Pinging is not working inside the pod/container AKS

Question

Pinging is not working inside the pod/container AKS

Mohd Rashid 20

Hi,

I have one cluster aks and inside cluster i deploy 2 pods both are running

when i go inside the pod and do ping google.com its not pinging even i can do telnet and nslookup both work but ping is not working for any domain weather my domain or google domain its not pinging

can u tell me where im missing or what i need to do

I have create NSG in Inbound rule and Outbound rule both but still no solve

Here is my cluster details

--resource-group Perfai-Prod --name PerfAI-Prod

Network configuration: Azure CNI Overlay

here is my details

ping to any domain is not pinging nslookup and telnet are working fine

and if i get into services like kubectl get svc -o wide and i try to ping that private ip from inside the pod its not pinging but when i use pod private ip is pinging not working from service

here is some screenshot

User's image

please tel me how i can achieve this ping issue inside pod what i miss do let me know and im using nginx ingress controller LB

Anonymous

2024-10-23T23:22:32.9766667+00:00

Hi Mohd Rashid,

Welcome to the Microsoft Q&A Platform. Thank you for posting your query here. We are looking into it and will get back to you soon.

Thank you.
Anonymous

2024-10-24T03:29:56.0266667+00:00

Hi Mohd Rashid,

Based upon your query, even after allowing ICMP in the outbound Network Security Group (NSG) rules, the issue is likely due to the Azure CNI Overlay network model or other underlying restrictions in the AKS networking layer.

With Azure CNI Overlay, ICMP traffic is often blocked at the network layer regardless of the NSG rules. This occurs because of how the Azure CNI Overlay plugin routes and isolates pod traffic. The overlay network focuses on higher-level protocols like TCP and UDP, which are essential for typical application traffic, while ICMP is deprioritized or blocked.

The Azure CNI Overlay model does not handle ICMP (used by ping) in the same way it handles DNS (used by nslookup) or TCP (used by telnet). As a result, even with NSG rules allowing ICMP, the AKS network itself may continue to block this traffic.

Instead of using ping, you can rely on tools like telnet, curl, or HTTP requests to test external connectivity and service availability.

If the information is helpful, please consider by clicking the "Upvote" on the post.

Thank you.
Mohd Rashid 20 Reputation points

2024-10-24T07:05:56.44+00:00

Hi @Anonymous
I understand what you said about Azure CNI Overlay but we need to ping that very important because we unable to find customer domain ping from my service Any other solution do u have or alternate do u have
anrodrigues-MSFT 0 Reputation points Microsoft Employee

2024-10-24T13:06:47.74+00:00

Hi @Mohd Rashid Thank you for reaching out to the Microsoft Q&A platform.

Please note that ICMP messages are blocked in some network appliances, levels and archs, which will render the "ping" not available.

Ping ICMP messages are no longer available and possible to use has @Anonymous has mentioned.

The alternative is to use for ex netcat (previous telnet) to check connectivity. (nc-vz $DEST_IP $PORT)

If you have any questions, please drop a comment by tagging my userid @anrodrigues-MSFT

If this does answer your question, please accept it as the answer as a token of appreciation.
Mohd Rashid 20 Reputation points

2024-10-24T15:55:03.98+00:00

@anrodrigues-MSFT

ok can u tell how to achive same thing using curl method instead of ping

even i try using curl its not working

can u tell to how i can achive this
Mohd Rashid 20 Reputation points

2024-10-24T18:18:14.8866667+00:00

@anrodrigues-MSFT

ok can u tell me how I can do same for curl instead of ping because when I go inside pod I try this curl https://google.com and i got response curl not found i cannot manual install curl I need some other method to get curl whenever I go inside pod and curl it should got response just tell where do I need to make changes in Azure portal
Anonymous

2024-10-25T07:20:57.19+00:00
Hi Mohd Rashid,

Based up on your latest response you are facing issue with curl command. Please follow below steps to resolve your issue:

First, log into the Kubernetes pod using the following command:

kubectl exec -it <pod-name> -- /bin/sh

Inside the pod, if curl is not installed, you’ll need to install it before executing any curl commands. Use the command below to install curl:

apt update && apt install curl -y

Once curl is installed, you can use it to verify if DNS is reachable with the following command:

http://example.com

If the information is helpful, please consider by clicking the "Upvote" on the post.
Mohd Rashid 20 Reputation points

2024-10-25T07:26:31.6133333+00:00

@Anonymous

The step you have shown me already i know and i did that
but i dont want that solution

how i want is that
curl should run everytime and pods get restart whenever code commit that curl will not work

what i want is that curl should be availabel everytime whenever pods get restart
Mohd Rashid 20 Reputation points

2024-10-25T07:30:35.1333333+00:00
@Anonymous @anrodrigues-MSFT

I know you are trying to help me but plse try to understand what im looking for error or issue related to curl

above steps i know but think when pods get restart when a new code commit comes that time a new pods comes and again i need to install curl and also think that curl should work continue in background whenever i go inside pod i do curl google.com i should get response i dont want to instal curl manually then try with curl

Here comes with real example which we used in our product

This is adding valid base path URL in your product

Error showing invalid base path inside product

And if i do curl inside pod i get below response saying "curl : not found"

Everytime cannot install curl manully inside pod

just tell me what setting do i need in Azure portal like NSG, Subnet, LB anything that help me
to make to work curl inside pod

Answer accepted by question author

0 additional answers

Your answer

Anonymous

2024-10-23T23:22:32.9766667+00:00

Hi Mohd Rashid,

Welcome to the Microsoft Q&A Platform. Thank you for posting your query here. We are looking into it and will get back to you soon.

Thank you.
Anonymous

2024-10-24T03:29:56.0266667+00:00

Hi Mohd Rashid,

Based upon your query, even after allowing ICMP in the outbound Network Security Group (NSG) rules, the issue is likely due to the Azure CNI Overlay network model or other underlying restrictions in the AKS networking layer.

With Azure CNI Overlay, ICMP traffic is often blocked at the network layer regardless of the NSG rules. This occurs because of how the Azure CNI Overlay plugin routes and isolates pod traffic. The overlay network focuses on higher-level protocols like TCP and UDP, which are essential for typical application traffic, while ICMP is deprioritized or blocked.

The Azure CNI Overlay model does not handle ICMP (used by ping) in the same way it handles DNS (used by nslookup) or TCP (used by telnet). As a result, even with NSG rules allowing ICMP, the AKS network itself may continue to block this traffic.

Instead of using ping, you can rely on tools like telnet, curl, or HTTP requests to test external connectivity and service availability.

If the information is helpful, please consider by clicking the "Upvote" on the post.

Thank you.
Mohd Rashid 20 Reputation points

2024-10-24T07:05:56.44+00:00

Hi @Anonymous
I understand what you said about Azure CNI Overlay but we need to ping that very important because we unable to find customer domain ping from my service Any other solution do u have or alternate do u have
anrodrigues-MSFT 0 Reputation points Microsoft Employee

2024-10-24T13:06:47.74+00:00

Hi @Mohd Rashid Thank you for reaching out to the Microsoft Q&A platform.

Please note that ICMP messages are blocked in some network appliances, levels and archs, which will render the "ping" not available.

Ping ICMP messages are no longer available and possible to use has @Anonymous has mentioned.

The alternative is to use for ex netcat (previous telnet) to check connectivity. (nc-vz $DEST_IP $PORT)

If you have any questions, please drop a comment by tagging my userid @anrodrigues-MSFT

If this does answer your question, please accept it as the answer as a token of appreciation.
Mohd Rashid 20 Reputation points

2024-10-24T15:55:03.98+00:00

@anrodrigues-MSFT

ok can u tell how to achive same thing using curl method instead of ping

even i try using curl its not working

can u tell to how i can achive this
Mohd Rashid 20 Reputation points

2024-10-24T18:18:14.8866667+00:00

@anrodrigues-MSFT

ok can u tell me how I can do same for curl instead of ping because when I go inside pod I try this curl https://google.com and i got response curl not found i cannot manual install curl I need some other method to get curl whenever I go inside pod and curl it should got response just tell where do I need to make changes in Azure portal
Anonymous

2024-10-25T07:20:57.19+00:00

Hi Mohd Rashid,

Based up on your latest response you are facing issue with curl command. Please follow below steps to resolve your issue:

First, log into the Kubernetes pod using the following command:

kubectl exec -it <pod-name> -- /bin/sh

Inside the pod, if curl is not installed, you’ll need to install it before executing any curl commands. Use the command below to install curl:

apt update && apt install curl -y

Once curl is installed, you can use it to verify if DNS is reachable with the following command:

http://example.com

If the information is helpful, please consider by clicking the "Upvote" on the post.
Mohd Rashid 20 Reputation points

2024-10-25T07:26:31.6133333+00:00

@Anonymous

The step you have shown me already i know and i did that
but i dont want that solution

how i want is that
curl should run everytime and pods get restart whenever code commit that curl will not work

what i want is that curl should be availabel everytime whenever pods get restart
Mohd Rashid 20 Reputation points

2024-10-25T07:30:35.1333333+00:00

@Anonymous @anrodrigues-MSFT

I know you are trying to help me but plse try to understand what im looking for error or issue related to curl

above steps i know but think when pods get restart when a new code commit comes that time a new pods comes and again i need to install curl and also think that curl should work continue in background whenever i go inside pod i do curl google.com i should get response i dont want to instal curl manually then try with curl

Here comes with real example which we used in our product

This is adding valid base path URL in your product

Error showing invalid base path inside product

And if i do curl inside pod i get below response saying "curl : not found"

Everytime cannot install curl manully inside pod

just tell me what setting do i need in Azure portal like NSG, Subnet, LB anything that help me
to make to work curl inside pod

Answer 1

Anonymous

Hi Mohd Rashid,

Thanks for sharing more context on the issue.

To ensure that curl is always available in your pods after a restart or when new pods are created, I recommend creating a custom Docker image that includes curl. This way, every new pod will have curl installed automatically, eliminating the need for manual installation each time.

If the information provided has been helpful to you then please accept the answer by clicking the Accept Answer & Upvote on the post. We value your feedback, and it will help us to assist others who might have a similar query.
User's image

Anonymous

2024-10-28T20:00:52.06+00:00

Hi Mohd Rashid,

Just I wanted to see if you had to chance to review my answer If you found helpful, could you please click the "Accept answer" on my post to help increase visibility of this question for other members of the Microsoft Q&A community. Thank you for helping to improve Microsoft Q&A!

Thank you.
Anonymous

2024-10-29T22:07:25.8066667+00:00

Hi Mohd Rashid,

Just checking in to see if you have got a chance to see the answer posted in resolving the issue. If you found helpful, could you please click the "Accept answer" on my post to help increase visibility of this question for other members of the Microsoft Q&A community. Thank you for helping to improve Microsoft Q&A!

Thank you.

Share via

Pinging is not working inside the pod/container AKS

0 additional answers

Your answer