An organization is deploying a new Azure Kubernetes Service (AKS) cluster to host a critical application. The corporate security policy requires that all pods receive IP addresses directly from the virtual network (`VNet1`) to facilitate direct firewall auditing of pod traffic to on-premises databases. However, the primary subnet designated for the cluster nodes, ``, has a limited number of available IP addresses. To prevent IP address exhaustion on the node subnet while satisfying the security policy, which two configurations should the administrator implement? (Select two.)
- Configure the cluster to use the Azure CNI network plugin.Cevap
- Specify a separate subnet in the virtual network for dynamic pod IP allocation.Cevap
- CConfigure the cluster to use the Kubenet network plugin and set the pod CIDR to match the node subnet.
- DConfigure the cluster to use the Azure CNI Overlay network plugin.
Cevap
Configure the cluster to use the Azure CNI network plugin and specify a separate subnet in the virtual network for dynamic pod IP allocation.
To allow firewalls to audit individual pod traffic directly, pods must have IP addresses from the Azure Virtual Network, which requires the Azure CNI plugin. To avoid IP exhaustion on the node subnet, the administrator can configure dynamic pod IP allocation. This feature allows nodes to be deployed in one subnet while pods are allocated IPs from a completely separate subnet, saving IP space on the node subnet.
Adım Adım Çözüm
Anahtar Kavram
Azure Kubernetes Service (AKS) network models and dynamic pod IP allocation configuration.
Tahmini Süre:2m 0s