{"id":1683,"date":"2021-08-27T14:46:22","date_gmt":"2021-08-27T21:46:22","guid":{"rendered":"http:\/\/blog.nillsf.com\/?p=1683"},"modified":"2021-08-27T14:46:26","modified_gmt":"2021-08-27T21:46:26","slug":"using-public-ips-from-a-public-ip-prefix-in-azure-kubernetes-service","status":"publish","type":"post","link":"https:\/\/blog.nillsf.com\/index.php\/2021\/08\/27\/using-public-ips-from-a-public-ip-prefix-in-azure-kubernetes-service\/","title":{"rendered":"Using public IPs from a public IP prefix in Azure Kubernetes Service"},"content":{"rendered":"\n

When creating a service of type LoadBalancer in AKS, AKS will by default use a random public IP address and configure that on the AKS load balancer. You can however use a static self-managed public IP<\/a> address as well. Don’t confuse this with using a public ip prefix for the outbound rule<\/a> for AKS though.<\/p>\n\n\n\n

Today I had a customer meeting, where the customer expressed interest in using IPs from a public IP prefix. You can do this as well, learn more about how to do this here:<\/p>\n\n\n\n

The process<\/h2>\n\n\n\n

Using a public IP from a public ip prefix is similar to the process of using a regular self-managed public IP in AKS. You’ll have to do the following steps to make this work:<\/p>\n\n\n\n

  1. Create an AKS cluster.<\/li>
  2. Create a public IP prefix<\/li>
  3. Create a public IP from that prefix<\/li>
  4. Give the AKS service principal permissions over the resource group of the public IP (*)<\/li>
  5. Reference the resource group of that public IP and the IP address itself in the service definition in Kubernetes.<\/li><\/ol>\n\n\n\n

    (*) AKS needs to list the public IP addresses in that resource group, so you’ll need to provide permissions to the full resource group of the public IP; not just the public IP itself.<\/em><\/p>\n\n\n\n

    Let’s walk through this. I did all of this using the Azure CLI, code can be found on GitHub<\/a>.<\/p>\n\n\n\n

    Creating an AKS cluster<\/h3>\n\n\n\n

    For this test, I created a very simple AKS cluster. You can see the command below:<\/p>\n\n\n\n

    az group create -n aks-prefix -l westus2\naz aks create -g aks-prefix -n aks-prefix -l westus2 --enable-managed-identity --node-count 1 --generate-ssh-keys\naz aks get-credentials -g aks-prefix -n aks-prefix<\/code><\/pre>\n\n\n\n
    Creating public ip prefix and public ip<\/h3>\n\n\n\n
    Next up, we’ll create a public IP prefix and public ip from that prefix. For the purposes of this example, I’m creating them in the same resource group as my AKS cluster; but you could create them in a separate resource group as well if you prefer.<\/p>\n\n\n\n
    # creating public ip prefix\naz network public-ip prefix create \\\n    --length 30 \\\n    --name pip-prefix \\\n    --resource-group aks-prefix \\\n    --location westus2 \\\n    --version IPv4\n\n# creating IP from prefix\naz network public-ip create \\\n    --name pip-for-aks \\\n    --resource-group aks-prefix \\\n    --allocation-method Static \\\n    --public-ip-prefix pip-prefix \\\n    --sku Standard \\\n    --version IPv4<\/code><\/pre>\n\n\n\n
    Giving AKS permissions on the resource group<\/h3>\n\n\n\n
    Next, we’ll need to give AKS permissions on the resource group hosting the public IP. For this, we’ll need the ID of the managed identity assigned to AKS and the ID of the resource group. <\/p>\n\n\n\n
    RGID=$(az group show -n aks-prefix -o tsv --query id )\nAPPID=$(az aks show -n aks-prefix -g aks-prefix --query \"identity.principalId\" -o tsv)\naz role assignment create \\\n    --assignee $APPID \\\n    --role \"Network Contributor\" \\\n    --scope $RGID<\/code><\/pre>\n\n\n\n
    Creating a Kubernetes service using that public IP<\/h3>\n\n\n\n
    And now, we can create the service in Kubernetes using that public IP. Let’s first get the actual IP address (we’ll need to input this later in the YAML for the service):<\/p>\n\n\n\n
    az network public-ip show \\\n    -n pip-for-aks \\\n    -g aks-prefix \\\n    --query \"ipAddress\" \\\n    -o tsv<\/code><\/pre>\n\n\n\n
    This will show you the public IP address. You’ll then need to input that into the YAML to create the service. You also need to provide the resource group that the public IP is a part of:<\/p>\n\n\n\n
    apiVersion: v1\nkind: Service\nmetadata:\n  name: myapp\n  annotations:\n        service.beta.kubernetes.io\/azure-load-balancer-resource-group: aks-prefix\nspec:\n  selector:\n    app: myapp\n  ports:\n  - port: 80\n    targetPort: 80\n  type: LoadBalancer\n  loadBalancerIP: <your-public-ip><\/code><\/pre>\n\n\n\n
    And then you can create the service and check it’s creation in Kubernetes using the following command:<\/p>\n\n\n\n
    kubectl create -f service.yaml\nkubectl get svc -w<\/code><\/pre>\n\n\n\n
    And this should show you an output similar to this:<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    And that is an IP from the prefix we created earlier. <\/p>\n\n\n\n
    Summary<\/h2>\n\n\n\n
    In this post, you learned how to use an IP address from a public IP prefix in AKS. We created a new cluster, created a public ip prefix and an IP in that prefix and finally linked that to the AKS cluster.<\/p>\n","protected":false},"excerpt":{"rendered":"
    When creating a service of type LoadBalancer in AKS, AKS will by default use a random public IP address and configure that on the AKS load balancer. You can however use a static self-managed public IP address as well. Don’t confuse this with using a public ip prefix for the outbound rule for AKS though. […]<\/p>\n","protected":false},"author":1,"featured_media":1686,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2,58,36],"tags":[37,115,18,38,186],"class_list":["post-1683","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","category-kubernetes","category-networking","tag-aks","tag-azure-kubernetes-service","tag-kubernetes","tag-networking","tag-public-ip"],"jetpack_featured_media_url":"https:\/\/nillsfblog.blob.core.windows.net\/media\/2021\/08\/Screen-Shot-2021-08-27-at-2.44.49-PM.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/posts\/1683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/comments?post=1683"}],"version-history":[{"count":1,"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/posts\/1683\/revisions"}],"predecessor-version":[{"id":1685,"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/posts\/1683\/revisions\/1685"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/media\/1686"}],"wp:attachment":[{"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/media?parent=1683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/categories?post=1683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.nillsf.com\/index.php\/wp-json\/wp\/v2\/tags?post=1683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}