Support for AKS Load Balancer
AKS supports Preserve client IP.
For the following policy intent:
Consumer to provider service, service protocol and port with allow action rules for various cases generates as follows:
|
Case |
Preserve Client |
|---|---|
|
1 |
On |
|
2 |
Off |
Case 1: Preserve client IP is on.
On the consumer node we generate an egress rule with consumer to load balancer service (lb ingress ip) service protocol and port allow.
A prerouting rule generated for provider node, which specifies the consumer as the source and all provider nodes as the destination. The rule includes the service protocol as the protocol and the node port of the service as the port, with the action set to allow.
On the provider pod, we generate an Ingress rule with src as provider nodes, dest as provider pod (any), protocol as target protocol, port as target port and action as allow.
Case 2: Preserve client IP is off.
On the consumer node we generate an egress rule with consumer to load balancer service (lb ingress ip) service protocol and port allow.
The provider node generates a prerouting rule that sets the lb ingress IPs as the source and all provider nodes as the destination. The rule specifies the service protocol as the protocol and the node port of the service as the port, with the action set to allow.
On the provider pod, we generate an Ingress rule with source as provider nodes, destination as provider pod (any), protocol as target protocol, port as target port and action as allow.