Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

UserDefinedRouting Egress #550

Merged
merged 10 commits into from
Mar 29, 2023
Merged

UserDefinedRouting Egress #550

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a5cd164
ad managed Node RG name parameter and retrictionLevel
lenisha Mar 16, 2023
aa3e38f
add userDefinedRouting aks egress
lenisha Mar 17, 2023
3d344a8
add userDefinedNetorking checks
lenisha Mar 17, 2023
f5c8cf7
spell BYON
lenisha Mar 17, 2023
095bdec
similar to PR 546 bug in bicep install
lenisha Mar 17, 2023
1607ddb
update description
lenisha Mar 17, 2023
5e8e46e
Merge pull request #1 from lenisha/main
lenisha Mar 17, 2023
f55fd0a
Merge branch 'Azure:main' into udr
lenisha Mar 20, 2023
88ba5f2
Merge branch 'Azure:main' into udr
lenisha Mar 23, 2023
54631fd
add udr ui changes
lenisha Mar 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions bicep/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1054,6 +1054,7 @@ param AutoscaleProfile object = {
'loadBalancer'
'managedNATGateway'
'userAssignedNATGateway'
'userDefinedRouting'
])
@description('Outbound traffic type for the egress traffic of your cluster')
param aksOutboundTrafficType string = 'loadBalancer'
Expand Down
2 changes: 1 addition & 1 deletion bicep/network.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ resource vnet_udr 'Microsoft.Network/routeTables@2022-07-01' = if (azureFirewall
{
name: 'AKSNodesEgress'
properties: {
addressPrefix: '0.0.0.0/1'
addressPrefix: '0.0.0.0/0'
nextHopType: 'VirtualAppliance'
nextHopIpAddress: azureFirewalls ? calcAzFwIp.outputs.FirewallPrivateIp : null
}
Expand Down
2 changes: 1 addition & 1 deletion helper/src/components/deployTab.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ export default function DeployTab({ defaults, updateFn, tabValues, invalidArray,
...(addons.appgwKVIntegration && addons.csisecret === 'akvNew' && { appgwKVIntegration: true })
})
}),
...(net.vnet_opt === "byo" && {
...(net.vnet_opt !== "default" && {
...(net.aksOutboundTrafficType !== defaults.net.aksOutboundTrafficType && {aksOutboundTrafficType: net.aksOutboundTrafficType})
}),
...(cluster.keyVaultKms !== defaults.cluster.keyVaultKms && {
Expand Down
14 changes: 9 additions & 5 deletions helper/src/components/networkTab.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,9 @@ export default function NetworkTab ({ defaults, tabValues, updateFn, invalidArra
<Stack horizontal tokens={{ childrenGap: 50 }}>
<Stack.Item>
<MessageBar messageBarType={MessageBarType.info}>NAT Gateway allows more traffic flows than a Load Balancer.<a target="_target" href="https://docs.microsoft.com/azure/aks/nat-gateway">docs</a></MessageBar>
{net.aksOutboundTrafficType==='userDefinedRouting' && net.vnet_opt === 'byo' &&
<MessageBar styles={{ root: { width:'400px', marginTop: '10px !important'}}} messageBarType={MessageBarType.warning}>Ensure that the AKS Subnet is configured with a UDR and that your Virtual Network Appliance is <Link href="https://learn.microsoft.com/azure/aks/limit-egress-traffic">properly configured</Link> to allow necessary traffic</MessageBar>
}
{hasError(invalidArray, 'aksOutboundTrafficType') &&
<MessageBar messageBarType={MessageBarType.error}>{getError(invalidArray, 'aksOutboundTrafficType')}</MessageBar>
}
Expand All @@ -169,7 +172,8 @@ export default function NetworkTab ({ defaults, tabValues, updateFn, invalidArra
options={[
{ key: 'loadBalancer', text: 'Load Balancer' },
{ key: 'managedNATGateway', text: 'Managed NAT Gateway' },
{ key: 'userAssignedNATGateway', text: 'Assigned NAT Gateway'}
{ key: 'userAssignedNATGateway', text: 'Assigned NAT Gateway'},
{ key: 'userDefinedRouting', text: 'User Defined Routing'}
]}
onChange={(ev, { key }) => updateFn("aksOutboundTrafficType", key)}
/>
Expand All @@ -182,7 +186,7 @@ export default function NetworkTab ({ defaults, tabValues, updateFn, invalidArra
label="Create NAT Gateway for AKS Subnet (Custom VNet Only)"
/>
<Slider
disabled={net.aksOutboundTrafficType==='loadBalancer' || net.vnet_opt === 'byo'}
disabled={net.aksOutboundTrafficType==='loadBalancer' || net.aksOutboundTrafficType==='userDefinedRouting' || net.vnet_opt === 'byo'}
buttonProps={{ "data-testid": "net-natGwIp-slider"}}
styles={{ root: { width: 450 } }}
label={'Nat Gateway Ip Count'} min={1} max={16} step={1}
Expand All @@ -191,7 +195,7 @@ export default function NetworkTab ({ defaults, tabValues, updateFn, invalidArra
/>

<Slider
disabled={net.aksOutboundTrafficType==='loadBalancer' || net.vnet_opt === 'byo'}
disabled={net.aksOutboundTrafficType==='loadBalancer' || net.aksOutboundTrafficType==='userDefinedRouting' || net.vnet_opt === 'byo'}
buttonProps={{ "data-testid": "net-natGwTimeout-slider"}}
styles={{ root: { width: 450 } }}
label={'Nat Gateway Idle Timeout (Minutes)'} min={5} max={120} step={1}
Expand All @@ -210,9 +214,9 @@ export default function NetworkTab ({ defaults, tabValues, updateFn, invalidArra
<MessageBar messageBarType={MessageBarType.error}>{getError(invalidArray, 'afw')}</MessageBar>
}
<Checkbox
styles={{ root: { marginLeft: '50px', marginTop: '10 !important' } }}
styles={{ root: { marginLeft: '50px', marginTop: '10px !important' } }}
disabled={net.vnet_opt !== 'custom'}
errorMessage={getError(invalidArray, 'afw')}
errorMessage={getError(invalidArray, 'afw(')}
checked={net.afw}
onChange={(ev, v) => updateFn("afw", v)}
label="Implement Azure Firewall & UDR next hop" />
Expand Down
23 changes: 17 additions & 6 deletions helper/src/components/portalnav.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -382,12 +382,23 @@ export default function PortalNav({ config }) {
invalidFn('net', 'byoAKSSubnetId', net.vnet_opt === 'byo' && !net.byoAKSSubnetId.match('^/subscriptions/[^/ ]+/resourceGroups/[^/ ]+/providers/Microsoft.Network/virtualNetworks/[^/ ]+/subnets/[^/ ]+$'), 'Enter a valid Subnet Id where AKS nodes will be installed')
invalidFn('net', 'byoAGWSubnetId', net.vnet_opt === 'byo' && addons.ingress === 'appgw' && !net.byoAGWSubnetId.match('^/subscriptions/[^/ ]+/resourceGroups/[^/ ]+/providers/Microsoft.Network/virtualNetworks/[^/ ]+/subnets/[^/ ]+$'), 'Enter a valid Subnet Id where Application Gateway is installed')
invalidFn('net', 'vnet_opt', net.vnet_opt === "default" && (net.afw || net.vnetprivateend), 'Cannot use default networking of you select Firewall or Private Link')
invalidFn('net', 'afw', net.afw && net.vnet_opt !== "custom",
net.vnet_opt === "byo" ?
'Please de-select, when using Bring your own VNET, configure a firewall as part of your own VNET setup, (in a subnet or peered network)'
:
'This template can only deploy Azure Firewall in single VNET with Custom Networking')
invalidFn('net', 'aksOutboundTrafficType', (net.aksOutboundTrafficType === 'managedNATGateway' && net.vnet_opt !== "default") || (net.aksOutboundTrafficType === 'userAssignedNATGateway' && net.vnet_opt === "default"), 'When using Managed Nat Gateway, only default networking is supported. For other networking options, use Assigned NAT Gateway')
invalidFn('net', 'afw',
(net.afw && net.vnet_opt !== "custom") ||
(!net.afw && net.aksOutboundTrafficType === 'userDefinedRouting' && net.vnet_opt === "custom"),
net.afw && net.vnet_opt === "byo" ?
'Please de-select, when using Bring your own VNET, configure a firewall as part of your own VNET setup, (in a subnet or peered network)'
: net.afw && net.vnet_opt === "default" ?
'This template can only deploy Azure Firewall in single VNET with Custom Networking'
:'Ensure to select Azure Firewall when using Custom Networking and User Defined Routing for Outbound Traffic Type')

invalidFn('net', 'aksOutboundTrafficType',
(net.aksOutboundTrafficType === 'managedNATGateway' && net.vnet_opt !== "default") ||
(net.aksOutboundTrafficType === 'userAssignedNATGateway' && net.vnet_opt === "default") ||
(net.aksOutboundTrafficType === 'userDefinedRouting' && net.vnet_opt === "default"),
net.aksOutboundTrafficType === 'userDefinedRouting' ?
'When using User Defined Routing, only custom and Bring your Own networking is supported.'
:
'When using Managed Nat Gateway, only default networking is supported. For other networking options, use Assigned NAT Gateway')
invalidFn('net', 'serviceCidr', net.vnet_opt === "custom" && !isCidrValid(net.serviceCidr), invalidCidrMessage)
invalidFn('net', 'podCidr', !isCidrValid(net.podCidr), invalidCidrMessage)
invalidFn('net', 'dnsServiceIP', !isIPValid(net.dnsServiceIP), 'Enter a valid IP')
Expand Down