Stage 5 · Platform

Compute & Containers

AKS Networking (Azure CNI)

Azure CNI, kubenet, Private clusters, and ingress with Application Gateway.

8 min readAzure Cloud EngineeringPlatform

CNI Models

AKS supports two primary networking models: Azure CNI and Kubenet. Azure CNI gives every pod a VNet IP address from the subnet. Kubenet gives pods IP addresses from a logical network and only nodes get VNet IPs.

Feature	Azure CNI	Kubenet
Pod IP assignment	VNet IP from subnet	Logical (overlay) network
IP consumption	High (1 IP per pod)	Low (1 IP per node)
Pod-to-pod latency	Same VNet routing	UDR-based routing
Max pods per node	250 (default)	110
Network policy	Azure or Calico	Calico
Best for	Enterprise, large clusters	Small clusters, IP conservation

Azure CNI

Azure CNI assigns each pod a private IP address from the subnet. Pods can be directly reached from outside the cluster (via load balancer or ingress). This provides better network performance and simplifies network debugging.

Create AKS with Azure CNI


# Create a VNet and subnet first
az network vnet create \
  --resource-group rg-aks-prod \
  --name vnet-aks-prod \
  --address-prefixes 10.0.0.0/16 \
  --subnet-name subnet-aks \
  --subnet-prefixes 10.0.1.0/24

# Create AKS cluster using the existing subnet
az aks create \
  --resource-group rg-aks-prod \
  --name aks-payments-prod \
  --node-count 3 \
  --node-vm-size Standard_D4s_v3 \
  --network-plugin azure \
  --vnet-name vnet-aks-prod \
  --subnet subnet-aks \
  --service-cidr 10.1.0.0/16 \
  --dns-service-ip 10.1.0.10 \
  --enable-managed-identity

The --service-cidr defines the CIDR range for Kubernetes services. It must not overlap with the VNet or pod CIDR ranges.

Kubenet

Kubenet is a simpler networking model where pods receive IPs from an overlay network. Node traffic is routed via User-Defined Routes (UDRs). It uses fewer IP addresses but has slightly higher latency.

Create AKS with Kubenet


az aks create \
  --resource-group rg-aks-dev \
  --name aks-dev \
  --node-count 2 \
  --node-vm-size Standard_D2s_v3 \
  --network-plugin kubenet \
  --pod-cidr 10.244.0.0/16 \
  --service-cidr 10.1.0.0/16 \
  --dns-service-ip 10.1.0.10

Kubenet assigns pod IPs from the --pod-cidr range. These IPs are not routable on the VNet — traffic is NATed through the node.

Private Clusters

A private AKS cluster has no public IP on the API server. The API server is accessible only through a private endpoint in your VNet. This is required for many compliance frameworks.

Create a private AKS cluster


az aks create \
  --resource-group rg-aks-prod \
  --name aks-payments-prod \
  --enable-private-cluster \
  --private-dns-zone system \
  --node-count 3 \
  --network-plugin azure \
  --enable-managed-identity \
  --generate-ssh-keys

--private-dns-zone system creates a private DNS zone in the AKS node resource group. Use --private-dns-zone None to bring your own DNS zone.

Private clusters require network access

With a private cluster, you cannot use az aks get-credentials from outside the VNet. Use a VPN gateway, ExpressRoute, or Azure Bastion to access the API server.

Ingress with Application Gateway

Application Gateway Ingress Controller (AGIC) integrates Azure Application Gateway as an ingress for your AKS cluster. It provides WAF, SSL termination, path-based routing, and automatic health probes.

Deploy AGIC with an AKS cluster


# Install the application-ingress extension
az aks application-routing enable \
  --resource-group rg-aks-prod \
  --name aks-payments-prod

# Get the ingress IP
kubectl get ingress -A

# Create an ingress resource
cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: payments-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
spec:
  rules:
  - host: payments.contoso.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: payments-service
            port:
              number: 80
EOF

AGIC watches for Ingress resources and automatically configures Application Gateway. Changes to Ingress resources are reflected in the Application Gateway within seconds.

Network Policies

Kubernetes Network Policies control traffic flow between pods at the IP/port level. AKS supports Azure Network Policy and Calico for enforcement.

Apply a network policy


# Create a policy that allows traffic only from the frontend namespace
cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-only
  namespace: backend
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: frontend
    ports:
    - protocol: TCP
      port: 8080
EOF

Network policies are additive — they only restrict traffic. A pod with no network policy accepts all traffic. Once any policy selects a pod, only explicitly allowed traffic passes.

Enable Azure Network Policy at cluster creation

Network policy cannot be changed after cluster creation. Use --network-policy calico or --network-policy azure when creating the cluster. For existing clusters, you must recreate the cluster.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.