AKS Networking Models: Kubenet, Azure CNI, and Overlay
AKS Networking Overview
Azure Kubernetes Service (AKS) supports multiple networking models—Kubenet, Azure CNI, and Azure CNI Overlay. Each model balances IP management, scalability, and Azure service integration differently.
Kubenet
Pods receive IPs from a private range managed by the node. Outbound traffic is NATed through the node’s IP, and User Defined Routes (UDRs) connect pods across nodes.
| Pros | Cons | Best Use Case |
|---|---|---|
| Conserves IP addresses | Limited Azure service integration | Small dev/test clusters |
| Simple setup | NAT adds latency | IP conservation scenarios |
Azure CNI (Classic)
Each pod gets an IP directly from the Azure VNet subnet, making pods first-class citizens in the VNet with seamless Azure service integration.
| Pros | Cons | Best Use Case |
|---|---|---|
| Full Azure integration | High IP consumption | Enterprise workloads needing direct pod-to-service communication |
| Lower latency (no NAT) | Requires careful subnet planning | Moderate scale clusters |
Azure CNI Overlay (Dynamic)
Pods get IPs from a separate overlay CIDR, not directly from the VNet. Traffic is encapsulated and mapped to the VNet, avoiding subnet exhaustion.
| Pros | Cons | Best Use Case |
|---|---|---|
| Scales to thousands of pods | Encapsulation overhead | Large-scale, multi-tenant workloads |
| Avoids subnet exhaustion | Newer model (less mature) | Dynamic scaling SaaS platforms |
| Supports dual-stack IPv4/IPv6 | Future-proof production clusters |
Comparison Table
| Feature | Kubenet | Azure CNI | Azure CNI Overlay |
|---|---|---|---|
| IP Consumption | Low | High | Low (overlay CIDR) |
| Azure Integration | Limited | Full | Full |
| Performance | NAT overhead | Direct, fast | Slight encapsulation overhead |
| Scalability | Limited | Subnet-bound | Very high |
| Complexity | Simple | Medium (subnet planning) | Medium (overlay config) |
Practical Guidance
- Use Kubenet for dev/test clusters where IP conservation is critical.
- Use Azure CNI for enterprise workloads needing direct Azure service integration.
- Use Azure CNI Overlay for high-scale, multi-tenant workloads to avoid IP exhaustion and enable dynamic scaling.