Forum Discussion
Azure: How to create Standard Load Balancer without public IP address?
I want to run my application with AKS cluster(version - 1.18.14) with the dependency of standard load balancer to create multiple node pools. But, the standard load balancer is creating public IP address. which is not suitable for my application. Because my application is private not public.
Is there any way to "create Standard load balancer without public IP address in Azure?"
Thanks.
- hspinto
Microsoft
You have to use an Internal Load Balancer for this purpose. Please, follow the doc below:
https://docs.microsoft.com/en-us/azure/aks/internal-lbAs per https://access.redhat.com/solutions/3215091, Azure internal load balancer is not suitable in front of a pool of master nodes servicing api calls that may come from master nodes themselves.
Hihspinto ,
The main issue here is that during creation of AKS cluster with Standard LoadBalancer, AKS cluster itself creates a Public IP address. We have clients which do not allow deploying Public IP address in their Tenant. Because of these issues we are unable to migrate to AKS cluster with standard LoadBalancer.
The thing you just described is when the cluster is ready available and only with Basic LoadBalancer. If an AKS cluster is created with basic LoadBalancer it does not create Public IP address and LoadBalancer by its own. And it becomes visible only when we deploy nginx-ingress controller helm chart. This chart we can configure to point public IP or private IP from VNet.
Because of AKS cluster creating public IP address with standard LoadBalancer, we are not able to use this. And we need to create multiple nodepools. Multiple nodepools are only supported with standard LoadBalancer AKS cluster.
Use the flag to create the cluster with Basic Load Balancer, because it won’t be created until you deploy the first external Load Balancer service from Kubernetes.
az aks create -g MyResourceGroup -n MyManagedCluster --load-balancer-sku basic
Basic Load Balancer has implications in capacity for outbound connectivity to Internet from the cluster. basic LB has 1024 SNAT ports fixed, in Standard LB this can be increased
- Hi
You can deploy an internal load balancer that can allow you to get an private IP . The manifest will look like this :
apiVersion: v1
kind: Service
metadata:
name: internal-app
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
type: LoadBalancer
ports:
- port: 80
selector:
app: internal-app
and you deploy it with :
kubectl apply -f YourManifestName.yaml
If you didn’t specify the option enable private cluster the API and your load balancer remain public . To create private cluster see the link below :
https://docs.microsoft.com/en-us/azure/aks/private-clusters . Check also this very good article on how to setup a fully private aks cluster ( no public ip)
https://denniszielke.medium.com/fully-private-aks-clusters-without-any-public-ips-finally-7f5688411184
