Expand limitations when using Calico and Cilium

[1kmilo]

Please help to expand the limitation of Calico and Cilium in comparison with the third party options.

https://docs.cilium.io/en/latest/security/policy/ https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy

This can help to know what to expect from the versions that are available in AKS and decide if going with BYO CNI plugin.

For instance, after doing tests, it looks like AKS Calico/Cilium does not support policies that use FQDN:

apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: "fqdn" spec: endpointSelector: matchLabels: org: empire class: mediabot egress:

• toFQDNs:
  • matchName: "api.github.com"
• toEndpoints:
  • matchLabels: "k8s:io.kubernetes.pod.namespace": kube-system "k8s:k8s-app": kube-dns toPorts:
  • ports:
    • port: "53" protocol: ANY rules: dns:
    • matchPattern: "*"

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 13ac2648-7dce-c83c-0b14-79d5b091b1af
• Version Independent ID: 6aa0b306-6926-87cc-9b59-496ac91dfba6
• Content: Secure pod traffic with network policies - Azure Kubernetes Service
• Content Source: articles/aks/use-network-policies.md
• Service: azure-kubernetes-service
• GitHub Login: @schaffererin
• Microsoft Alias: schaffererin

[PesalaPavan]

@1kmilo Thanks for your feedback! We will investigate and update as appropriate.

[ManoharLakkoju-MSFT]

@schaffererin Can you please check and add your comments on this doc update request as applicable.

[ManoharLakkoju-MSFT]

@1kmilo I'm going to assign this to the document author so they can take a look at it accordingly

[rayoef]

Thank you for your dedication to our documentation. Unfortunately, at this time we have been unable to review your issue in a timely manner, and we sincerely apologize for the delayed response. The requested updates have not been made since the creation of this issue, and the timeline for resolution may vary based on resourcing, so we've created an internal work item to incorporate your suggestions. We are closing this issue for now, but feel free to comment here as necessary.

please-close