// Module included in the following assemblies:
//
// * installing/installing_azure/installing-azure-government-region.adoc
// * installing/installing_azure/installing-azure-private.adoc
// * installing/installing_azure/installing-azure-vnet.adoc
// * installing/installing_azure/installing-restricted-networks-azure-installer-provisioned.adoc

ifeval::["{context}" == "installing-azure-government-region"]
:azure:
endif::[]
ifeval::["{context}" == "installing-azure-private"]
:azure-private:
endif::[]
ifeval::["{context}" == "installing-azure-vnet"]
:azure:
endif::[]
ifeval::["{context}" == "installing-restricted-networks-azure-installer-provisioned"]
:azure:
:restricted:
endif::[]

:_mod-docs-content-type: REFERENCE
[id="installation-about-custom-azure-vnet-requirements_{context}"]
= Requirements for using your VNet

[role="_abstract"]
When you deploy a cluster by using an existing VNet, you must perform additional network configuration before you install the cluster. In installer-provisioned infrastructure clusters, the installation program usually creates the following components, but it does not create them when you install into an existing VNet:

* Subnets
* Route tables
* VNets
* Network Security Groups

include::snippets/custom-dns-server.adoc[]

If you use a custom VNet, you must correctly configure it and its subnets for the installation program and the cluster to use. The installation program cannot subdivide network ranges for the cluster to use, set route tables for the subnets, or set VNet options like DHCP, so you must do so before you install the cluster.

The cluster must be able to access the resource group that contains the existing VNet and subnets. While all of the resources that the cluster creates are placed in a separate resource group that it creates, some network resources are used from a separate group. Some cluster Operators must be able to access resources in both resource groups. For example, the Machine API controller attaches NICs for the virtual machines that it creates to subnets from the networking resource group.

Your VNet must meet the following characteristics:

* The VNet's CIDR block must contain the `Networking.MachineCIDR` range, which is the IP address pool for cluster machines.
* The VNet and its subnets must belong to the same resource group, and the subnets must be configured to use Azure-assigned DHCP IP addresses instead of static IP addresses.

You must provide two subnets within your VNet, one for the control plane machines and one for the compute machines. Because Azure distributes machines in different availability zones within the region that you specify, your cluster will have high availability by default.

[NOTE]
====
By default, if you specify availability zones in the `install-config.yaml` file, the installation program distributes the control plane machines and the compute machines across availability zones within a region. To ensure high availability for your cluster, select a region with at least three availability zones. If your region contains fewer than three availability zones, the installation program places more than one control plane machine in the available zones. For more information, see "Availability zones" and "Regions".
====

To ensure that the subnets that you provide are suitable, the installation program confirms the following data:

* All the specified subnets exist.
* There are two private subnets, one for the control plane machines and one for the compute machines.
* The subnet CIDRs belong to the machine CIDR that you specified. Machines are not provisioned in availability zones that you do not provide private subnets for.
ifdef::azure[]
If required, the installation program creates public load balancers that manage the control plane and worker nodes, and Azure allocates a public IP address to them.
endif::[]

[NOTE]
====
If you destroy a cluster that uses an existing VNet, the VNet is not deleted.
====

[id="installation-about-custom-azure-vnet-nsg-requirements_{context}"]
== Network security group requirements

The network security groups for the subnets that host the compute and control plane machines require specific access to ensure that the cluster communication is correct. You must create rules to allow access to the required cluster communication ports.

[IMPORTANT]
====
The network security group rules must be in place before you install the cluster. If you attempt to install a cluster without the required access, the installation program cannot reach the Azure APIs, and installation fails.
====

.Required ports
[options="header",cols="1,3,1,1"]
|===

|Port
|Description
|Control plane
|Compute

|`80`
|Allows HTTP traffic
|
|x

|`443`
|Allows HTTPS traffic
|
|x

|`6443`
|Allows communication to the control plane machines
|x
|

|`22623`
|Allows internal communication to the machine config server for provisioning machines
|x
|

ifdef::restricted[]
|`*`
a|Allows connections to Azure APIs. You must set a Destination Service Tag to `AzureCloud`. ^[1]^
|x
|x

|`*`
a|Denies connections to the internet. You must set a Destination Service Tag to `Internet`. ^[1]^
|x
|x
endif::restricted[]
|===
[.small]
--
1. If you are using Azure Firewall to restrict the internet access, then you can configure Azure Firewall to allow the Azure APIs. A network security group rule is not needed. For more information, see "Configuring your firewall" in "Additional resources".
--

include::snippets/mcs-endpoint-limitation.adoc[]

Because cluster components do not modify the user-provided network security groups, which the Kubernetes controllers update, a pseudo-network security group is created for the Kubernetes controller to modify without impacting the rest of the environment.

.Ports used for all-machine to all-machine communications
[cols="2a,2a,5a",options="header"]
|===

|Protocol
|Port
|Description

|ICMP
|N/A
|Network reachability tests

.3+|TCP
|`1936`
|Metrics

|`9000`-`9999`
|Host level services, including the node exporter on ports `9100`-`9101` and
the Cluster Version Operator on port `9099`.

|`10250`-`10259`
|The default ports that Kubernetes reserves

.5+|UDP

|`6081`
|Geneve

|`9000`-`9999`
|Host level services, including the node exporter on ports `9100`-`9101`.

|`500`
|IPsec IKE packets

|`4500`
|IPsec NAT-T packets

|`123`
|Network Time Protocol (NTP) on UDP port `123`. If you configure an external NTP time server, you must open UDP port `123`.

|TCP/UDP
|`30000`-`32767`
|Kubernetes node port

|ESP
|N/A
|IPsec Encapsulating Security Payload (ESP)

|===

.Ports used for control plane machine to control plane machine communications
[cols="2a,2a,5a",options="header"]
|===

|Protocol
|Port
|Description

|TCP
|`2379`-`2380`
|etcd server and peer ports

|===

ifeval::["{context}" == "installing-azure-government-region"]
:!azure:
endif::[]
ifeval::["{context}" == "installing-azure-private"]
:!azure-private:
endif::[]
ifeval::["{context}" == "installing-azure-vnet"]
:!azure:
endif::[]
ifeval::["{context}" == "installing-restricted-networks-azure-installer-provisioned"]
:!azure:
:!restricted:
endif::[]