DMZ kind of network design in the AKS

Question

I am looking for some guidance on a network design for AKS where all the node pool are in unroutable subnet in a vet and I want to use another vet subnet for the load balancer.

I tried searching it in the documentation and couldn't find any reference. Has anyone have any experience with it?

We cannot peer the networks as it will not have different set of non routable ips a bigger range for the nodes. I did this in aws but looking for a way to do this in aks.

Answer 1

It sounds like you want to implement a DMZ (Demilitarized Zone) network design in your AKS (Azure Kubernetes Service) environment, where all the node pools are in an unroutable subnet and the load balancer is in a separate subnet. While there isn't a specific guide for implementing this exact scenario in AKS, there are a few general steps you can follow to achieve this network design:

1. Create two virtual networks (VNets) in Azure: one for the node pools and one for the load balancer. Make sure the two VNets are in different regions and don't have overlapping IP address ranges.

2. Create a subnet within the node pool VNet for each node pool you want to create in AKS. These subnets should have a non-routable IP address range, such as 10.0.0.0/16 or 172.16.0.0/12.

3. Create a subnet within the load balancer VNet for the Azure Load Balancer. This subnet should have a routable IP address range, as it will be used to route traffic to the node pools.

4. Create an AKS cluster in the node pool VNet, and make sure to specify the subnets you created in step 2 as the node pool subnets.

5. Create an Azure Load Balancer in the load balancer VNet, and make sure to specify the subnet you created in step 3 as the backend subnet.

6. Add the node pools to the Azure Load Balancer, so that traffic can be routed to them. You can do this using the AKS node resource group or by adding the nodes directly to the load balancer.

7. Configure any necessary network security groups or firewall rules to restrict traffic to and from the node pools and the load balancer, as appropriate for your security needs.

This should give you a basic DMZ network design in AKS, where the node pools are in an unroutable subnet and the load balancer is in a separate, routable subnet. Keep in mind that this is just a general guide, and you may need to adjust the steps based on your specific requirements and network setup.

Ready to level up your coding game? Uncover the realm of microservices with our cutting-edge Microservices Developer Certification!