You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Use a static IP with a load balancer in Azure Kubernetes Service (AKS)
3
3
titleSuffix: Azure Kubernetes Service
4
4
description: Learn how to create and use a static IP address with the Azure Kubernetes Service (AKS) load balancer.
5
5
author: asudbring
6
6
ms.author: allensu
7
7
ms.subservice: aks-networking
8
8
ms.topic: how-to
9
-
ms.date: 11/14/2020
10
-
9
+
ms.date: 02/27/2023
11
10
12
11
#Customer intent: As a cluster operator or developer, I want to create and manage static IP address resources in Azure that I can use beyond the lifecycle of an individual Kubernetes service deployed in an AKS cluster.
13
12
---
14
13
15
14
# Use a static public IP address and DNS label with the Azure Kubernetes Service (AKS) load balancer
16
15
17
-
By default, the public IP address assigned to a load balancer resource created by an AKS cluster is only valid for the lifespan of that resource. If you delete the Kubernetes service, the associated load balancer and IP address are also deleted. If you want to assign a specific IP address or retain an IP address for redeployed Kubernetes services, you can create and use a static public IP address.
16
+
When you create a load balancer resource in an Azure Kubernetes Service (AKS) cluster, the public IP address assigned to it is only valid for the lifespan of that resource. If you delete the Kubernetes service, the associated load balancer and IP address are also deleted. If you want to assign a specific IP address or retain an IP address for redeployed Kubernetes services, you can create and use a static public IP address.
18
17
19
18
This article shows you how to create a static public IP address and assign it to your Kubernetes service.
20
19
21
20
## Before you begin
22
21
23
-
This article assumes that you have an existing AKS cluster. If you need an AKS cluster, see the AKS quickstart [using the Azure CLI][aks-quickstart-cli], [using Azure PowerShell][aks-quickstart-powershell], or [using the Azure portal][aks-quickstart-portal].
24
-
25
-
You also need the Azure CLI version 2.0.59 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
26
-
27
-
This article covers using a *Standard* SKU IP with a *Standard* SKU load balancer. For more information, see [IP address types and allocation methods in Azure][ip-sku].
22
+
* This article assumes that you have an existing AKS cluster. If you need an AKS cluster, see the AKS quickstart [using the Azure CLI][aks-quickstart-cli], [using Azure PowerShell][aks-quickstart-powershell], or [using the Azure portal][aks-quickstart-portal].
23
+
* You need the Azure CLI version 2.0.59 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
24
+
* This article covers using a *Standard* SKU IP with a *Standard* SKU load balancer. For more information, see [IP address types and allocation methods in Azure][ip-sku].
28
25
29
26
## Create a static IP address
30
27
31
-
Create a static public IP address with the [az network public ip create][az-network-public-ip-create] command. The following creates a static IP resource named *myAKSPublicIP* in the *myResourceGroup*resource group:
28
+
1. Use the `az aks show`[az-aks-show] command to get the node resource group name of your AKS cluster, which follows this format: `MC_<resource group name>_<AKS cluster name>_<region>`.
32
29
33
-
```azurecli-interactive
34
-
az network public-ip create \
35
-
--resource-group myResourceGroup \
36
-
--name myAKSPublicIP \
37
-
--sku Standard \
38
-
--allocation-method static
39
-
```
30
+
```azurecli-interactive
31
+
az aks show \
32
+
--resource-group myResourceGroup \
33
+
--name myAKSCluster
34
+
--query nodeResourceGroup
35
+
--output tsv
36
+
```
40
37
41
-
> [!NOTE]
42
-
> If you are using a *Basic* SKU load balancer in your AKS cluster, use *Basic* for the *sku* parameter when defining a public IP. Only *Basic* SKU IPs work with the *Basic* SKU load balancer and only *Standard* SKU IPs work with *Standard* SKU load balancers.
43
-
44
-
The IP address is displayed, as shown in the following condensed example output:
45
-
46
-
```json
47
-
{
48
-
"publicIp": {
49
-
...
50
-
"ipAddress": "40.121.183.52",
51
-
...
52
-
}
53
-
}
54
-
```
38
+
2. Use the [`az network public ip create`][az-network-public-ip-create] command to create a static public IP address. The following example creates a static IP resource named *myAKSPublicIP* in the *MC_myResourceGroup_myAKSCluster_eastus* node resource group.
55
39
56
-
You can later get the public IP address using the [az network public-ip list][az-network-public-ip-list] command. Specify the name of the node resource group and public IP address you created, and query for the *ipAddress* as shown in the following example:
$ az network public-ip show --resource-group myResourceGroup --name myAKSPublicIP --query ipAddress --output tsv
48
+
> [!NOTE]
49
+
> If you're using a *Basic* SKU load balancer in your AKS cluster, use *Basic* for the `--sku` parameter when defining a public IP. Only *Basic* SKU IPs work with the *Basic* SKU load balancer and only *Standard* SKU IPs work with *Standard* SKU load balancers.
60
50
61
-
40.121.183.52
62
-
```
51
+
3. After you create the static public IP address, use the [`az network public-ip list`][az-network-public-ip-list] command to get the IP address. Specify the name of the node resource group and public IP address you created, and query for the *ipAddress*.
52
+
53
+
```azurecli-interactive
54
+
az network public-ip show --resource-group MC_myResourceGroup_myAKSCluster_eastus --name myAKSPublicIP --query ipAddress --output tsv
55
+
```
63
56
64
57
## Create a service using the static IP address
65
58
66
-
Before creating a service, ensure the cluster identity used by the AKS cluster has delegated permissions to the other resource group. For example:
59
+
1. Before creating a service, use the [`az role assignment create`][az-role-assignment-create] command to ensure the cluster identity used by the AKS cluster has delegated permissions to the node resource group.
> If you customized your outbound IP, make sure your cluster identity has permissions to both the outbound public IP and the inbound public IP.
70
+
71
+
2. Create a file named `load-balancer-service.yaml` and copy in the contents of the following YAML file, providing your own public IP address created in the previous step and the node resource group name.
3. Use the `kubectl apply` command to create the service and deployment.
67
90
68
-
```azurecli-interactive
69
-
az role assignment create \
70
-
--assignee <Client ID> \
71
-
--role "Network Contributor" \
72
-
--scope /subscriptions/<subscription id>/resourceGroups/<resource group name>
91
+
```console
92
+
kubectl apply -f load-balancer-service.yaml
73
93
```
74
94
75
-
> [!IMPORTANT]
76
-
> If you customized your outbound IP make sure your cluster identity has permissions to both the outbound public IP and this inbound public IP.
95
+
## Apply a DNS label to the service
77
96
78
-
To create a *LoadBalancer* service with the static public IP address, add the `loadBalancerIP` property and the value of the static public IP address to the YAML manifest. Create a file named `load-balancer-service.yaml` and copy in the following YAML. Provide your own public IP address created in the previous step. The following example also sets the annotation to the resource group named *myResourceGroup*. Provide your own resource group name.
97
+
If your service uses a dynamic or static public IP address, you can use the `service.beta.kubernetes.io/azure-dns-label-name` service annotation to set a public-facing DNS label. This publishes a fully qualified domain name (FQDN) for your service using Azure's public DNS servers and top-level domain. The annotation value must be unique within the Azure location, so it's recommended to use a sufficiently qualified label. Azure automatically appends a default suffix in the location you selected, such as `<location>.cloudapp.azure.com`, to the name you provide, creating the FQDN.
Create the service and deployment with the `kubectl apply` command.
114
+
To see the DNS label for your load balancer, run the following command:
97
115
98
116
```console
99
-
kubectl apply -f load-balancer-service.yaml
117
+
kubectl describe service azure-load-balancer
100
118
```
101
119
102
-
## Apply a DNS label to the service
103
-
104
-
If your service is using a dynamic or static public IP address, you can use the service annotation `service.beta.kubernetes.io/azure-dns-label-name` to set a public-facing DNS label. This publishes a fully qualified domain name for your service using Azure's public DNS servers and top-level domain. The annotation value must be unique within the Azure location, so it's recommended to use a sufficiently qualified label.
105
-
106
-
Azure will then automatically append a default suffix, such as `<location>.cloudapp.azure.com` (where location is the region you selected), to the name you provide, to create the fully qualified DNS name. For example:
120
+
The DNS label will be listed under the `Annotations`, as shown in the following condensed example output:
> To publish the service on your own domain, see [Azure DNS][azure-dns-zone] and the [external-dns][external-dns] project.
125
132
126
133
## Troubleshoot
127
134
128
-
If the static IP address defined in the *loadBalancerIP* property of the Kubernetes service manifest does not exist, or has not been created in the node resource group and no additional delegations configured, the load balancer service creation fails. To troubleshoot, review the service creation events with the [kubectl describe][kubectl-describe] command. Provide the name of the service as specified in the YAML manifest, as shown in the following example:
135
+
If the static IP address defined in the *loadBalancerIP* property of the Kubernetes service manifest doesn't exist or hasn't been created in the node resource group and there are no additional delegations configured, the load balancer service creation fails. To troubleshoot, review the service creation events using the [`kubectl describe`][kubectl-describe] command. Provide the name of the service specified in the YAML manifest, as shown in the following example:
129
136
130
137
```console
131
138
kubectl describe service azure-load-balancer
132
139
```
133
140
134
-
Information about the Kubernetes service resource is displayed. The *Events* at the end of the following example output indicate that the *user supplied IP Address was not found*. In these scenarios, verify that you have created the static public IP address in the node resource group and that the IP address specified in the Kubernetes service manifest is correct.
141
+
The output will show you information about the Kubernetes service resource. The following example output shows a `Warning` in the `Events`: "`user supplied IP address was not found`." In this scenario, make sure you've created the static public IP address in the node resource group and that the IP address specified in the Kubernetes service manifest is correct.
135
142
136
-
```
143
+
```console
137
144
Name: azure-load-balancer
138
145
Namespace: default
139
146
Labels: <none>
@@ -157,22 +164,22 @@ Events:
157
164
158
165
## Next steps
159
166
160
-
For additional control over the network traffic to your applications, you may want to instead [create an ingress controller][aks-ingress-basic]. You can also [create an ingress controller with a static public IP address][aks-static-ingress].
167
+
For additional control over the network traffic to your applications, you may want to [create an ingress controller][aks-ingress-basic]. You can also [create an ingress controller with a static public IP address][aks-static-ingress].
0 commit comments