Skip to content

Commit b9697cb

Browse files
authored
Clarify egress traffic restriction instructions in AKS
Edit review per CI 5011
1 parent 5a89eea commit b9697cb

1 file changed

Lines changed: 4 additions & 4 deletions

File tree

support/azure/azure-kubernetes/connectivity/errors-arfter-restricting-egress-traffic.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,21 +18,21 @@ Certain commands of the [kubectl](https://kubernetes.io/docs/reference/kubectl/)
1818

1919
## Cause
2020

21-
When you restrict egress traffic from an AKS cluster, your settings must comply with [required Outbound network and FQDN rules for AKS clusters](/azure/aks/outbound-rules-control-egress). If your settings are in conflict with any of these rules, the symptoms of egress traffic restriction issues occur.
21+
When you restrict egress traffic from an AKS cluster, your settings must comply with [required Outbound network and FQDN (fully qualified domain names) rules for AKS clusters](/azure/aks/outbound-rules-control-egress). If your settings are in conflict with any of these rules, the egress traffic restriction issues occur.
2222

2323
## Solution
2424

2525
Verify that your configuration doesn't conflict with any of the [required Outbound network and FQDN rules for AKS clusters](/azure/aks/outbound-rules-control-egress) for the following items:
2626

2727
- Outbound ports
2828
- Network rules
29-
- Fully qualified domain names (FQDNs)
29+
- FQDNs
3030
- Application rules
3131

32-
Check out the NSG, firewall, or appliance that AKS traffic passes according to the configuration.
32+
Check the NSG (network security group), firewall, or appliance that AKS traffic passes through according to the configuration.
3333

3434
> [!NOTE]
35-
> The AKS outbound dependencies are almost entirely defined by using FQDNs. These FQDNs don't have static addresses behind them. The lack of static addresses means that you can't use network security groups (NSGs) to restrict outbound traffic from an AKS cluster. In addition, scenarios that only allow IPs obtained from required FQDNs after all deny in NSG are not enough. Since the IPs are not static, issues may occur later.
35+
> The AKS outbound dependencies are almost entirely defined by using FQDNs. These FQDNs don't have static addresses behind them. The lack of static addresses means that you can't use NSGs to restrict outbound traffic from an AKS cluster. Additionally, scenarios that allow only IPs that are obtained from required FQDNs after all deny in NSG are not enough. Because the IPs are not static, issues might occur later.
3636
3737
## More information
3838

0 commit comments

Comments
 (0)