Skip to content

Document AKS internal CIDR ranges to avoid on Mendix on Azure #11783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
katarzyna-koltun-mx merged 2 commits into from
Aug 20, 2026
+12 −1
Merged

Document AKS internal CIDR ranges to avoid on Mendix on Azure #11783

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5a839f8
Document AKS internal CIDR ranges to avoid for VNet peering (MXFORAZU…
MXClyde Aug 20, 2026
523d204
Update _index.md
katarzyna-koltun-mx Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion content/en/docs/deployment/mx-azure/configuration/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,20 @@ The [Mendix on Azure Portal](https://mendixonazure.mendix.com) provides a variet
| Advanced Option | Description | Editable after initial creation |
| --- | --- | --- |
| Load Balancer Type | Controls whether your applications are reachable publicly or only privately via your own (Virtual) Network or Private Endpoints. | Yes |
| AKS Node CIDR IP Range | Defines the IP address range on the VNet hosting AKS cluster nodes. This can only be set during initial deployment and should align with your organization's IP plan if you plan to connect Mendix on Azure to other networks via peering. Default is acceptable when no interconnection is required. | No |
| AKS Node CIDR IP Range | Defines the IP address range on the VNet hosting AKS cluster nodes. This can only be set during initial deployment and should align with your organization's IP plan if you plan to connect Mendix on Azure to other networks via peering. Default is acceptable when no interconnection is required. Do not use a range that overlaps 10.0.0.0/16 or 10.244.0.0/16: these are reserved for internal AKS traffic on every Mendix on Azure cluster and are not configurable. If overlap cannot be avoided, use Private Endpoints. | No |
| AKS Network Isolated Cluster | When set to true will lead to a cluster without egress configuration, please carefully read the [documentation on cluster networking modes](/developerportal/deploy/mendix-on-azure/configuration/ingress-egress/) to understand the implications | No |

{{% alert color="warning" %}}
Every Mendix on Azure cluster uses the AKS default internal address ranges `10.0.0.0/16` (Kubernetes service CIDR) and `10.244.0.0/16` (pod CIDR). These ranges are not part of the VNet that Mendix creates, and they are not configurable.

Because of this:

* Do not set an *AKS Node CIDR IP Range* that overlaps with `10.0.0.0/16` or `10.244.0.0/16`. Azure rejects cluster creation when the service CIDR overlaps a subnet to which the cluster can route.
* Do not route networks that overlap with `10.0.0.0/16` or `10.244.0.0/16` to the cluster through VNet peering, a VPN, or ExpressRoute. Traffic to addresses in those ranges is resolved inside the cluster and does not reach the remote network.

If your IP plan uses `10.0.0.0/8`, choose a node CIDR range outside these two ranges and confirm that the on-premises and peered ranges you want to reach from Mendix on Azure do not overlap them either. If overlap cannot be avoided, use Private Endpoints to reach the services in the overlapping network, as Private Endpoints do not require peering or routing between the overlapping ranges.
{{% /alert %}}

For more information, see [Configuring Ingress and Egress](/developerportal/deploy/mendix-on-azure/configuration/ingress-egress/).

### Application Cluster Settings
Expand Down