Azure CNI in one of the CNI plugins AKS provides. Below example is based on an AKS cluster. The k8s version is 1.18.10 and CNI version is v1.2.0_hotfix.

What?

• network

The info of virtual network CNI creates

• endpoint

The info of pod’s networking CNI creates

• netPlugin

The parent plugin created when…

Generally speaking the process are two parts.

Part-1:

The 1st part is to provision the resources on Azure platform like control plane, networking, identity and virtual machine.

Part-2:

The 2nd part is to use the features of Azure virtual machine like custom data and custom script extension to install/configure kubelet related components…

Download URL:

1. Input the “name” of the pod and “namespace” of the pod to the “xxx.json”. Example is “example/test.json”
2. Run “./k8sTcpdump -p xxx.json” and it will bring up pods on the corresponding nodes to capture the network traces of the target pods. The ‘.cap’ file will be downloaded to the current folder.

You could refer to the GIF https://github.com/Shuanglu/k8sTcpdump/blob/main/doc/k8sTcpdump.gif as well

Issue:

In the AKS cluster, pods in a separate subnet(172.16.3.0/24) cannot connect to the Internet

Environment:

cloudprovider: AKS

version: 1.17.11

NetworkPolicy: Calico

NetworkPlugin: Azure

nodepools:

• agentpool | 172.16.2.0/24
• test | 172.16.3.0/24

Troubleshooting steps:

• Login to the node where the pod is running and run the test like ‘curl -v 216.58.193.78’…

Azure Policy in AKS is in-preview. Reviewed the deployment and found it uses open policy agent. Below are some language references for the constraint template created.

https://raw.githubusercontent.com/Azure/azure-policy/master/built-in-references/Kubernetes/container-allowed-capabilities/template.yaml

Glossary:

1. Native client

A type of client application that is installed natively on a device. It’s behalf of the human user while authenticating with AAD. We name it “kubectl app” in this article.

2. Web Client

A type of client application that executes all code on a web server, and…

Access the Azure Container Registry using Azure Managed Identity programatically

1. Install the MSI to the VM

2. Get the ARM access token from the MSI endpoint

response=$(curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' -H Metadata:true -s) access_token=$(echo $response | python -c 'import sys, json; print (json.load(sys.stdin)["access_token"])') client_id=$(echo $response | python -c 'import sys, json; print…

1. Change the timezone in the image(below commands needs to be modified according to the Linux distribution)

RUN rm -rf /etc/localtime
RUN ln -s /usr/share/zoneinfo/Asia/Singapore /etc/localtime
RUN dpkg-reconfigure -f noninteractive tzdata

2. Change the timezone via k8s mount hostPath

spec:containers:- name: nginximage: nginxports:- containerPort: 80name: nginxvolumeMounts:- name: tz-configmountPath: /etc/localtimevolumes:- name: tz-confighostPath:path:  /usr/share/zoneinfo/Asia/Singapore