Your company is deploying a new Azure Kubernetes Service (AKS) cluster to host a microserv… — Microsoft Azure Administrator (AZ-104)

Your company is deploying a new Azure Kubernetes Service (AKS) cluster to host a microservices application. The Azure environment includes a virtual network named `VNet1` with the address space $172.20.0.0/16$ . The AKS cluster will be deployed into a subnet named `aks-subnet` ( $172.20.8.0/24$ ). The cluster is required to scale up to $15$ nodes, with each node supporting a maximum of $80$ pods. The pods must be able to communicate with on-premises database servers over an existing ExpressRoute connection. To prevent virtual network IP address exhaustion, the network security team mandates that pod IP addresses must not be allocated from the $172.20.0.0/16$ address space. Additionally, the solution must not require the configuration or management of user-defined routes (UDRs) or route tables for pod routing. Which network configuration should you use for the AKS cluster?

Azure CNI OverlayAnswer
B
Kubenet
C
Azure CNI with dynamic pod IP allocation
D
Azure CNI with static IP allocation

Answer

Azure CNI Overlay

Azure CNI Overlay is the correct choice because it assigns pods IP addresses from a private CIDR block that is completely separate from the virtual network (

172.20.0.0/16

), thereby satisfying the security mandate. It supports the required scaling limits because only the nodes receive IP addresses from the

172.20.8.0/24

subnet. Additionally, unlike Kubenet, Azure CNI Overlay does not require the configuration of user-defined routes (UDRs) or route tables for pod routing, and it seamlessly handles outbound traffic to on-premises networks over ExpressRoute by NAT'ing the pod traffic to the node's VNet IP address.

Step-by-Step Solution

Analyze the IP address capacity and constraints.

The target subnet `aks-subnet` (

172.20.8.0/24

) has only 251 usable IP addresses. The cluster requires up to

15

nodes, each supporting

80

pods (totaling

1,200

pods). Standard Azure CNI (static IP allocation) requires an IP address from the subnet for every pod, which would require

1,200

IPs and fail due to IP exhaustion.

Determines that standard Azure CNI cannot be used due to IP capacity limitations.

Evaluate the pod IP address allocation security mandate.

The security team requires that pod IPs must not come from the

172.20.0.0/16

space. Azure CNI with dynamic pod IP allocation still requires provisioning a subnet within the virtual network's address space (

172.20.0.0/16

) for the pods, which violates this security requirement.

Eliminates dynamic pod IP allocation.

Compare Overlay options based on routing and complexity constraints.

Both Kubenet and Azure CNI Overlay use an overlay network where pods get IPs from a private non-VNet CIDR. However, Kubenet requires Azure route tables and user-defined routes (UDRs) to route traffic between nodes. Azure CNI Overlay handles pod-to-pod routing internally via an overlay data path without requiring UDRs or custom route tables, and performs SNAT to the node's IP for outbound traffic (making it routable to on-premises via the ExpressRoute gateway).

Identifies the correct configuration that satisfies all requirements.

Key Concept

Azure Kubernetes Service (AKS) networking models, specifically the differences in IP address allocation, scalability, and routing complexity between Kubenet, Azure CNI, and Azure CNI Overlay.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic