You have an Azure subscription. You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-premises clients connect to App1 by using the IP address of the pod. For the AKS cluster, you need to choose a network type that will support App1. What should you choose?

The requirement is for on-premises clients to connect to an application by using the pod's IP address directly. This is only possible if the pods have IP addresses that are routable from the on-premises network. The Azure Container Networking Interface (CNI) network plugin achieves this by assigning each pod an IP address directly from the Azure virtual network's subnet. These VNet-routable IPs make the pods first-class citizens on the network, allowing them to be directly accessed from connected on-premises environments via ExpressRoute or a VPN Gateway. The kubenet model, in contrast, uses a separate, non-routable address space for pods and relies on Network Address Translation (NAT), which prevents direct connectivity to pod IPs from outside the cluster.

A. kubenet: Pods are assigned IP addresses from a logically separate address space that is not routable on the Azure VNet, preventing direct access from on-premises.
C. Hybrid Connection endpoints: This is a feature of Azure App Service and Azure Functions used to connect to on-premises resources, not a networking model for an AKS cluster.
D. Azure Private Link: This provides private endpoint connectivity to a specific service, but it is not the fundamental network model for the cluster that assigns routable IPs to individual pods.

1. Microsoft Documentation | Concepts - Networking in Azure Kubernetes Services (AKS), section "Compare network models". The documentation states for Azure CNI: "Every pod gets an IP address from the subnet and can be accessed directly." For kubenet, it notes: "Pods receive an IP address from a logically different address space... Network Address Translation (NAT) is then configured..." This directly confirms that only Azure CNI supports direct pod IP access.

2. Microsoft Documentation | Configure Azure CNI networking in Azure Kubernetes Service (AKS), section "Overview". This document explicitly states, "With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space..." This reinforces that Azure CNI is designed for scenarios requiring direct pod reachability.

3. Microsoft Documentation | Azure App Service Hybrid Connections, section "How it works". This source clarifies that Hybrid Connections are a feature of Azure App Service, not a networking option for AKS clusters.

4. Microsoft Documentation | What is Azure Private Link?, section "Key benefits". This document describes Private Link as a technology for creating private endpoints to PaaS services, which is distinct from the underlying CNI plugin that governs pod IP allocation within the cluster itself.