Skip to content

Commit 3ba601c

Browse files
v-regandownerv-regandowner
authored
Merge pull request #221212 from schaffererin/freshness-pass-internal-load-balancer
AKS freshness pass: Create and use an internal load balancer
2 parents 46995d2 + 473e893 commit 3ba601c

File tree

1 file changed

+60
-36
lines changed

1 file changed

+60
-36
lines changed

‎articles/aks/internal-lb.md

Lines changed: 60 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -4,26 +4,27 @@ titleSuffix: Azure Kubernetes Service
44
description: Learn how to create and use an internal load balancer to expose your services with Azure Kubernetes Service (AKS).
55
services: container-service
66
ms.topic: article
7-
ms.date: 03/04/2019
7+
ms.date: 12/12/2022
88

99

1010
#Customer intent: As a cluster operator or developer, I want to learn how to create a service in AKS that uses an internal Azure load balancer for enhanced security and without an external endpoint.
1111
---
1212

1313
# Use an internal load balancer with Azure Kubernetes Service (AKS)
1414

15-
To restrict access to your applications in Azure Kubernetes Service (AKS), you can create and use an internal load balancer. An internal load balancer makes a Kubernetes service accessible only to applications running in the same virtual network as the Kubernetes cluster. This article shows you how to create and use an internal load balancer with Azure Kubernetes Service (AKS).
15+
You can create and use an internal load balancer to restrict access to your applications in Azure Kubernetes Service (AKS).
16+
An internal load balancer makes a Kubernetes service accessible only to applications running in the same virtual network as the Kubernetes cluster. This article shows you how to create and use an internal load balancer with AKS.
1617

1718
> [!NOTE]
18-
> Azure Load Balancer is available in two SKUs - *Basic* and *Standard*. By default, the Standard SKU is used when you create an AKS cluster. When creating a Service with type as LoadBalancer, you will get the same LB type as when you provision the cluster. For more information, see [Azure load balancer SKU comparison][azure-lb-comparison].
19+
> Azure Load Balancer is available in two SKUs: *Basic* and *Standard*. The *Standard* SKU is used by default when you create an AKS cluster. When you create a *LoadBalancer* service type, you'll get the same load balancer type as when you provisioned the cluster. For more information, see [Azure Load Balancer SKU comparison][azure-lb-comparison].
1920
2021
## Before you begin
2122

22-
This article assumes that you have an existing AKS cluster. If you need an AKS cluster, see the AKS quickstart [using the Azure CLI][aks-quickstart-cli], [using Azure PowerShell][aks-quickstart-powershell], or [using the Azure portal][aks-quickstart-portal].
23+
This article assumes that you have an existing AKS cluster. If you need an AKS cluster, you can create one [using Azure CLI][aks-quickstart-cli], [Azure PowerShell][aks-quickstart-powershell], or [the Azure portal][aks-quickstart-portal].
2324

24-
You also need the Azure CLI version 2.0.59 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
25+
You also need the Azure CLI version 2.0.59 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
2526

26-
The AKS cluster identity needs permission to manage network resources if you use an existing subnet or resource group. For information, see [Use kubenet networking with your own IP address ranges in Azure Kubernetes Service (AKS)][use-kubenet] or [Configure Azure CNI networking in Azure Kubernetes Service (AKS)][advanced-networking]. If you are configuring your load balancer to use an [IP address in a different subnet][different-subnet], ensure the AKS cluster identity also has read access to that subnet.
27+
If you want to use an existing subnet or resource group, the AKS cluster identity needs permission to manage network resources. For information, see [Use kubenet networking with your own IP address ranges in AKS][use-kubenet] or [Configure Azure CNI networking in AKS][advanced-networking]. If you're configuring your load balancer to use an [IP address in a different subnet][different-subnet], ensure the AKS cluster identity also has read access to that subnet.
2728

2829
For more information on permissions, see [Delegate AKS access to other Azure resources][aks-sp].
2930

@@ -46,26 +47,30 @@ spec:
4647
app: internal-app
4748
```
4849
49-
Deploy the internal load balancer using the [kubectl apply][kubectl-apply] and specify the name of your YAML manifest:
50+
Deploy the internal load balancer using [`kubectl apply`][kubectl-apply] and specify the name of your YAML manifest.
5051

5152
```console
5253
kubectl apply -f internal-lb.yaml
5354
```
5455

55-
An Azure load balancer is created in the node resource group and connected to the same virtual network as the AKS cluster.
56+
This command creates an Azure load balancer in the node resource group that's connected to the same virtual network as your AKS cluster.
5657

57-
When you view the service details, the IP address of the internal load balancer is shown in the *EXTERNAL-IP* column. In this context, *External* is in relation to the external interface of the load balancer, not that it receives a public, external IP address. It may take a minute or two for the IP address to change from *\<pending\>* to an actual internal IP address, as shown in the following example:
58+
When you view the service details, the IP address of the internal load balancer is shown in the *EXTERNAL-IP* column. In this context, *External* refers to the external interface of the load balancer. It doesn't mean that it receives a public, external IP address.
59+
60+
It may take a minute or two for the IP address to change from *\<pending\>* to an actual internal IP address, as shown in the following example:
5861

5962
```
60-
$ kubectl get service internal-app
63+
kubectl get service internal-app
6164
6265
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
6366
internal-app LoadBalancer 10.0.248.59 10.240.0.7 80:30555/TCP 2m
6467
```
6568

6669
## Specify an IP address
6770

68-
If you would like to use a specific IP address with the internal load balancer, add the *loadBalancerIP* property to the load balancer YAML manifest. In this scenario, the specified IP address must reside in the same subnet as the AKS cluster but can't already be assigned to a resource. For example, an IP address in the range designated for the Kubernetes subnet within the AKS cluster shouldn't be used.
71+
If you want to use a specific IP address with the internal load balancer, add the *loadBalancerIP* property to the load balancer YAML manifest. In this scenario, the specified IP address must reside in the same subnet as the AKS cluster, but it can't already be assigned to a resource. For example, you shouldn't use an IP address in the range designated for the Kubernetes subnet within the AKS cluster.
72+
73+
For more information on subnets, see [Add a node pool with a unique subnet][unique-subnet].
6974

7075
```yaml
7176
apiVersion: v1
@@ -83,10 +88,10 @@ spec:
8388
app: internal-app
8489
```
8590

86-
When deployed and you view the service details, the IP address in the *EXTERNAL-IP* column reflects your specified IP address:
91+
When you view the service details, the IP address in the *EXTERNAL-IP* column should reflect your specified IP address.
8792

8893
```
89-
$ kubectl get service internal-app
94+
kubectl get service internal-app
9095

9196
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
9297
internal-app LoadBalancer 10.0.184.168 10.240.0.25 80:30225/TCP 4m
@@ -98,14 +103,15 @@ For more information on configuring your load balancer in a different subnet, se
98103
99104
### Before you begin
100105
101-
You must have the following resource installed:
106+
You must have the following resources:
102107
103-
* The Azure CLI
104-
* Kubernetes version 1.22.x or above
108+
* Azure CLI version 2.0.59 or later.
109+
* Kubernetes version 1.22.x or later.
110+
* An existing resource group with a VNet and subnet. This resource group is where you'll [create the private endpoint](#create-a-private-endpoint-to-the-private-link-service). If you don't have these resources, see [Create a virtual network and subnet][aks-vnet-subnet].
105111
106112
### Create a Private Link service connection
107113
108-
To attach an Azure Private Link service to an internal load balancer, create a service manifest named `internal-lb-pls.yaml` with the service type *LoadBalancer* and the *azure-load-balancer-internal* and *azure-pls-create* annotation as shown in the example below. For more options, refer to the [Azure Private Link Service Integration](https://kubernetes-sigs.github.io/cloud-provider-azure/topics/pls-integration/) design document
114+
To attach an Azure Private Link service to an internal load balancer, create a service manifest named `internal-lb-pls.yaml` with the service type *LoadBalancer* and the *azure-load-balancer-internal* and *azure-pls-create* annotation as shown in the following example. For more options, refer to the [Azure Private Link Service Integration](https://kubernetes-sigs.github.io/cloud-provider-azure/topics/pls-integration/) design document.
109115
110116
```yaml
111117
apiVersion: v1
@@ -123,27 +129,35 @@ spec:
123129
app: internal-app
124130
```
125131

126-
Deploy the internal load balancer using the [kubectl apply][kubectl-apply] and specify the name of your YAML manifest:
132+
Deploy the internal load balancer using [`kubectl apply`][kubectl-apply] and specify the name of your YAML manifest.
127133

128134
```console
129135
kubectl apply -f internal-lb-pls.yaml
130136
```
131137

132-
An Azure load balancer is created in the node resource group and connected to the same virtual network as the AKS cluster.
138+
This command creates an Azure load balancer in the node resource group that's connected to the same virtual network as your AKS cluster.
133139

134-
When you view the service details, the IP address of the internal load balancer is shown in the *EXTERNAL-IP* column. In this context, *External* is in relation to the external interface of the load balancer, not that it receives a public, external IP address. It may take a minute or two for the IP address to change from *\<pending\>* to an actual internal IP address, as shown in the following example:
140+
When you view the service details, the IP address of the internal load balancer is shown in the *EXTERNAL-IP* column. In this context, *External* refers to the external interface of the load balancer. It doesn't mean that it receives a public, external IP address.
141+
142+
It may take a minute or two for the IP address to change from *\<pending\>* to an actual internal IP address, as shown in the following example:
135143

136144
```
137-
$ kubectl get service internal-app
145+
kubectl get service internal-app
138146
139147
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
140148
internal-app LoadBalancer 10.125.17.53 10.125.0.66 80:30430/TCP 64m
141149
```
142150

143-
Additionally, a Private Link Service object will also be created that connects to the Frontend IP configuration of the Load Balancer associated with the Kubernetes service. Details of the Private Link Service object can be retrieved as shown in the following example:
144-
```
145-
$ AKS_MC_RG=$(az aks show -g myResourceGroup --name myAKSCluster --query nodeResourceGroup -o tsv)
146-
$ az network private-link-service list -g ${AKS_MC_RG} --query "[].{Name:name,Alias:alias}" -o table
151+
A Private Link Service object is also created. This Private Link Service object connects to the frontend IP configuration of the load balancer associated with the Kubernetes service. You can get the details of the Private Link Service object with the following sample command:
152+
153+
```azurecli-interactive
154+
# Create a variable for the resource group
155+
156+
AKS_MC_RG=$(az aks show -g myResourceGroup --name myAKSCluster --query nodeResourceGroup -o tsv)
157+
158+
# List the private link service
159+
160+
az network private-link-service list -g $AKS_MC_RG --query "[].{Name:name,Alias:alias}" -o table
147161
148162
Name Alias
149163
-------- -------------------------------------------------------------------------
@@ -153,24 +167,31 @@ pls-xyz pls-xyz.abc123-defg-4hij-56kl-789mnop.eastus2.azure.privatelinkservice
153167

154168
### Create a Private Endpoint to the Private Link service
155169

156-
A Private Endpoint allows you to privately connect to your Kubernetes service object via the Private Link Service created above. To do so, follow the example shown below:
170+
A Private Endpoint allows you to privately connect to your Kubernetes service object via the Private Link Service you created. To do so, follow the sample commands.
171+
172+
```azurecli-interactive
173+
# Create a variable for the private link service
174+
175+
AKS_PLS_ID=$(az network private-link-service list -g $AKS_MC_RG --query "[].id" -o tsv)
176+
177+
# Create the private endpoint
157178
158-
```azurecli
159-
$ AKS_PLS_ID=$(az network private-link-service list -g ${AKS_MC_RG} --query "[].id" -o tsv)
160179
$ az network private-endpoint create \
161180
-g myOtherResourceGroup \
162181
--name myAKSServicePE \
163182
--vnet-name myOtherVNET \
164183
--subnet pe-subnet \
165-
--private-connection-resource-id ${AKS_PLS_ID} \
184+
--private-connection-resource-id $AKS_PLS_ID \
166185
--connection-name connectToMyK8sService
167186
```
168187

169188
## Use private networks
170189

171-
When you create your AKS cluster, you can specify advanced networking settings. This approach lets you deploy the cluster into an existing Azure virtual network and subnets. One scenario is to deploy your AKS cluster into a private network connected to your on-premises environment and run services only accessible internally. For more information, see configure your own virtual network subnets with [Kubenet][use-kubenet] or [Azure CNI][advanced-networking].
190+
When you create your AKS cluster, you can specify advanced networking settings. These settings allow you to deploy the cluster into an existing Azure virtual network and subnets. For example, you can deploy your AKS cluster into a private network connected to your on-premises environment and run services that are only accessible internally.
191+
192+
For more information, see [configure your own virtual network subnets with Kubenet][use-kubenet] or [with Azure CNI][advanced-networking].
172193

173-
No changes to the previous steps are needed to deploy an internal load balancer in an AKS cluster that uses a private network. The load balancer is created in the same resource group as your AKS cluster but connected to your private virtual network and subnet, as shown in the following example:
194+
You don't need to make any changes to the previous steps to deploy an internal load balancer that uses a private network in an AKS cluster. The load balancer is created in the same resource group as your AKS cluster, but it's instead connected to your private virtual network and subnet, as shown in the following example:
174195

175196
```
176197
$ kubectl get service internal-app
@@ -180,11 +201,12 @@ internal-app LoadBalancer 10.1.15.188 10.0.0.35 80:31669/TCP 1m
180201
```
181202

182203
> [!NOTE]
183-
> You may need to grant the cluster identity for your AKS cluster the *Network Contributor* role to the resource group where your Azure virtual network resources are deployed. View the cluster identity with [az aks show][az-aks-show], such as `az aks show --resource-group myResourceGroup --name myAKSCluster --query "identity"`. To create a role assignment, use the [az role assignment create][az-role-assignment-create] command.
204+
>
205+
> You may need to give the *Network Contributor* role to the resource group in which your Azure virtual network resources are deployed. You can view the cluster identity with [az aks show][az-aks-show], such as `az aks show --resource-group myResourceGroup --name myAKSCluster --query "identity"`. To create a role assignment, use the [az role assignment create][az-role-assignment-create] command.
184206
185207
## Specify a different subnet
186208

187-
To specify a subnet for your load balancer, add the *azure-load-balancer-internal-subnet* annotation to your service. The subnet specified must be in the same virtual network as your AKS cluster. When deployed, the load balancer *EXTERNAL-IP* address is part of the specified subnet.
209+
Add the *azure-load-balancer-internal-subnet* annotation to your service to specify a subnet for your load balancer. The subnet specified must be in the same virtual network as your AKS cluster. When deployed, the load balancer *EXTERNAL-IP* address is part of the specified subnet.
188210

189211
```yaml
190212
apiVersion: v1
@@ -204,13 +226,13 @@ spec:
204226
205227
## Delete the load balancer
206228
207-
When all services that use the internal load balancer are deleted, the load balancer itself is also deleted.
229+
The load balancer will be deleted when all of its services are deleted.
208230
209-
You can also directly delete a service as with any Kubernetes resource, such as `kubectl delete service internal-app`, which also then deletes the underlying Azure load balancer.
231+
As with any Kubernetes resource, you can directly delete a service, such as `kubectl delete service internal-app`, which also deletes the underlying Azure load balancer.
210232

211233
## Next steps
212234

213-
Learn more about Kubernetes services at the [Kubernetes services documentation][kubernetes-services].
235+
Learn more about Kubernetes services in the [Kubernetes services documentation][kubernetes-services].
214236

215237
<!-- LINKS - External -->
216238
[kubectl-apply]: https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#apply
@@ -228,3 +250,5 @@ Learn more about Kubernetes services at the [Kubernetes services documentation][
228250
[install-azure-cli]: /cli/azure/install-azure-cli
229251
[aks-sp]: kubernetes-service-principal.md#delegate-access-to-other-azure-resources
230252
[different-subnet]: #specify-a-different-subnet
253+
[aks-vnet-subnet]: /aks/configure-kubenet.md#create-a-virtual-network-and-subnet
254+
[unique-subnet]: /aks/use-multiple-node-pools.md#add-a-node-pool-with-a-unique-subnet

0 commit comments

Comments
 (0)