Network Policies in AKS

[sharnath]

We have hardened network policy requirements for certain group of K8S pods. Can I install AKS on multiple VNETs and attach it to a namescape? OR Does AKS support advanced network policies?

Example - Stateful pods should not have an outbound connection, Some communication pods can make internet connections, some pods allow a peer to peer communication for replication across the region.

How do we support these requirements with AKS?

[sauryadas]

How do you plan to apply network policies? An AKS cluster can be deployed in a single VNET/subnet only. Network policy support is planned with Calico. You can use kube-router today if you wish.

[sharnath]

Currently we are planning to use ACS-engine with Calico. When can we expect this feature in AKS? - Santosh

…

On Jun 16, 2018, at 8:01 PM, Saurya Das ***@***.***> wrote: Calico

[sauryadas]

Couple of months hopefully Thanks Saurya

________________________________ From: sharnath <notifications@github.com> Sent: Saturday, June 16, 2018 9:26:41 PM To: Azure/AKS Cc: Saurya Das; Comment Subject: Re: [Azure/AKS] Network Policies in AKS (#435) Currently we are planning to use ACS-engine with Calico. When can we expect this feature in AKS? - Santosh

On Jun 16, 2018, at 8:01 PM, Saurya Das ***@***.***> wrote: Calico

— You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2FAKS%2Fissues%2F435%23issuecomment-397853798&data=02%7C01%7Csaudas%40microsoft.com%7C003d3bb6f97547d5cf6308d5d40a871b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636648064037088427&sdata=MIctY05Z9VoUHIPzlzCZuzEP9NxAtWRyxKDqR%2BglO7k%3D&reserved=0>, or mute the thread<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAOrMb-FC_xiSyHLlLFEI042RH6iBrsHuks5t9dqBgaJpZM4Uohsg&data=02%7C01%7Csaudas%40microsoft.com%7C003d3bb6f97547d5cf6308d5d40a871b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636648064037098431&sdata=gYIkx5e%2FUYiBLodhpgHiht4eKyba69huHWkS%2FHmP8EM%3D&reserved=0>.

[mjhoffman65]

Any update to the timeframe for Calico support with AKS? It is our preferred network policy implementation

[sauryadas]

targeting q3 cy 2018

[mbrancato]

@sauryadas Can you elaborate if this will support the Azure network plugin with advanced networking?

[sauryadas]

Yes the support is with advanced networking Thanks Saurya

…

________________________________ From: Mike Brancato <notifications@github.com> Sent: Monday, July 30, 2018 7:24:18 AM To: Azure/AKS Cc: Saurya Das; Mention Subject: Re: [Azure/AKS] Network Policies in AKS (#435) @sauryadas<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fsauryadas&data=02%7C01%7Csaudas%40microsoft.com%7C11052b5931164a86199908d5f628230d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636685574605663712&sdata=MnMIowM3jwif2%2B2BrLDoyP8ZuoMtQ6SXdWbolDv9Tm8%3D&reserved=0> Can you elaborate if this will support the Azure network plugin with advanced networking? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2FAKS%2Fissues%2F435%23issuecomment-408881651&data=02%7C01%7Csaudas%40microsoft.com%7C11052b5931164a86199908d5f628230d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636685574605663712&sdata=xCziFGLJ1F1rBkflW8zwdd%2F4RrOVooyAPi%2FJXluIILs%3D&reserved=0>, or mute the thread<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAOrMb31MgGvZO0RGtbfy80w4XXsUb5jTks5uLxcSgaJpZM4Uohsg&data=02%7C01%7Csaudas%40microsoft.com%7C11052b5931164a86199908d5f628230d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636685574605663712&sdata=HEdevQyfWXeRN10hOuEVK%2FUasxTS0am412Acu%2B5mSvE%3D&reserved=0>.

[suonto]

@sauryadas I'm using kubenet - calico, but it seems that NetworkPolicies have no effect. Are they supposed to work already?

[MCKLMT]

Could we have a clear status on this feature please?
Is it possible to restrict the traffic between different namespaces on AKS? This blog post explains how to setup that with kube -router but you are telling it is not working yet with calico, correct?
https://carlos.mendible.com/2018/07/19/at-last-network-policies-in-aks-with-kube-router/

Thanks

[suonto]

@MCKLMT just to be precise, currently AKS does not support calico network policy with kubenet (even though the docs say so). If you do not add it, the cluster creation command (arms template) outputs calico as the policy. However, it does not seem to be true, since any network policies I've created do not have any effect. But I guess it's coming...

[MCKLMT]

@sauryadas Could you give us more details about the support of network policies on AKS please?

[sauryadas]

@MCKLMT Need another 4-6 weeks for the network policy integration with Calico. Will post an update when it is ready

[MCKLMT]

And what about kube-router?

[sauryadas]

I believe kube-router should work but we havent tested it extensively.

[MCKLMT]

Some guys reported that the network policies on kube-router are not working properly.
@sauryadas Could you confirm that kube-router works as expected?

[badalk]

@MCKLMT Need another 4-6 weeks for the network policy integration with Calico. Will post an update when it is ready

@sauryadas - is this something that can be prioritized. This is one of the must haves we need to pass through from the infosec standpoint to secure pod to pod communication or namespace to namespace communication

[dberuben]

@sauryadas Any update ?

[sauryadas]

End of Nov.. Apologies for the delay.

[gonarys]

@sauryadas We are at the end of the month. Any update ?

[flamingboo]

@sauryadas network policies still planned for end of nov? or any new dates?

[azurewraith]

@sauryadas -- we're now into December, any updates on the ETA for this?

[bramvdklinkenberg]

would be (more than) nice to see this in AKS before the end of the year.

[yves-vogl]

@sauryadas Can you give a feedback about the current state of implementation? We think to postpone implementing kube-router for isolation in favour of the officially supported feature.

[seanmck]

The feature is basically complete, but as we are entering a holiday release freeze, it may not roll out until early January.

[badalk]

@seanmck thats not a good news :(. May we know whether this would be based on calico / kube-router?

Regards
Badal

[yves-vogl]

Hallo @seanmck,
thanks for your feedback. And also thanks for the great work you guys do.
I wish you happy holidays and will look eagerly forward to January.

@badalk Do you really think so? For me these are great news as it means that there's progress and open communication. @sauryadas has already given an answer to your question: it will be based on Calico and can be used with Advanced Networking.

[badalk]

@yves-vogl I did not mean that its a bad news for the community. In my context it is, as we have a release planned before holidays and was expecting this to be available anytime soon.
@sauryadas and @seanmck my intent was not to put down the effort you guys put in in making aks and azure in general a better cloud platform. and I equally appreciate what you guys do

Have a great holiday all

[seanmck]

@badalk No worries. We certainly understand that it is frustrating when dates aren't hit. We will get this out as soon as we can.

[youenchene]

@seanmck any details on AKS update deployment strategy over the different regions?

[IgorRogDevPro]

@seanmck Sorry for possibly a stupid question, but are you looking forward to making calicoctl tool available for end users of AKS? I guess yes, since the users have access to K8S API in K8S, but would like to double check nevertheless.
Happy holidays!

[bcastilho90]

Hi there @seanmck! Happy holidays!

Any updates on when it will be available? So looking forward to have this available in AKS.

Thanks

[badalk]

Some guys reported that the network policies on kube-router are not working properly.
@sauryadas Could you confirm that kube-router works as expected?

I am facing the same issue, kube router deployed as daemonset does no seem to work very well with standard network policies. I am able to deny all traffic but If I allow traffic from other pods, it does not work

[erewok]

@seanmck, I too would like to know the status of the Calico rollout for AKS. We're planning to work on some projects that require Network Policies, and I'm not sure if I should shuffle our schedule around to delay these.

I notice that the roadmap page lists this feature as "In Development" as of January 28th, but from your note above, I assumed it would be released around this time.

Does "In Development" mean we can enable it with a feature flag (so we can continue our own development that relies on this) or does it mean that it will be released shortly?

[mbrancato]

For anyone watching, it looks like Calico is available today in 1.12.4, which you should see as an available version now in AKS. It is a preview feature and unsupported. This is mentioned in the new change log document: https://github.com/Azure/AKS/blob/master/CHANGELOG.md

I previously asked if it would support Azure CNI implying existing clusters #435 (comment), it doesn't look like that support exists yet. New clusters only with the Calico CNI.

[sauryadas]

And here is the official documentation
https://docs.microsoft.com/en-us/azure/aks/use-network-policies

[bobhenkel]

How long will this be in preview? Looking at when it will be in a release state and ready for production use.

Thanks!

[feiskyer]

Already supported and preview flag removed, see the documentation at https://docs.microsoft.com/en-us/azure/aks/use-network-policies.

[sauryadas]

https://azure.microsoft.com/en-us/updates/user-defined-network-policy-in-azure-kubernetes-service-aks-is-now-available/