AKS networking (kubenet, Azure CNI) - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the network plugin for an AKS cluster.

Azure

az aks create --resource-group myResourceGroup --name myAKSCluster --network-plugin [1]

Drag options to blanks, or click blank then click option'

Akubenet

Bflannel

Cbridge

Dazure

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'kubenet' when Azure CNI is required.

Using unsupported network plugins like 'bridge' or 'flannel' in AKS.

The azure option sets the Azure CNI network plugin, which integrates pods directly with the Azure virtual network.

2fill in blank

medium

Complete the code to enable IP masquerading in kubenet networking.

Azure

az aks create --resource-group myResourceGroup --name myAKSCluster --network-plugin kubenet --enable-ip-masquerade [1]

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

Cenable

Dyes

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'false' disables IP masquerading, which may block external access.

Using non-boolean values like 'enable' or 'yes' causes errors.

Setting --enable-ip-masquerade true enables IP masquerading, which is important for kubenet networking to allow pods to access external networks.

3fill in blank

hard

Fix the error in the command to create an AKS cluster with Azure CNI and a custom subnet.

Azure

az aks create --resource-group myResourceGroup --name myAKSCluster --network-plugin [1] --vnet-subnet-id /subscriptions/xxx/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/myVnet/subnets/mySubnet

Drag options to blanks, or click blank then click option'

Akubenet

Bazure

Cbridge

Dflannel

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'kubenet' with a custom subnet causes deployment errors.

Using unsupported plugins like 'bridge' or 'flannel' in AKS.

The azure network plugin is required when specifying a custom subnet with --vnet-subnet-id. Kubenet does not support this.

4fill in blank

hard

Fill both blanks to configure the AKS cluster with kubenet and specify the DNS service IP.

Azure

az aks create --resource-group myResourceGroup --name myAKSCluster --network-plugin [1] --service-cidr 10.0.0.0/16 --dns-service-ip [2]

Drag options to blanks, or click blank then click option'

Akubenet

B10.0.0.10

Cazure

D10.0.1.10

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'azure' network plugin with kubenet-specific flags.

Setting DNS service IP outside the service CIDR range.

Using kubenet as the network plugin and setting the DNS service IP to 10.0.0.10 within the service CIDR is a valid configuration.

5fill in blank

hard

Fill all three blanks to create an AKS cluster with Azure CNI, specify the subnet, and enable network policy.

Azure

az aks create --resource-group myResourceGroup --name myAKSCluster --network-plugin [1] --vnet-subnet-id [2] --network-policy [3]

Drag options to blanks, or click blank then click option'

Akubenet

B/subscriptions/xxx/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/myVnet/subnets/mySubnet

Cazure

Dcalico

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'kubenet' with subnet ID and network policy flags.

Using unsupported network policies or missing subnet ID.

The Azure CNI plugin (azure) requires specifying the subnet ID and can use calico as the network policy for advanced network security.

Practice

1. What is the main difference between kubenet and Azure CNI networking in AKS?

easy

A. Both assign IPs from the Azure subnet but differ in routing protocols.

B. Kubenet uses NAT and assigns pod IPs from a private range, Azure CNI assigns IPs from the Azure subnet directly.

C. Kubenet assigns IPs from the Azure subnet, Azure CNI uses NAT for pod IPs.

D. Azure CNI uses NAT, while kubenet assigns IPs from the Azure subnet.

Solution

1. Step 1: Understand kubenet networking

   Kubenet assigns pod IPs from a private IP range and uses NAT to allow pods to communicate outside the cluster.

2. Step 2: Understand Azure CNI networking

   Azure CNI assigns pod IPs directly from the Azure virtual network subnet, allowing pods to have direct IP addresses visible in the Azure network.

3. Final Answer:

   Kubenet uses NAT and assigns pod IPs from a private range, Azure CNI assigns IPs from the Azure subnet directly. -> Option B

4. Quick Check:

   Kubenet = NAT, Azure CNI = Azure subnet IPs [OK]

Hint: Kubenet uses NAT; Azure CNI uses Azure subnet IPs [OK]

Common Mistakes:

• Confusing which method uses NAT
• Thinking both assign IPs from Azure subnet
• Assuming Azure CNI uses private IP range

2. Which of the following is the correct way to specify Azure CNI networking when creating an AKS cluster using Azure CLI?

easy

A. az aks create --name myAKS --resource-group myRG --network-plugin azure

B. az aks create --name myAKS --resource-group myRG --network-plugin kubenet

C. az aks create --name myAKS --resource-group myRG --network-plugin azure-cni

D. az aks create --name myAKS --resource-group myRG --network-plugin azurecni

Solution

1. Step 1: Identify the correct network plugin name for Azure CNI

   The Azure CLI uses the exact string azure to specify Azure CNI networking.

2. Step 2: Check the command syntax

   The command must include --network-plugin azure to enable Azure CNI networking.

3. Final Answer:

   az aks create --name myAKS --resource-group myRG --network-plugin azure -> Option A

4. Quick Check:

   Azure CNI plugin = azure [OK]

Hint: Azure CNI plugin is exactly 'azure' in CLI [OK]

Common Mistakes:

• Using 'azure-cni' instead of 'azure'
• Confusing kubenet with Azure CNI plugin name
• Typos in the network plugin parameter

3. Given an AKS cluster configured with kubenet, what will happen if a pod tries to communicate with another pod in a different node?

medium

A. Pods communicate directly using their Azure subnet IPs without NAT.

B. Pod traffic is blocked by default between nodes.

C. Pods cannot communicate across nodes in kubenet mode.

D. The pod-to-pod traffic will be routed through the node's NAT IP and may require additional routing setup.

Solution

1. Step 1: Understand pod communication in kubenet mode

   In kubenet, pods get private IPs and use NAT on the node to communicate outside their node.

2. Step 2: Analyze cross-node pod communication

   Traffic between pods on different nodes goes through the node's NAT IP, requiring routing rules to allow this traffic.

3. Final Answer:

   The pod-to-pod traffic will be routed through the node's NAT IP and may require additional routing setup. -> Option D

4. Quick Check:

   Kubenet cross-node uses NAT routing [OK]

Hint: Kubenet pods use NAT IPs for cross-node traffic [OK]

Common Mistakes:

• Assuming direct pod IP communication in kubenet
• Thinking pods cannot communicate across nodes
• Believing pod traffic is blocked by default

4. You deployed an AKS cluster with Azure CNI but pods are not getting IP addresses from the Azure subnet. What is the likely cause?

medium

A. The Azure subnet does not have enough free IP addresses for pods.

B. The cluster was created with kubenet instead of Azure CNI.

C. The pods are configured to use host networking.

D. The Azure CNI plugin is not installed on the nodes.

Solution

1. Step 1: Check IP availability in Azure subnet

   Azure CNI assigns pod IPs from the Azure subnet. If the subnet IP pool is exhausted, pods cannot get IPs.

2. Step 2: Verify cluster network plugin and configuration

   Since the cluster is deployed with Azure CNI, the plugin is installed. Host networking would not prevent IP assignment.

3. Final Answer:

   The Azure subnet does not have enough free IP addresses for pods. -> Option A

4. Quick Check:

   Subnet IP exhaustion blocks pod IP assignment [OK]

Hint: Check subnet IP availability first for Azure CNI issues [OK]

Common Mistakes:

• Assuming plugin is missing when cluster uses Azure CNI
• Ignoring subnet IP exhaustion
• Confusing host networking with IP assignment

5. You want to deploy an AKS cluster that allows pods to communicate directly with other Azure resources in the same virtual network using their pod IPs. Which networking option should you choose and why?

hard

A. Use kubenet with additional routing rules to enable pod IP visibility.

B. Use kubenet because it saves IP addresses and allows direct pod IP communication.

C. Use Azure CNI because it assigns pod IPs from the Azure subnet enabling direct communication with Azure resources.

D. Use Azure CNI but disable IP assignment to pods for better security.

Solution

1. Step 1: Identify networking needs for direct pod-to-Azure resource communication

   Direct communication requires pods to have IPs visible in the Azure virtual network.

2. Step 2: Compare kubenet and Azure CNI capabilities

   Kubenet uses NAT and private IPs, so pods are not directly reachable. Azure CNI assigns pod IPs from the Azure subnet, enabling direct communication.

3. Final Answer:

   Use Azure CNI because it assigns pod IPs from the Azure subnet enabling direct communication with Azure resources. -> Option C

4. Quick Check:

   Azure CNI = direct pod IPs in Azure subnet [OK]

Hint: Azure CNI enables direct pod IP communication with Azure resources [OK]

Common Mistakes:

• Choosing kubenet for direct pod IP communication
• Thinking kubenet allows direct pod IP visibility
• Disabling IP assignment in Azure CNI disables communication