Share via

Impact analysis if shifting the existing Public AKS to an existing Site-2-Site vpn VNet?

Tanul 1,251 Reputation points
2022-06-01T15:40:16.787+00:00

Team.

We already have a Site-2-Site enabled VNet for our Azure VM's(with private ip's). Other than this we have an AKS cluster with public ip running in a separate vnet.

Now we have to move this existing AKS into our existing Site-2-Site network. Has anyone did something like this before. For this, we have to remove the public ip address of AKS and transfer it under site-2-site vnet with a private ip address. We are unable to figure out that this activity will impact which areas in our existing setup as we do not want to be in any disastrous situation.

I'm just guessing that after transferring AKS into other existing vnet is there any chance of facing ip shortage issues within the pods or services etc.

Is it possible to perform this successfully. If not, can anyone share the successful strategy to do this otherwise it shall badly impact all our environments.

Regards,
Tanul

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,887 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. KarishmaTiwari-MSFT 18,627 Reputation points Microsoft Employee
    2022-06-14T20:35:30+00:00

    Hi @Tanul ,

    This will require deploying a new AKS cluster into the S2S network. There are 2 primary configurations that will need to be considered:

    1. Deploy a private cluster (Create a private Azure Kubernetes Service cluster - Azure Kubernetes Service | Microsoft Learn)
    2. During deployment of private cluster also select an --outbound-type of userDefinedRouting (Customize user-defined routes (UDR) in Azure Kubernetes Service (AKS) - Azure Kubernetes Service | Microsoft Learn)

    You would will need to modify the AKS cluster subnet route table to point egress traffic via a default route (0.0.0.0/0) to some kind of appliance like a firewall, gateway, or proxy. From my understanding of your environment setup, the traffic will likely need to be directed to the S2S gateway.

    Ensure there is some pathway to public internet which is required for the AKS nodes to provision successfully (e.g. mcr.microsoft.com)

    Aside from the hard requirement for a new AKS cluster, it is best to create this new cluster and perform testing and either a gradual migration of workload (if possible) or a full migration of workload after thorough testing.

    The following is a good article to read that covers this "fully private" concept: Fully private AKS clusters — without any public ips — finally! | by Dennis Zielke | Medium

    Hope that helps. Let me now if you have further questions.

    0 comments