You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Use a static IP with a load balancer in Azure Kubernetes Service (AKS)
3
3
titleSuffix: Azure Kubernetes Service
4
4
description: Learn how to create and use a static IP address with the Azure Kubernetes Service (AKS) load balancer.
5
5
author: asudbring
6
6
ms.author: allensu
7
7
ms.service: azure-kubernetes-service
8
8
ms.subservice: aks-networking
9
9
ms.topic: how-to
10
-
ms.date: 11/14/2020
11
-
10
+
ms.date: 02/24/2023
12
11
13
12
#Customer intent: As a cluster operator or developer, I want to create and manage static IP address resources in Azure that I can use beyond the lifecycle of an individual Kubernetes service deployed in an AKS cluster.
14
13
---
15
14
16
15
# Use a static public IP address and DNS label with the Azure Kubernetes Service (AKS) load balancer
17
16
18
-
By default, the public IP address assigned to a load balancer resource created by an AKS cluster is only valid for the lifespan of that resource. If you delete the Kubernetes service, the associated load balancer and IP address are also deleted. If you want to assign a specific IP address or retain an IP address for redeployed Kubernetes services, you can create and use a static public IP address.
17
+
When you create a load balancer resource in an Azure Kubernetes Service (AKS) cluster, the public IP address assigned to it is only valid for the lifespan of that resource. If you delete the Kubernetes service, the associated load balancer and IP address are also deleted. If you want to assign a specific IP address or retain an IP address for redeployed Kubernetes services, you can create and use a static public IP address.
19
18
20
19
This article shows you how to create a static public IP address and assign it to your Kubernetes service.
21
20
22
21
## Before you begin
23
22
24
-
This article assumes that you have an existing AKS cluster. If you need an AKS cluster, see the AKS quickstart [using the Azure CLI][aks-quickstart-cli], [using Azure PowerShell][aks-quickstart-powershell], or [using the Azure portal][aks-quickstart-portal].
25
-
26
-
You also need the Azure CLI version 2.0.59 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
27
-
28
-
This article covers using a *Standard* SKU IP with a *Standard* SKU load balancer. For more information, see [IP address types and allocation methods in Azure][ip-sku].
23
+
* This article assumes that you have an existing AKS cluster. If you need an AKS cluster, see the AKS quickstart [using the Azure CLI][aks-quickstart-cli], [using Azure PowerShell][aks-quickstart-powershell], or [using the Azure portal][aks-quickstart-portal].
24
+
* You need the Azure CLI version 2.0.59 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
25
+
* This article covers using a *Standard* SKU IP with a *Standard* SKU load balancer. For more information, see [IP address types and allocation methods in Azure][ip-sku].
29
26
30
27
## Create a static IP address
31
28
32
-
Create a static public IP address with the [az network public ip create][az-network-public-ip-create] command. The following creates a static IP resource named *myAKSPublicIP* in the *myResourceGroup* resource group:
33
-
34
-
```azurecli-interactive
35
-
az network public-ip create \
36
-
--resource-group myResourceGroup \
37
-
--name myAKSPublicIP \
38
-
--sku Standard \
39
-
--allocation-method static
40
-
```
41
-
42
-
> [!NOTE]
43
-
> If you are using a *Basic* SKU load balancer in your AKS cluster, use *Basic* for the *sku* parameter when defining a public IP. Only *Basic* SKU IPs work with the *Basic* SKU load balancer and only *Standard* SKU IPs work with *Standard* SKU load balancers.
44
-
45
-
The IP address is displayed, as shown in the following condensed example output:
46
-
47
-
```json
48
-
{
49
-
"publicIp": {
50
-
...
51
-
"ipAddress": "40.121.183.52",
52
-
...
53
-
}
54
-
}
55
-
```
56
-
57
-
You can later get the public IP address using the [az network public-ip list][az-network-public-ip-list] command. Specify the name of the node resource group and public IP address you created, and query for the *ipAddress* as shown in the following example:
58
-
59
-
```azurecli-interactive
60
-
$ az network public-ip show --resource-group myResourceGroup --name myAKSPublicIP --query ipAddress --output tsv
29
+
1. Use the `az aks show`[az-aks-show] command to get the node resource group name of your AKS cluster, which follows this format: `MC_<resource group name>_<AKS cluster name>_<region>`.
61
30
62
-
40.121.183.52
63
-
```
31
+
```azurecli-interactive
32
+
az aks show \
33
+
--resource-group myResourceGroup \
34
+
--name myAKSCluster
35
+
--query nodeResourceGroup
36
+
--output tsv
37
+
```
64
38
65
-
## Create a service using the static IP address
39
+
2. Use the [`az network public ip create`][az-network-public-ip-create] command to create a static public IP address. The following example creates a static IP resource named *myAKSPublicIP* in the *MC_myResourceGroup_myAKSCluster_eastus* node resource group.
66
40
67
-
Before creating a service, ensure the cluster identity used by the AKS cluster has delegated permissions to the other resource group. For example:
--scope /subscriptions/<subscription id>/resourceGroups/<resource group name>
74
-
```
49
+
> [!NOTE]
50
+
> If you're using a *Basic* SKU load balancer in your AKS cluster, use *Basic* for the `--sku` parameter when defining a public IP. Only *Basic* SKU IPs work with the *Basic* SKU load balancer and only *Standard* SKU IPs work with *Standard* SKU load balancers.
75
51
76
-
> [!IMPORTANT]
77
-
> If you customized your outbound IP make sure your cluster identity has permissions to both the outbound public IP and this inbound public IP.
52
+
3. After you create the static public IP address, use the [`az network public-ip list`][az-network-public-ip-list] command to get the IP address. Specify the name of the node resource group and public IP address you created, and query for the *ipAddress*.
78
53
79
-
To create a *LoadBalancer* service with the static public IP address, add the `loadBalancerIP` property and the value of the static public IP address to the YAML manifest. Create a file named `load-balancer-service.yaml` and copy in the following YAML. Provide your own public IP address created in the previous step. The following example also sets the annotation to the resource group named *myResourceGroup*. Provide your own resource group name.
54
+
```azurecli-interactive
55
+
az network public-ip show --resource-group MC_myResourceGroup_myAKSCluster_eastus --name myAKSPublicIP --query ipAddress --output tsv
Create the service and deployment with the `kubectl apply` command.
60
+
1. Before creating a service, use the [`az role assignment create`][az-role-assignment-create] command to ensure the cluster identity used by the AKS cluster has delegated permissions to the node resource group.
> If you customized your outbound IP, make sure your cluster identity has permissions to both the outbound public IP and the inbound public IP.
71
+
72
+
2. Create a file named `load-balancer-service.yaml` and copy in the contents of the following YAML file, providing your own public IP address created in the previous step and the node resource group name.
3. Use the `kubectl apply` command to create the service and deployment.
98
91
99
92
```console
100
93
kubectl apply -f load-balancer-service.yaml
101
94
```
102
95
103
96
## Apply a DNS label to the service
104
97
105
-
If your service is using a dynamic or static public IP address, you can use the service annotation `service.beta.kubernetes.io/azure-dns-label-name` to set a public-facing DNS label. This publishes a fully qualified domain name for your service using Azure's public DNS servers and top-level domain. The annotation value must be unique within the Azure location, so it's recommended to use a sufficiently qualified label.
106
-
107
-
Azure will then automatically append a default suffix, such as `<location>.cloudapp.azure.com` (where location is the region you selected), to the name you provide, to create the fully qualified DNS name. For example:
98
+
If your service uses a dynamic or static public IP address, you can use the `service.beta.kubernetes.io/azure-dns-label-name` service annotation to set a public-facing DNS label. This publishes a fully qualified domain name (FQDN) for your service using Azure's public DNS servers and top-level domain. The annotation value must be unique within the Azure location, so it's recommended to use a sufficiently qualified label. Azure automatically appends a default suffix in the location you selected, such as `<location>.cloudapp.azure.com`, to the name you provide, creating the FQDN.
108
99
109
100
```yaml
110
101
apiVersion: v1
@@ -121,20 +112,20 @@ spec:
121
112
app: azure-load-balancer
122
113
```
123
114
124
-
> [!NOTE]
115
+
> [!NOTE]
125
116
> To publish the service on your own domain, see [Azure DNS][azure-dns-zone] and the [external-dns][external-dns] project.
126
117
127
118
## Troubleshoot
128
119
129
-
If the static IP address defined in the *loadBalancerIP* property of the Kubernetes service manifest does not exist, or has not been created in the node resource group and no additional delegations configured, the load balancer service creation fails. To troubleshoot, review the service creation events with the [kubectl describe][kubectl-describe] command. Provide the name of the service as specified in the YAML manifest, as shown in the following example:
120
+
If the static IP address defined in the *loadBalancerIP* property of the Kubernetes service manifest doesn't exist or hasn't been created in the node resource group and there are no additional delegations configured, the load balancer service creation fails. To troubleshoot, review the service creation events using the [`kubectl describe`][kubectl-describe] command. Provide the name of the service specified in the YAML manifest, as shown in the following example:
130
121
131
122
```console
132
123
kubectl describe service azure-load-balancer
133
124
```
134
125
135
-
Information about the Kubernetes service resource is displayed. The *Events* at the end of the following example output indicate that the *user supplied IP Address was not found*. In these scenarios, verify that you have created the static public IP address in the node resource group and that the IP address specified in the Kubernetes service manifest is correct.
126
+
The output will show you information about the Kubernetes service resource. The following example output shows a `Warning` in the `Events`: "`user supplied IP address was not found`."In this scenario, make sure you've created the static public IP address in the node resource group and that the IP address specified in the Kubernetes service manifest is correct.
136
127
137
-
```
128
+
```console
138
129
Name: azure-load-balancer
139
130
Namespace: default
140
131
Labels: <none>
@@ -158,22 +149,22 @@ Events:
158
149
159
150
## Next steps
160
151
161
-
For additional control over the network traffic to your applications, you may want to instead [create an ingress controller][aks-ingress-basic]. You can also [create an ingress controller with a static public IP address][aks-static-ingress].
152
+
For additional control over the network traffic to your applications, you may want to [create an ingress controller][aks-ingress-basic]. You can also [create an ingress controller with a static public IP address][aks-static-ingress].
0 commit comments