.
  5. E
    The virtual network subnets must be configured with User-Defined Routes (UDRs) to manually route pod traffic between the nodes.

Answer

The administrator must ensure that the Pod CIDR range used for the overlay network does not overlap with the virtual network or the on-premises network, and that the DNS service IP address is within the Service CIDR range configured for the cluster.
Azure CNI Overlay routes pod traffic using a private overlay network. The Pod CIDR range must be unique and must not overlap with the virtual network (10.100.0.0/1610.100.0.0/16) or the connected on-premises network (172.16.0.0/12172.16.0.0/12) to avoid routing errors. Additionally, the DNS service IP address must reside within the configured Service CIDR range to enable internal cluster name resolution.

Step-by-Step Solution

1
Determine the network model requirements for Azure CNI Overlay.
Identify that Azure CNI Overlay requires the network plugin to be set to 'azure' and the plugin mode to 'overlay'. Nodes receive IPs from the VNet subnet, while pods receive IPs from a private Pod CIDR range.
This establishes how IP address allocation behaves and why the Pod CIDR must be distinct from the VNet and peered ranges.
2
Evaluate the IP overlapping rules for Pod and Service CIDRs.
Confirm that the Pod CIDR and Service CIDR ranges must not overlap with each other, the virtual network's address space (10.100.0.0/1610.100.0.0/16), or any peered/on-premises ranges (172.16.0.0/12172.16.0.0/12).
Routing conflicts will occur if pod or service IPs overlap with reachable addresses in the peered VNet or on-premises networks.
3
Verify DNS service IP requirements.
Ensure that the DNS service IP is configured as a single IP address located inside the Service CIDR block (usually ending in .10, but cannot be the first or last IP of the range).
CoreDNS requires an IP address within the Service CIDR to route service resolution requests inside the cluster.

Key Concept

Azure CNI Overlay network configuration in Azure Kubernetes Service (AKS)
Rate this question

Topics

Configure Azure Kubernetes Service (AKS)

More questions from this topic