Skip to content

Commit f9c46b9

Browse files
naman-msftnaman-msft
committed
Add scenarios/azure-aks-docs/articles/aks/windows-faq.yml
1 parent 442a51e commit f9c46b9

File tree

1 file changed

+153
-0
lines changed

1 file changed

+153
-0
lines changed

‎scenarios/azure-aks-docs/articles/aks/windows-faq.yml

+153
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
### YamlMime:FAQ
2+
metadata:
3+
title: "Windows Server on AKS FAQ"
4+
description: Frequently asked questions about Windows Server containers on Azure Kubernetes Service (AKS).
5+
keywords: frequently asked questions, faq
6+
ms.service: azure-kubernetes-service
7+
ms.topic: faq
8+
ms.date: 11/06/2023
9+
title: "Frequently asked questions about Windows Server on AKS"
10+
summary: |
11+
This article provides answers to some of the most common questions about using Windows Server containers on Azure Kubernetes Service (AKS).
12+
13+
14+
sections:
15+
- name: General questions
16+
questions:
17+
- question: |
18+
What kind of disks are supported for Windows?
19+
answer: |
20+
Azure Disks and Azure Files are the supported volume types, and are accessed as New Technology File System (NTFS) volumes in the Windows Server container.
21+
22+
- question: |
23+
Does Windows support generation 2 virtual machines (VMs)?
24+
answer: |
25+
Generation 2 VMs are supported on Windows for WS2022 only.
26+
27+
For more information, see [Support for generation 2 VMs on Azure](/azure/virtual-machines/generation-2).
28+
29+
- question: |
30+
How do I patch my Windows nodes?
31+
answer: |
32+
To get the latest patches for Windows nodes, you can either [upgrade the node pool](./manage-node-pools.md#upgrade-a-single-node-pool) or [upgrade the node image](./node-image-upgrade.md).
33+
34+
- question: |
35+
Is preserving the client source IP supported?
36+
answer: |
37+
At this time, [client source IP preservation](./concepts-network-ingress.md#ingress-controllers) isn't supported with Windows nodes.
38+
39+
- question: |
40+
Can I change the maximum number of pods per node?
41+
answer: |
42+
Yes. For more information, see [Maximum number of pods](./concepts-network-ip-address-planning.md#maximum-pods-per-node).
43+
44+
- question: |
45+
What is the default transmission control protocol (TCP) timeout in Windows OS?
46+
answer: |
47+
The default TCP timeout in Windows OS is four minutes. This value isn't configurable. When an application uses a longer timeout, the TCP connections between different containers in the same node close after four minutes.
48+
49+
- question: |
50+
Why am I seeing an error when I try to create a new Windows agent pool?
51+
answer: |
52+
If you created your cluster before February 2020 and didn't perform any upgrade operations, the cluster still uses an old Windows image. You might see an error that resembles the following example:
53+
54+
"The following list of images referenced from the deployment template isn't found: Publisher: MicrosoftWindowsServer, Offer: WindowsServer, Sku: 2019-datacenter-core-smalldisk-2004, Version: latest. Refer to [Find and use Azure Marketplace Virtual Machine images with Azure PowerShell](/azure/virtual-machines/windows/cli-ps-findimage) for instructions on finding available images."
55+
56+
To fix this issue, you need to perform the following steps:
57+
58+
1. Upgrade the [cluster control plane](./manage-node-pools.md#upgrade-a-cluster-control-plane-with-multiple-node-pools), which updates the image offer and publisher.
59+
2. Create new Windows agent pools.
60+
3. Move Windows pods from existing Windows agent pools to new Windows agent pools.
61+
4. Delete old Windows agent pools.
62+
63+
- question: |
64+
Why am I seeing an error when I try to deploy Windows pods?
65+
answer: |
66+
If you specify a value in `--max-pods` less than the number of pods you want to create, you might see the `No available addresses` error.
67+
68+
To fix this error, use the `az aks nodepool add` command with a high enough `--max-pods` value. For example:
69+
70+
```azurecli
71+
az aks nodepool add \
72+
--cluster-name $CLUSTER_NAME \
73+
--resource-group $RESOURCE_GROUP \
74+
--name $NODEPOOL_NAME \
75+
--max-pods 3
76+
```
77+
78+
For more details, see the [`--max-pods` documentation](/cli/azure/aks/nodepool#az-aks-nodepool-add).
79+
80+
- question: |
81+
Why is there an unexpected user named "sshd" on my virtual machine node?
82+
answer: |
83+
AKS adds a user named "sshd" when installing the OpenSSH service. This user isn't malicious. We recommend that customers update their alerts to ignore this unexpected user account.
84+
85+
- question: |
86+
How do I rotate the service principal for my Windows node pool?
87+
answer: |
88+
Windows node pools don't support service principal rotation. To update the service principal, create a new Windows node pool and migrate your pods from the older pool to the new one. After your pods are migrated to the new pool, delete the older node pool.
89+
90+
Instead of service principals, you can use managed identities. For more information, see [Use managed identities in AKS](./use-managed-identity.md).
91+
92+
- question: |
93+
How do I change the administrator password for Windows Server nodes on my cluster?
94+
answer: |
95+
To change the administrator password using the Azure CLI, use the `az aks update` command with the `--admin-password` parameter. For example:
96+
97+
```azurecli
98+
az aks update \
99+
--resource-group $RESOURCE_GROUP \
100+
--name $CLUSTER_NAME \
101+
--admin-password <new-password>
102+
```
103+
104+
To change the password using Azure PowerShell, use the `Set-AzAksCluster` cmdlet with the `-AdminPassword` parameter. For example:
105+
106+
```azurepowershell
107+
Set-AzAksCluster `
108+
-ResourceGroupName $RESOURCE_GROUP `
109+
-Name $CLUSTER_NAME `
110+
-AdminPassword <new-password>
111+
```
112+
113+
Keep in mind that performing a cluster update causes a restart and only updates the Windows Server node pools. For information about Windows Server password requirements, see [Windows Server password requirements](/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements#reference).
114+
115+
- question: |
116+
How many node pools can I create?
117+
answer: |
118+
AKS clusters with Windows node pools have the same resource limits as the default limits specified for the AKS service. For more information, see [Quotas, virtual machine size restrictions, and region availability in Azure Kubernetes Service (AKS)](./quotas-skus-regions.md).
119+
120+
- question: |
121+
Can I run ingress controllers on Windows nodes?
122+
answer: |
123+
Yes, you can run ingress controllers that support Windows Server containers.
124+
125+
- question: |
126+
Can my Windows Server containers use gMSA?
127+
answer: |
128+
Yes. Group-managed service account (gMSA) support is generally available (GA) for Windows on AKS. For more information, see [Enable Group Managed Service Accounts (GMSA) for your Windows Server nodes on your Azure Kubernetes Service (AKS) cluster](./use-group-managed-service-accounts.md)
129+
- question: |
130+
Are there any limitations on the number of services on a cluster with Windows nodes?
131+
answer: |
132+
A cluster with Windows nodes can have approximately 500 services (sometimes less) before it encounters port exhaustion. This limitation applies to a Kubernetes Service with External Traffic Policy set to "Cluster".
133+
134+
When the external traffic policy on a Service is configured as a Cluster, the traffic undergoes an extra Source NAT on the node. This process also results in reservation of a port from the TCPIP dynamic port pool. This port pool is a limited resource (~16K ports by default) and many active connections to a Service can lead to dynamic port pool exhaustion resulting in connection drops.
135+
136+
If the Kubernetes Service is configured with External Traffic Policy set to "Local", port exhaustion problems aren't likely to occur at 500 services.
137+
138+
- question: |
139+
How do I change the time zone of a running container?
140+
answer: |
141+
To change the time zone of a running Windows Server container, connect to the running container with a PowerShell session. For example:
142+
143+
```azurecli
144+
kubectl exec -it CONTAINER-NAME -- powershell
145+
```
146+
147+
In the running container, use [Set-TimeZone](/powershell/module/microsoft.powershell.management/set-timezone) to set the time zone of the running container. For example:
148+
149+
```azurepowershell
150+
Set-TimeZone -Id "Russian Standard Time"
151+
```
152+
153+
To see the current time zone of the running container or an available list of time zones, use [Get-TimeZone](/powershell/module/microsoft.powershell.management/get-timezone).

0 commit comments

Comments
 (0)