Troubleshooting outbound connectivity issues in Azure Kubernetes Service (AKS) can be a daunting task due to its layered nature. To help professionals, Microsoft has announced the “Connectivity Analysis” feature in public preview to simplify the troubleshooting process. The new tool is integrated into the AKS Portal and leverages the Azure Virtual Network Verifier engine. It is able to analyze network configurations without needing to generate live traffic.
While it’s a helpful tool, Microsoft does note that the feature"s scope is currently limited to outbound connectivity from node pools to the public internet and that it doesn"t analyze third-party or external network resources.
The Connectivity Analysis tool can be used to verify if traffic is being blocked by a variety of Azure resources such as Load Balancers, Firewalls, NSGs, and route tables. It can help to troubleshoot common issues including EgressBlocked conditions, failed image pulls from container registries, and unreachable webhooks.
The feature also provides a network flow diagram and detailed JSON output to help pinpoint the exact network component causing the issue. Microsoft"s announcement does mention that the tool, however, does have some limitations, including unsupported regions for CNI Overlay clusters, but this will be coming in early September. Regarding support for CNI Overlay clusters, it"s only available in the West US, West US 2, and South Central US regions. There are also user interface improvements in the pipeline, but they’re not available yet.
Microsoft said that it’s looking to support other types of analysis too and there are also plans to have support for connectivity analysis from a node pool to the API server and in-cluster node-to-node traffic. With this said, there is no specific timeline from Microsoft for these future features. To learn more about how to use the new tool, check out Microsoft"s announcement for detailed step-by-step instructions.