You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/static-ip.md
+66-55Lines changed: 66 additions & 55 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,19 +19,26 @@ This article shows you how to create a static public IP address and assign it to
19
19
20
20
## Before you begin
21
21
22
-
* This article assumes that you have an existing AKS cluster. If you need an AKS cluster, see the AKS quickstart [using the Azure CLI][aks-quickstart-cli], [using Azure PowerShell][aks-quickstart-powershell], or [using the Azure portal][aks-quickstart-portal].
23
22
* You need the Azure CLI version 2.0.59 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
24
23
* This article covers using a *Standard* SKU IP with a *Standard* SKU load balancer. For more information, see [IP address types and allocation methods in Azure][ip-sku].
25
24
26
-
## Create a static IP address
25
+
## Create an AKS cluster
26
+
27
+
1. Create an Azure resource group using the [`az group create`][az-group-create] command.
28
+
29
+
```azurecli-interactive
30
+
az group create --name myNetworkResourceGroup --location eastus
31
+
```
27
32
28
-
1. Create a resource group for your IP address
33
+
2. Create an AKS cluster using the [`az aks create`][az-aks-create] command.
29
34
30
35
```azurecli-interactive
31
-
az group create --name myNetworkResourceGroup
36
+
az aks create --name myAKSCluster --resource-group myNetworkResourceGroup --generate-ssh-keys
32
37
```
33
38
34
-
2. Use the [`az network public ip create`][az-network-public-ip-create] command to create a static public IP address. The following example creates a static IP resource named *myAKSPublicIP* in the *myNetworkResourceGroup* resource group.
39
+
## Create a static IP address
40
+
41
+
1. Create a static public IP address using the [`az network public ip create`][az-network-public-ip-create] command.
35
42
36
43
```azurecli-interactive
37
44
az network public-ip create \
@@ -44,19 +51,25 @@ This article shows you how to create a static public IP address and assign it to
44
51
> [!NOTE]
45
52
> If you're using a *Basic* SKU load balancer in your AKS cluster, use *Basic* for the `--sku` parameter when defining a public IP. Only *Basic* SKU IPs work with the *Basic* SKU load balancer and only *Standard* SKU IPs work with *Standard* SKU load balancers.
46
53
47
-
3. After you create the static public IP address, use the [`az network public-ip list`][az-network-public-ip-list] command to get the IP address. Specify the name of the node resource group and public IP address you created, and query for the *ipAddress*.
54
+
2. Get the name of the node resource group using the [`az aks show`][az-aks-show] command and query for the `nodeResourceGroup` property.
55
+
56
+
```azurecli-interactive
57
+
az aks show --name myAKSCluster --resource-group myNetworkResourceGroup --query nodeResourceGroup -o tsv
58
+
```
59
+
60
+
3. Get the static public IP address using the [`az network public-ip list`][az-network-public-ip-list] command. Specify the name of the node resource group and public IP address you created, and query for the `ipAddress`.
48
61
49
62
```azurecli-interactive
50
-
az network public-ip show --resource-group myNetworkResourceGroup --name myAKSPublicIP --query ipAddress --output tsv
63
+
az network public-ip show --resource-group <node resource group> --name myAKSPublicIP --query ipAddress --output tsv
51
64
```
52
65
53
66
## Create a service using the static IP address
54
67
55
-
1. Before creating a service, use the [`az role assignment create`][az-role-assignment-create] command to ensure the cluster identity used by the AKS cluster has delegated permissions to the node resource group.
68
+
1. Ensure the cluster identity used by the AKS cluster has delegated permissions to the node resource group using the [`az role assignment create`][az-role-assignment-create] command.
56
69
57
70
```azurecli-interactive
58
-
CLIENT_ID=$(az aks show --name <cluster name> --resource-group <cluster resource group> --query identity.principalId -o tsv)
59
-
RG_SCOPE=$(az group show --name myNetworkResourceGroup --query id -o tsv)
71
+
CLIENT_ID=$(az aks show --name myAKSCluster --resource-group myNetworkResourceGroup --query identity.principalId -o tsv)
72
+
RG_SCOPE=$(az group show --name <node resource group> --query id -o tsv)
60
73
az role assignment create \
61
74
--assignee ${CLIENT_ID} \
62
75
--role "Network Contributor" \
@@ -69,79 +82,78 @@ This article shows you how to create a static public IP address and assign it to
69
82
2. Create a file named `load-balancer-service.yaml` and copy in the contents of the following YAML file, providing your own public IP address created in the previous step and the node resource group name.
70
83
71
84
> [!IMPORTANT]
72
-
> Adding the `loadBalancerIP` property to the load balancer YAML manifest is deprecating following [upstream Kubernetes](https://github.com/kubernetes/kubernetes/pull/107235). While current usage remains the same and existing services are expected to work without modification, we **highly recommend setting service annotations** instead. To set service annotations, you can use `service.beta.kubernetes.io/azure-load-balancer-ipv4` for an IPv4 address and `service.beta.kubernetes.io/azure-load-balancer-ipv6` for an IPv6 address.
85
+
> Adding the `loadBalancerIP` property to the load balancer YAML manifest is deprecating following [upstream Kubernetes](https://github.com/kubernetes/kubernetes/pull/107235). While current usage remains the same and existing services are expected to work without modification, we **highly recommend setting service annotations** instead. To set service annotations, you can use `service.beta.kubernetes.io/azure-load-balancer-ipv4` for an IPv4 address and `service.beta.kubernetes.io/azure-load-balancer-ipv6` for an IPv6 address, as shown in the example YAML.
service.beta.kubernetes.io/azure-load-balancer-ipv4: <public IP address>
80
94
name: azure-load-balancer
81
95
spec:
82
-
loadBalancerIP: 40.121.183.52
83
96
type: LoadBalancer
84
97
ports:
85
98
- port: 80
86
99
selector:
87
100
app: azure-load-balancer
88
101
```
89
102
90
-
3. Use the `kubectl apply` command to create the serviceand deployment.
103
+
3. Set a public-facing DNS label to the service using the `service.beta.kubernetes.io/azure-dns-label-name` service annotation. This publishes a fully qualified domain name (FQDN) for your service using Azure's public DNS servers and top-level domain. The annotation value must be unique within the Azure location, so we recommend you use a sufficiently qualified label. Azure automatically appends a default suffix in the location you selected, such as `<location>.cloudapp.azure.com`, to the name you provide, creating the FQDN.
91
104
92
-
```console
93
-
kubectl apply -f load-balancer-service.yaml
105
+
> [!NOTE]
106
+
> If you want to publish the service on your own domain, see [Azure DNS][azure-dns-zone] and the [external-dns][external-dns] project.
If your service uses a dynamic or static public IP address, you can use the `service.beta.kubernetes.io/azure-dns-label-name` service annotation to set a public-facing DNS label. This publishes a fully qualified domain name (FQDN) for your service using Azure's public DNS servers and top-level domain. The annotation value must be unique within the Azure location, so it's recommended to use a sufficiently qualified label. Azure automatically appends a default suffix in the location you selected, such as `<location>.cloudapp.azure.com`, to the name you provide, creating the FQDN.
If the static IP address defined in the *loadBalancerIP* property of the Kubernetes service manifest doesn't exist or hasn't been created in the node resource group and there are no additional delegations configured, the load balancer service creation fails. To troubleshoot, review the service creation events using the [`kubectl describe`][kubectl-describe] command. Provide the name of the service specified in the YAML manifest, as shown in the following example:
148
+
If the static IP address defined in the `loadBalancerIP` property of the Kubernetes service manifest doesn't exist or hasn't been created in the node resource group and there are no other delegations configured, the load balancer service creation fails. To troubleshoot, review the service creation events using the [`kubectl describe`][kubectl-describe] command. Provide the name of the service specified in the YAML manifest, as shown in the following example:
137
149
138
150
```console
139
151
kubectl describe service azure-load-balancer
140
152
```
141
153
142
-
The output will show you information about the Kubernetes service resource. The following example output shows a `Warning` in the `Events`: "`user supplied IP address was not found`." In this scenario, make sure you've created the static public IP address in the node resource group and that the IP address specified in the Kubernetes service manifest is correct.
154
+
The output shows you information about the Kubernetes service resource. The following example output shows a `Warning` in the `Events`: "`user supplied IP address was not found`." In this scenario, make sure you created the static public IP address in the node resource group and that the IP address specified in the Kubernetes service manifest is correct.
143
155
144
-
```console
156
+
```output
145
157
Name: azure-load-balancer
146
158
Namespace: default
147
159
Labels: <none>
@@ -165,7 +177,7 @@ Events:
165
177
166
178
## Next steps
167
179
168
-
For additional control over the network traffic to your applications, you may want to [create an ingress controller][aks-ingress-basic]. You can also [create an ingress controller with a static public IP address][aks-static-ingress].
180
+
For more control over the network traffic to your applications, you may want to [create an ingress controller][aks-ingress-basic]. You can also [create an ingress controller with a static public IP address][aks-static-ingress].
0 commit comments