1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["3199"],{71330:function(e,n,t){t.r(n),t.d(n,{frontMatter:()=>l,toc:()=>s,default:()=>u,metadata:()=>i,assets:()=>a,contentTitle:()=>c});var i=JSON.parse('{"id":"getting-started/kubernetes/managed-public-cloud/aks","title":"Microsoft Azure Kubernetes Service (AKS)","description":"Enable Calico network policy in AKS.","source":"@site/calico_versioned_docs/version-3.28/getting-started/kubernetes/managed-public-cloud/aks.mdx","sourceDirName":"getting-started/kubernetes/managed-public-cloud","slug":"/getting-started/kubernetes/managed-public-cloud/aks","permalink":"/calico/3.28/getting-started/kubernetes/managed-public-cloud/aks","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico_versioned_docs/version-3.28/getting-started/kubernetes/managed-public-cloud/aks.mdx","tags":[],"version":"3.28","frontMatter":{"description":"Enable Calico network policy in AKS."},"sidebar":"calicoSidebar","previous":{"title":"IBM Cloud Kubernetes Service (IKS)","permalink":"/calico/3.28/getting-started/kubernetes/managed-public-cloud/iks"},"next":{"title":"Self-managed public cloud","permalink":"/calico/3.28/getting-started/kubernetes/self-managed-public-cloud/"}}'),o=t(37937),r=t(17869);let l={description:"Enable Calico network policy in AKS."},c="Microsoft Azure Kubernetes Service (AKS)",a={},s=[{value:"Big picture",id:"big-picture",level:2},{value:"Value",id:"value",level:2},{value:"How to",id:"how-to",level:2},{value:"Install AKS with Calico for network policy",id:"install-aks-with-calico-for-network-policy",level:3},{value:"Install AKS with Calico networking",id:"install-aks-with-calico-networking",level:3},{value:"Next steps",id:"next-steps",level:2}];function d(e){let n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.R)(),...e.components},{GeekDetails:t}=n;return t||function(e,n){throw Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("GeekDetails",!0),(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.header,{children:(0,o.jsx)(n.h1,{id:"microsoft-azure-kubernetes-service-aks",children:"Microsoft Azure Kubernetes Service (AKS)"})}),"\n",(0,o.jsx)(n.h2,{id:"big-picture",children:"Big picture"}),"\n",(0,o.jsx)(n.p,{children:"Enable Calico in AKS managed Kubernetes service."}),"\n",(0,o.jsx)(n.h2,{id:"value",children:"Value"}),"\n",(0,o.jsx)(n.p,{children:"AKS has built-in support for Calico, providing a robust implementation of the full Kubernetes Network Policy API. AKS users wanting to go beyond Kubernetes network policy capabilities can make full use of the Calico Network Policy API."}),"\n",(0,o.jsx)(n.p,{children:"You can also use Calico for networking on AKS in place of the default Azure VPC networking. This allows you to take advantage of the full set of Calico networking features."}),"\n",(0,o.jsx)(n.h2,{id:"how-to",children:"How to"}),"\n",(0,o.jsx)(n.h3,{id:"install-aks-with-calico-for-network-policy",children:"Install AKS with Calico for network policy"}),"\n",(0,o.jsx)(n.p,{children:"The geeky details of what you get:"}),"\n",(0,o.jsx)(t,{prodname:"Calico",details:"Policy:Calico,IPAM:Azure,CNI:Azure,Overlay:No,Routing:VPC Native,Datastore:Kubernetes"}),"\n",(0,o.jsx)(n.p,{children:"Alternatively you can run in Azure CNI overlay mode."}),"\n",(0,o.jsx)(n.p,{children:"The geeky details of what you get:"}),"\n",(0,o.jsx)(t,{prodname:"Calico",details:"Policy:Calico,IPAM:Azure,CNI:Azure,Overlay:Yes,Routing:VPC Native,Datastore:Kubernetes"}),"\n",(0,o.jsxs)(n.p,{children:["To enable Calico network policy enforcement, follow these step-by-step instructions: ",(0,o.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/azure/aks/use-network-policies",children:"Create an AKS cluster and enable network policy"}),"."]}),"\n",(0,o.jsx)(n.h3,{id:"install-aks-with-calico-networking",children:"Install AKS with Calico networking"}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:"Limitations"})}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.a,{href:"/calico/3.28/getting-started/kubernetes/windows-calico/",children:"Windows data plane"})," is not supported."]}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.a,{href:"https://github.com/projectcalico/vpp-dataplane",children:"VPP data plane"})," is not supported."]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:"The geeky details of what you get:"}),"\n",(0,o.jsx)(t,{prodname:"Calico",details:"Policy:Calico,IPAM:Calico,CNI:Calico,Overlay:VXLAN,Routing:Calico,Datastore:Kubernetes"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["Create an Azure AKS cluster with no Kubernetes CNI pre-installed. Please refer to ",(0,o.jsx)(n.a,{href:"https://docs.microsoft.com/en-us
1/azure/aks/use-byo-cni?tabs=azure-cli",children:"Bring your own CNI with AKS"})," for details."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:" # Create a resource group\n az group create --name my-calico-rg --location westcentralus\n\n az aks create --resource-group my-calico-rg --name my-calico-cluster --location westcentralus --pod-cidr 192.168.0.0/16 --network-plugin none\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["Get credentials to allow you to access the cluster with ",(0,o.jsx)(n.code,{children:"kubectl"}),":"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"az aks get-credentials --resource-group my-calico-rg --name my-calico-cluster\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:"Now that you have a cluster configured, you can install Calico."}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:"Install the operator."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.5/manifests/tigera-operator.yaml\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:"Configure the Calico installation."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"kubectl create -f - <<EOF\nkind: Installation\napiVersion: operator.tigera.io/v1\nmetadata:\n name: default\nspec:\n kubernetesProvider: AKS\n cni:\n type: Calico\n calicoNetwork:\n bgp: Disabled\n ipPools:\n - cidr: 192.168.0.0/16\n encapsulation: VXLAN\n---\napiVersion: operator.tigera.io/v1\nkind: APIServer\nmetadata:\n name: default\nspec: {}\nEOF\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:"Confirm that all of the pods are running with the following command."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"watch kubectl get pods -n calico-system\n"})}),"\n",(0,o.jsxs)(n.p,{children:["Wait until each pod has the ",(0,o.jsx)(n.code,{children:"STATUS"})," of ",(0,o.jsx)(n.code,{children:"Running"}),"."]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.h2,{id:"next-steps",children:"Next steps"}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:"Recommended"})}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:(0,o.jsx)(n.a,{href:"https://www.projectcalico.org/everything-you-need-to-know-about-kubernetes-networking-on-azure/",children:"Video: Everything you need to know about Kubernetes networking on Azure"})}),"\n",(0,o.jsx)(n.li,{children:(0,o.jsx)(n.a,{href:"/calico/3.28/network-policy/get-started/kubernetes-policy/kubernetes-network-policy",children:"Get started with Kubernetes network policy"})}),"\n",(0,o.jsx)(n.li,{children:(0,o.jsx)(n.a,{href:"/calico/3.28/network-policy/get-started/calico-policy/calico-network-policy",children:"Get started with Calico network policy"})}),"\n",(0,o.jsx)(n.li,{children:(0,o.jsx)(n.a,{href:"/calico/3.28/network-policy/get-started/kubernetes-default-deny",children:"Enable default deny for Kubernetes pods"})}),"\n"]})]})}function u(e={}){let{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},17869:function(e,n,t){t.d(n,{R:()=>l,x:()=>c});var i=t(82645);let o={},r=i.createContext(o);function l(e){let n=i.useContext(r);return i.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:l(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.