Docs: add note about AKS kube-apiserver entity

[darox]

Adds a note to the docs that kube-apiserver
entity is not available in AKS.

[networkop]

lgmt

[qmonnet]

Looks good, thanks!

Is there an easy way to check whether the entity is available for a specific distribution?

[darox]

Looks good, thanks!

Is there an easy way to check whether the entity is available for a specific distribution?

No that I'm aware of. I will do some tests on EKS and GKE next week.

[gandro]

Could you clarify what you mean by "unavailable"? As far as I understand it, kube-apiserver works fine for egress traffic, even on AKS. But it won't work for ingress traffic (because of NAT) (ref #31711 (comment))

[darox]

Could you clarify what you mean by "unavailable"? As far as I understand it, kube-apiserver works fine for egress traffic, even on AKS. But it won't work for ingress traffic (because of NAT) (ref #31711 (comment))

You're absolutely right; the note should mention that only ingress statements with fromEntities: kube-apiserver are affected.

[darox]

Could you clarify what you mean by "unavailable"? As far as I understand it, kube-apiserver works fine for egress traffic, even on AKS. But it won't work for ingress traffic (because of NAT) (ref #31711 (comment))

I tested against AKS, EKS and GKE and the behaviour is the same. kube-apiserver doesn't work for ingress traffic on GKE and AKS, but for egress traffic. For EKS I don't see any issues at all.

[gandro]

/test