Installing Calico/VXLAN on AKS BYOCNI with Windows nodepools.

  1. Deploy an AKS cluster with BYOCNI mode.
  2. Configure Calico using VXLAN.
  3. Add a Windows 2019 or 2022 nodepool.
  4. Configure strict affinity for the ip pools.
  5. Follow the instructions on Installing Calico for Windows using HostProcess Containers with the following modifications:
    1. In calico-windows.yaml, make the following changes:
      1. Set K8S_SERVICE_CIDR and K8S_NAME_SERVERS appropriately for your environment.
      2. Set CNI_BIN_DIR to "C:\k\azurecni\bin"
      3. Set CNI_CONF_DIR to "C:\k\azurecni\netconf"
      4. Add an initContainer to the calico-node-windows DaemonSet to delete the Azure CNI configuration that's present by default:
        - name: delete-azure-cni
          image: calico/windows:v3.24.5
          command:
          - powershell.exe
          - -Command
          - "Get-Item -ErrorAction SilentlyContinue C:\\k\\azurecni\\netconf\\10-azure.conf | Remove-Item; exit 0"
          imagePullPolicy: Always
    2. The default installation of kube-proxy will not start without Azure CNI, so you have to bring your own kube-proxy per step 7 on the Calico install instructions, referencing windows-kube-proxy.yaml for the following modifications:
      1. In the ConfigMap, remove the lines that modify kubeConfig and set $kubeConfigPath = "C:\k\config"
      2. Set K8S_VERSION appropriately in the environment variables
      3. Add a tolarations block:
        tolerations:        
        - operator: Exists  
          effect: NoSchedule
      4. Duplicate the Daemonset, using the following configurations:
        1. Windows Server 2019
          • image: mcr.microsoft.com/windows/nanoserver:ltsc2019
          • nodeSelector: kubernetes.azure.com/os-sku: Windows2019
        2. Windows Server 2022
          • image: mcr.microsoft.com/windows/nanoserver:ltsc2022
          • nodeSelector: kubernetes.azure.com/os-sku: Windows2022

Outstanding issues

cloud-node-manager-windows is currently unable to reach IMDS from its pod - how can we build a route to 169.254.169.254?