AKS - Part 3 - Standard Load Balancer

Create a AKS using Standard Load Balancer

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

set -g -x AKS_NAME "aks-lb-standard"
set -g -x AKS_RG "rg-aks-cluster"
set -g -x SUBSCRIPTION "..."
set -g -x REGION "eastus"

# Create a resouce group
az group create \
    --location $REGION \
    --name $AKS_RG \
    --subscription $SUBSCRIPTION

# Create a service principal
az ad sp create-for-rbac \
    --skip-assignment \
    -n "sp-aks"

# rbac stands for Kubernetes "role base access control"

# Create AKS
az aks create \
    --location $REGION
    --subscription $SUBSCRIPTION
    --resource-group $AKS_RG
    --name $AKS_NAME
    --ssh-key-value $HOME/.ssh/id_rsa.pub \
    --service-principal "...." \
    --client-secret "...." \
    --network-plugin kubenet \
    --load-balancer-sku standard \
    --outbound-type loadBalancer \
    --node-vm-size Standard_B2s \
    --node-count 1 \
    --tags 'ENV=DEV' 'SRV=EXAMPLE' ```

When choosing a Standard Load Balancer resource for your AKS Azure will automatically create and configure the Load Balancer. A Public and static IP will be created and assigned to that Load Balancer. There is no need to create a Kubernetes loadBalancer service anymore.

Because there is a Load Balance resource behind your AKS all the outbound traffic will be assume the Load Balancer resource IP.

Outbound IPs

When using a Standard Load Balance resource you can customize the outbound IPs.

You can also have more then one outbound IP and you can do that by specifying IP prefixes for example.

You can choose to have more than one outbound IP for those scenarios where you have a heavy outbound traffic. Using multiple IPs is useful to avoid SNAT port exhaustion

Customizing your Load Balance

Be careful whenever you need or feel like changing the ‘idle-timeout’ and the ‘outbound-ports’ configuration for your Load Balancer.

1

(outBoundIPs * 64.000) < (nodeVMs * desiredAllocatedOutboundPorts)

In order to customize the outbound-ports you must be sure you have enough resources (available ports) for your outbound traffic.