Configure Azure CNI Overlay networking in Azure Kubernetes Service (AKS)

For dual-stack networking, use a supported Kubernetes version in AKS that's available in your region.

Key parameters for Azure CNI Overlay AKS clusters

The following table describes the key parameters for configuring Azure CNI Overlay networking in AKS clusters:

The default behavior for network plugins depends on whether you explicitly set --network-plugin:

• If you don't specify --network-plugin, AKS defaults to Azure CNI Overlay.
• If you specify --network-plugin=azure and omit --network-plugin-mode, AKS intentionally uses virtual network (node subnet) mode for backward compatibility.

Create an Azure CNI Overlay AKS cluster

Create an Azure CNI Overlay AKS cluster by using the az aks create command with --network-plugin=azure and --network-plugin-mode=overlay. If you don't specify a value for --pod-cidr, AKS assigns the default value of 10.244.0.0/16.

az aks create \
  --name $CLUSTER_NAME \
  --resource-group $RESOURCE_GROUP \
  --location $REGION \
  --network-plugin azure \
  --network-plugin-mode overlay \
  --pod-cidr 192.168.0.0/16 \
  --generate-ssh-keys

Add a new node pool to a dedicated subnet

Add a node pool to a different subnet within the same virtual network to control virtual machine (VM) node IP addresses for network traffic to virtual network or peered virtual network resources.

Add a new node pool to the cluster by using the az aks nodepool add command and specify the subnet resource ID with the --vnet-subnet-id parameter. For example:

az aks nodepool add \
  --resource-group $RESOURCE_GROUP \
  --cluster-name $CLUSTER_NAME \
  --name $NODE_POOL_NAME \
  --node-count 1 \
  --mode system \
  --vnet-subnet-id $SUBNET_RESOURCE_ID

About Azure CNI Overlay AKS clusters with dual-stack networking

You can deploy your Azure CNI Overlay AKS clusters in a dual-stack mode with an Azure virtual network. In this configuration, nodes receive both an IPv4 and IPv6 address from the Azure virtual network subnet. Pods receive an IPv4 and IPv6 address from a different address space to the Azure virtual network subnet of the nodes. Network address translation (NAT) is then configured so that the pods can reach resources on the Azure virtual network. The source IP address of the traffic is NAT'd to the VM node's primary IP address of the same family (IPv4 to IPv4 and IPv6 to IPv6).

Dual-stack networking limitations

The following features aren't supported with dual-stack networking:

• Azure network policies
• Calico network policies
• Standard NAT Gateway, which supports only IPv4. For dual-stack egress, use StandardV2 NAT Gateway. The AKS-managed managedNATGatewayV2 outbound type is in preview. Before using StandardV2, review its known limitations and regional availability and known issues. For configuration guidance, see Create a managed or user-assigned NAT gateway for your AKS cluster.
• Virtual nodes add-on

Key parameters for dual-stack networking

The following table describes the key parameters for configuring dual-stack networking in Azure CNI Overlay AKS clusters:

Create a dual-stack Azure CNI Overlay AKS cluster (Linux)

1. Create an Azure resource group for the cluster by using the az group create command:

   az group create --location $REGION --name $RESOURCE_GROUP
   

2. Create a dual-stack AKS cluster by using the az aks create command with the --ip-families parameter set to ipv4,ipv6:

   az aks create \
     --location $REGION \
     --resource-group $RESOURCE_GROUP \
     --name $CLUSTER_NAME \
     --network-plugin azure \
     --network-plugin-mode overlay \
     --ip-families ipv4,ipv6 \
     --generate-ssh-keys
   

Create a dual-stack Azure CNI Overlay AKS cluster (Windows)

1. Create a cluster with Azure CNI Overlay by using the az aks create command:

   az aks create \
     --name $CLUSTER_NAME \
     --resource-group $RESOURCE_GROUP \
     --location $REGION \
     --network-plugin azure \
     --network-plugin-mode overlay \
     --ip-families ipv4,ipv6 \
     --generate-ssh-keys
   

2. Add a Windows node pool to the cluster by using the az aks nodepool add command:

   az aks nodepool add \
     --resource-group $RESOURCE_GROUP \
     --cluster-name $CLUSTER_NAME \
     --os-type Windows \
     --name $WINDOWS_NODE_POOL_NAME \
     --node-count 2
   

Deploy an example workload to the Azure CNI Overlay AKS cluster

Deploy dual-stack AKS CNI Overlay clusters with IPv4/IPv6 addresses on virtual machine nodes. This example deploys an NGINX web server and exposes it by using a LoadBalancer service with both IPv4 and IPv6 addresses.

Before you expose the workload, ensure an NGINX deployment is running in your cluster. If you don't already have one, create the deployment and wait for it to be ready by using the following commands:

kubectl create deployment nginx --image=nginx
kubectl rollout status deployment/nginx

Expose the workload by using a LoadBalancer service

Expose the NGINX deployment by using either kubectl commands or YAML manifests.

This section assumes an NGINX deployment named nginx is running in your cluster. To verify the deployment exists and is ready, run kubectl get deployment nginx and confirm the READY column shows all desired replicas as ready.