Azure

Load Balancing

kube-apiserver

A load balancer distributes IPv4 TCP/6443 traffic across a backend address pool of controllers with a healthy kube-apiserver. Clusters with multiple controllers use an availability set with 2 fault domains to tolerate hardware failures within Azure.

HTTP/HTTPS Ingress

An Azure Load Balancer distributes IPv4/IPv6 TCP/80 and TCP/443 traffic across backend address pools of workers with a healthy Ingress controller.

The load balancer addresses are output as ingress_static_ipv4 and ingress_static_ipv6 for use in DNS A and AAAA records. See Ingress on Azure.

TCP/UDP Services

Load balance TCP/UDP applications by adding rules to the Azure LB (output). A rule may map different ports (e.g. 3333 external, 30333 internal).

# Forward traffic to the worker backend address pool
resource "azurerm_lb_rule" "some-app-tcp" {
  name                           = "some-app-tcp"
  resource_group_name            = module.ramius.resource_group_name
  loadbalancer_id                = module.ramius.loadbalancer_id
  frontend_ip_configuration_name = "ingress-ipv4"

  protocol                 = "Tcp"
  frontend_port            = 3333
  backend_port             = 30333
  backend_address_pool_ids = module.ramius.backend_address_pool_ids.ipv4
  probe_id                 = azurerm_lb_probe.some-app.id
}

# Health check some-app
resource "azurerm_lb_probe" "some-app" {
  name                = "some-app"
  resource_group_name = module.ramius.resource_group_name
  loadbalancer_id     = module.ramius.loadbalancer_id
  protocol            = "Tcp"
  port                = 30333
}

Firewalls

Add firewall rules to the worker security group.

resource "azurerm_network_security_rule" "some-app" {
  name                         = "some-app"
  resource_group_name          = module.ramius.resource_group_name
  network_security_group_name  = module.ramius.worker_security_group_name
  priority                     = "3001"
  access                       = "Allow"
  direction                    = "Inbound"
  protocol                     = "Tcp"
  source_port_range            = "*"
  destination_port_range       = "30333"
  source_address_prefix        = "*"
  destination_address_prefixes = module.ramius.worker_address_prefixes.ipv4
}

IPv6

Azure does not provide public IPv6 addresses at the standard SKU.

IPv6 Feature	Supported
Node IPv6 address	Yes
Node Outbound IPv6	Yes
Kubernetes Ingress IPv6	Yes