Forum Discussion

Kaivalya's avatar
Kaivalya
Copper Contributor
Mar 10, 2021

Azure: How to create Standard Load Balancer without public IP address?

I want to run my application with AKS cluster(version - 1.18.14) with the dependency of standard load balancer to create multiple node pools. But, the standard load balancer is creating public IP address. which is not suitable for my application. Because my application is private not public.

 

Is there any way to "create Standard load balancer without public IP address in Azure?"

 

Thanks.

    • AkshayMahakalkar's avatar
      AkshayMahakalkar
      Copper Contributor

      Hihspinto ,

      The main issue here is that during creation of AKS cluster with Standard LoadBalancer, AKS cluster itself creates a Public IP address. We have clients which do not allow deploying Public IP address in their Tenant. Because of these issues we are unable to migrate to AKS cluster with standard LoadBalancer.

       

      The thing you just described is when the cluster is ready available and only with Basic LoadBalancer. If an AKS cluster is created with basic LoadBalancer it does not create Public IP address and LoadBalancer by its own. And it becomes visible only when we deploy nginx-ingress controller helm chart. This chart we can configure to point public IP or private IP from VNet.

       

      Because of AKS cluster creating public IP address with standard LoadBalancer, we are not able to use this. And we need to create multiple nodepools. Multiple nodepools are only supported with standard LoadBalancer AKS cluster.

      • Varun Sharma's avatar
        Varun Sharma
        Copper Contributor

        AkshayMahakalkar 

        Use the flag to create the cluster with Basic Load Balancer, because it won’t be created until you deploy the first external Load Balancer service from Kubernetes.

         

        az aks create -g MyResourceGroup -n MyManagedCluster --load-balancer-sku basic

         

        Basic Load Balancer has implications in capacity for outbound connectivity to Internet from the cluster. basic LB has 1024 SNAT ports fixed, in Standard LB this can be increased

         

  • ibnmbodji's avatar
    ibnmbodji
    Steel Contributor
    Hi
    You can deploy an internal load balancer that can allow you to get an private IP . The manifest will look like this :
    apiVersion: v1
    kind: Service
    metadata:
    name: internal-app
    annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
    spec:
    type: LoadBalancer
    ports:
    - port: 80
    selector:
    app: internal-app
    and you deploy it with :
    kubectl apply -f YourManifestName.yaml
    If you didn’t specify the option enable private cluster the API and your load balancer remain public . To create private cluster see the link below :
    https://docs.microsoft.com/en-us/azure/aks/private-clusters . Check also this very good article on how to setup a fully private aks cluster ( no public ip)
    https://denniszielke.medium.com/fully-private-aks-clusters-without-any-public-ips-finally-7f5688411184

Resources