Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

patch (network topology): [appgw] right size appgw snet #304

Merged
merged 3 commits into from
Apr 22, 2022
Merged

patch (network topology): [appgw] right size appgw snet #304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b9293e1
right size app gw snet
ferantivero Apr 19, 2022
622570c
whitelist the new app gw snet address prefix
ferantivero Apr 19, 2022
1c60c68
Address PR Feedback: update network-topology diagram
ferantivero Apr 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion networking/network-topology.drawio
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion networking/spoke-BU0001A0008.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,7 +322,7 @@ resource vnetSpoke 'Microsoft.Network/virtualNetworks@2021-05-01' = {
{
name: 'snet-applicationgateway'
properties: {
addressPrefix: '10.240.4.16/28'
addressPrefix: '10.240.5.0/24'
networkSecurityGroup: {
id: nsgAppGwSubnet.id
}
Expand Down
6 changes: 3 additions & 3 deletions networking/topology.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,12 @@ In the future, this VNet might hold more subnets like [ACI Provider instance] su

## Subnet details

| Subnet | Upgrade Node | Nodes/VMs/Instance | % Seasonal scale out | +Nodes/VMs | Max Ips/Pods per VM/Node | [% Max Surge] | [% Max Unavailable] | +Ips/Pods per VM/Node | Tot. Ips/Pods per VM/Node | [Azure Subnet not assignable Ips factor] | [Private Endpoints] | [Minimum Subnet size] | Scaled Subnet size | [Subnet Mask bits] | Cidr | Host | Broadcast |
| Subnet | Upgrade Node | Nodes/VMs/Instance | % Seasonal scale out | +Nodes/VMs | Max Ips/Pods per VM/Node | [% Max Surge] | [% Max Unavailable] | +Ips/Pods per VM/Node | Tot. Ips/Pods per VM/Node | [Azure Subnet not assignable Ips factor] | [Private Endpoints] | [Minimum Subnet size] | Scaled Subnet size | [Subnet Mask bits] | Cidr | Host | Broadcast |
|--------------------------------------------------------|--------------|--------------------|------------------|------------|--------------------------|---------------|---------------------|-----------------------|---------------------------|------------------------------------------|---------------------|-----------------------|--------------------|--------------------|----------------|-------------|---------------|
| AKS System and User Nodepool Subnet | 2 | 5 | 200 | 10 | [30] | 100 | 0 | 30 | 60 | 5 | 0 | 372 | 982 | 22 | 10.240.0.0/22 | 10.240.0.0 | 10.240.3.255 |
| AKS Internal Load Balancer Services Subnet | 0 | 0 | 0 | 0 | 5 | 100 | 100 | 0 | 5 | 5 | 0 | 10 | 10 | 28 | 10.240.4.0/28 | 10.240.4.0 | 10.240.4.15 |
| Azure Application Gateway Subnet | 0 | [11] | 0 | 0 | 0 | 100 | 100 | 0 | 0 | 5 | 0 | 16 | 16 | 28 | 10.240.4.16/28 | 10.240.4.16 | 10.240.4.31 |
| Private Link Endpoint Subnet | 0 | 0 | 0 | 0 | 0 | 100 | 100 | 0 | 0 | 5 | 2 | 7 | 7 | 28 | 10.240.4.32/28 | 10.240.4.32 | 10.240.4.47 |
| Azure Application Gateway Subnet | 0 | [251] | 0 | 0 | 0 | 100 | 100 | 0 | 0 | 5 | 0 | 256 | 256 | 24 | 10.240.5.0/24 | 10.240.5.0 | 10.240.5.255 |
| Gateway Subnet (GatewaySubnet) | 0 | [27<sup>1</sup>] | 0 | 0 | 0 | 100 | 100 | 0 | 0 | 5 | 0 | 32 | 32 | 27 | 10.200.0.64/27 | 10.200.0.64 | 10.200.0.95 |
| Azure Firewall Subnet (AzureFirewallSubnet) | 0 | [59] | 0 | 0 | 0 | 100 | 100 | 0 | 0 | 5 | 0 | 64 | 64 | 26 | 10.200.0.0/26 | 10.200.0.0 | 10.200.0.63 |
| Azure Bastion Subnet (AzureBastionSubnet) | 0 | [27<sup>2</sup>] | 0 | 0 | 0 | 100 | 100 | 0 | 0 | 5 | 0 | 32 | 32 | 27 | 10.200.0.96/27 | 10.200.0.96 | 10.200.0.127 |
Expand All @@ -47,7 +47,7 @@ In the future, this VNet might hold more subnets like [ACI Provider instance] su
3. [Private Endpoints] subnet: Private Links are created for Azure Container Registry and Azure Key Vault, so these Azure services can be accessed using Private Endpoints within the spoke virtual network. There are multiple [Private Link deployment options]; in this implementation they are deployed to a dedicated subnet within the spoke virtual network.

[27<sup>1</sup>]: https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub
[11]: https://docs.microsoft.com/azure/application-gateway/configuration-overview#size-of-the-subnet
[251]: https://docs.microsoft.com/azure/application-gateway/configuration-overview#size-of-the-subnet
[59]: https://docs.microsoft.com/azure/firewall/firewall-faq#does-the-firewall-subnet-size-need-to-change-as-the-service-scales
[27<sup>2</sup>]: https://docs.microsoft.com/azure/bastion/bastion-create-host-portal#createhost
[30]: https://docs.microsoft.com/azure/aks/use-system-pools#system-and-user-node-pools
Expand Down
6 changes: 3 additions & 3 deletions workload/traefik.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ data:
[http.middlewares]
[http.middlewares.gzip-compress.compress]
[http.middlewares.app-gateway-snet.ipWhiteList]
sourceRange = ["10.240.4.16/28"]
sourceRange = ["10.240.5.0/24"]
[entryPoints]
[entryPoints.metrics]
address = ":8082"
Expand All @@ -133,7 +133,7 @@ data:
[entryPoints.websecure]
address = ":8443"
[entryPoints.websecure.forwardedHeaders]
trustedIPs = ["10.240.4.16/28"]
trustedIPs = ["10.240.5.0/24"]
[entryPoints.websecure.http.tls]
options = "default"
[ping]
Expand Down Expand Up @@ -300,4 +300,4 @@ spec:
- name: data
emptyDir: {}
nodeSelector:
agentpool: npuser01
agentpool: npuser01