Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
Azure Kubernetes Service (AKS) clusters can run workloads on Windows Server node pools, which are groups of Windows-based virtual machines. Setting these up involves choosing a network model and ensuring the cluster can connect to necessary Azure services. There are two main network models to choose from. Kubenet Networking is simpler and lets AKS manage most of the network setup automatically. Azure Container Networking Interface (CNI) is more advanced and connects the AKS nodes directly to an existing Azure Virtual Network, giving you more control over IP addresses and routing.
Your choice between Kubenet and Azure CNI affects how the cluster communicates. With Azure CNI, each pod gets an IP address from the virtual network's subnet, just like a regular virtual machine. This requires careful planning of your IP address space beforehand. With either model, you must configure the network to allow the Windows nodes to reach critical services like the AKS API server, the Microsoft Container Registry for pulling container images, and Azure Storage Accounts.
For the cluster to work properly, the Windows Server nodes need to resolve names and connect to the internet or your on-premises network. You must ensure DNS can resolve the hostnames for all the Azure services the cluster depends on. You also need to set up outbound internet connectivity, often through a firewall or proxy, so nodes can download container images and software updates. If your cluster needs to talk to on-premises systems, you might need to configure DNS forwarding or use a peered virtual network.
To handle changing workloads efficiently, you can configure autoscaling for your node pools. The Cluster Autoscaler can automatically add or remove nodes in a pool based on the resource needs of your pods. You can also use the Horizontal Pod Autoscaler to increase or decrease the number of pod replicas based on metrics like CPU usage. This combination helps maintain performance during traffic spikes and saves cost when demand is low. You monitor these metrics to decide when to scale resources down.
Securing an AKS cluster with Windows nodes involves controlling traffic at multiple levels. You use Azure Network Security Groups (NSGs) attached to the node's subnet to filter traffic entering and leaving the virtual network (North-South traffic). Inside the cluster, you use Azure Network Policy Manager or Calico to create network policies that control which pods can talk to each other (East-West traffic). This micro-segmentation limits the spread of any potential security issues.
For a secure hybrid deployment, it is a best practice to use private endpoints for services like Azure Container Registry, storage, and key vaults. This keeps traffic between your AKS cluster and these services entirely within the Azure private network, not going over the public internet. You should also use system-assigned managed identities for your AKS cluster and other resources, which provides a secure and automatically managed identity for authenticating to Azure services without storing credentials in your code.
StudyCerts
StudyCerts