AKS networking (kubenet, Azure CNI) - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Pod IP Address Allocation in AKS

In Azure Kubernetes Service (AKS), you can choose between two networking models: kubenet and Azure CNI. Which statement correctly describes how pod IP addresses are allocated in these two models?

A Both kubenet and Azure CNI assign pod IPs from the same subnet as the nodes without isolation.

B In kubenet, pods get IPs from a private subnet managed by AKS; in Azure CNI, pods get IPs directly from the Azure virtual network subnet.

C In kubenet, pods get IPs directly from the Azure virtual network subnet; in Azure CNI, pods get IPs from a private subnet managed by AKS.

D Neither kubenet nor Azure CNI assign IPs to pods; pods share the node IP address.

💡 Hint

Think about whether pods get IPs from the Azure network or from a separate range.

Kubenet assigns pod IPs from a private address space managed by AKS, using network address translation (NAT) to communicate outside. Azure CNI assigns pod IPs directly from the Azure virtual network subnet, making pods first-class citizens on the network.

❓ Architecture

intermediate

Choosing Networking Model for High Pod Density

You plan to deploy an AKS cluster with a very high number of pods per node. Which networking model is better suited for this scenario and why?

A Azure CNI, because it supports unlimited pods per node without IP address exhaustion.

B Azure CNI, because it assigns IPs from a private subnet, reducing IP usage.

C Kubenet, because it uses NAT and allows more pods per node without needing many IP addresses.

D Kubenet, because it assigns IPs directly from the Azure subnet, avoiding IP conflicts.

💡 Hint

Consider how IP address usage affects pod density in each model.

Kubenet uses NAT, so pods share node IPs externally and do not require an IP per pod from the Azure subnet, allowing more pods per node. Azure CNI assigns an IP per pod from the subnet, which can limit pod density due to IP exhaustion.

❓ security

advanced

Network Policy Enforcement Differences

Which AKS networking model supports Azure Network Policies natively for controlling pod traffic?

A Azure CNI supports Azure Network Policies natively; kubenet does not support them directly.

B Kubenet supports Azure Network Policies natively; Azure CNI requires additional configuration.

C Both kubenet and Azure CNI support Azure Network Policies natively without extra setup.

D Neither kubenet nor Azure CNI support Azure Network Policies; only Calico does.

💡 Hint

Think about which model integrates better with Azure's native network security features.

Azure CNI integrates with Azure Network Policies, allowing native enforcement of traffic rules. Kubenet does not support Azure Network Policies directly and requires other solutions like Calico for network policy enforcement.

❓ service_behavior

advanced

Pod-to-Pod Communication Across Nodes

In an AKS cluster using kubenet networking, how is pod-to-pod communication across different nodes handled?

A Pods use a VPN tunnel established between nodes for communication.

B Pods communicate directly using their Azure VNet IPs without NAT or routing rules.

C Pods cannot communicate across nodes in kubenet; only within the same node.

D Pods communicate using node IPs with NAT translating pod IPs, requiring routing rules on nodes.

💡 Hint

Consider how kubenet uses NAT and routing for pod traffic.

Kubenet assigns pod IPs from a private range and uses NAT on nodes to translate pod IPs to node IPs for cross-node communication. Routing rules on nodes ensure traffic reaches the correct pod.

✅ Best Practice

expert

Scaling AKS Cluster with Azure CNI and IP Address Limits

You have an AKS cluster using Azure CNI networking. You want to scale the cluster to 100 nodes, each running 30 pods. What is the best practice to avoid IP address exhaustion in the Azure virtual network subnet?

A Increase the subnet size to accommodate at least 3000 IP addresses, considering node and pod IPs.

B Use kubenet instead of Azure CNI to avoid IP address exhaustion issues.

C Assign static IP addresses to pods to manage IP usage manually.

D Reduce the number of pods per node to 5 to limit IP consumption.

💡 Hint

Think about how Azure CNI assigns IPs and what subnet size is needed.

Azure CNI assigns an IP per pod from the Azure subnet. To support 100 nodes with 30 pods each plus node IPs, the subnet must be large enough to provide at least 3000 IP addresses. Increasing subnet size is the best practice.