For security compliance and risk control purposes, industries with high security standards, such as finance, government, and enterprise sectors, usually require the "application network" that carries application workloads to be physically or logically completely isolated from the "management network" that carries infrastructure management components, with no direct routes between the two networks.
AKE supports configuring multiple network interfaces for nodes in workload clusters (VM-based workload clusters), implementing separation between the management network and the application network. When creating a cluster, users can add multiple NICs to nodes and explicitly define the role of each NIC (management NIC, application NIC, Pod dedicated NIC, or ABS CSI dedicated NIC). Users can flexibly specify the default gateway interface and configure cluster-level static route rules. Kubelet and CNI components automatically bind to the specified network interfaces. AKE automatically completes complex underlying configurations such as routing rules and CNI binding at the node operating system and Kubernetes component levels, ensuring stable cluster operation in network isolation environments. After a cluster is created, dynamically adding NICs and adjusting static route rules are also supported.
