为 Azure Kubernetes 服务 (AKS) 中的出口流量使用静态公共 IP 地址Use a static public IP address for egress traffic in Azure Kubernetes Service (AKS)

默认情况下,Azure Kubernetes 服务 (AKS) 群集的出口 IP 地址是随机分配的。By default, the egress IP address from an Azure Kubernetes Service (AKS) cluster is randomly assigned. 例如,当需要标识用于访问外部服务的 IP 地址时,此配置是不理想的。This configuration is not ideal when you need to identify an IP address for access to external services, for example. 而是可能需要分配静态 IP 地址,此地址可被列入服务访问允许列表。Instead, you may need to assign a static IP address that can be whitelisted for service access.

本文介绍了如何创建和使用静态公共 IP 地址,以便用于 AKS 群集中的出口流量。This article shows you how to create and use a static public IP address for use with egress traffic in an AKS cluster.

准备阶段Before you begin

本文假定你拥有现有的 AKS 群集。This article assumes that you have an existing AKS cluster. 如果需要 AKS 群集,请参阅 AKS 快速入门使用 Azure CLI使用 Azure 门户If you need an AKS cluster, see the AKS quickstart using the Azure CLI or using the Azure portal.

还需安装并配置 Azure CLI 2.0.59 或更高版本。You also need the Azure CLI version 2.0.59 or later installed and configured. 运行  az --version 即可查找版本。Run az --version to find the version. 如果需要进行安装或升级,请参阅 安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

出口流量概述Egress traffic overview

AKS 群集的出站流量遵循 Azure 负载均衡器约定Outbound traffic from an AKS cluster follows Azure Load Balancer conventions. 在创建 LoadBalancer 类型的第一个 Kubernetes 服务之前,AKS 群集中的代理节点不是任何 Azure 负载均衡器池的一部分。Before the first Kubernetes service of type LoadBalancer is created, the agent nodes in an AKS cluster are not part of any Azure Load Balancer pool. 在此配置中,节点没有实例级公共 IP 地址。In this configuration, the nodes have no instance level Public IP address. Azure 将出站流转换为不可配置的或确定性的公用源 IP 地址。Azure translates the outbound flow to a public source IP address that is not configurable or deterministic.

创建 LoadBalancer 类型的 Kubernetes 服务后,会向 Azure 负载均衡器池添加代理节点。Once a Kubernetes service of type LoadBalancer is created, agent nodes are added to an Azure Load Balancer pool. 对于出站流,Azure 将其转换为在负载均衡器上配置的第一个公共 IP 地址。For outbound flow, Azure translates it to the first public IP address configured on the load balancer. 此公共 IP 地址仅对该资源的生命期有效。This public IP address is only valid for the lifespan of that resource. 如果删除 Kubernetes 负载均衡器服务,则会同时删除关联的负载均衡器和 IP 地址。If you delete the Kubernetes LoadBalancer service, the associated load balancer and IP address are also deleted. 如果要分配特定 IP 地址或保留已重新部署的 Kubernetes 服务的 IP 地址,请创建并使用静态公共 IP 地址。If you want to assign a specific IP address or retain an IP address for redeployed Kubernetes services, you can create and use a static public IP address.

创建静态公共 IPCreate a static public IP

使用 az aks show 命令并添加 --query nodeResourceGroup 查询参数获取资源组名称。Get the resource group name with the az aks show command and add the --query nodeResourceGroup query parameter. 以下示例在名为“myResourceGroup”的资源组中获取名为“myAKSCluster”的 AKS 群集的节点资源组:The following example gets the node resource group for the AKS cluster name myAKSCluster in the resource group name myResourceGroup :

$ az aks show --resource-group myResourceGroup --name myAKSCluster --query nodeResourceGroup -o tsv

MC_myResourceGroup_myAKSCluster_chinaeast2

现在,使用 az network public ip create 命令创建静态公共 IP 地址。Now create a static public IP address with the az network public ip create command. 指定在上一命令中获取的节点资源组名称,然后指定 IP 地址资源的名称(如 myAKSPublicIP):Specify the node resource group name obtained in the previous command, and then a name for the IP address resource, such as myAKSPublicIP :

az network public-ip create \
    --resource-group MC_myResourceGroup_myAKSCluster_chinaeast2 \
    --name myAKSPublicIP \
    --allocation-method static

将显示 IP 地址,如以下精简版示例输出中所示:The IP address is shown, as shown in the following condensed example output:

{
  "publicIp": {
    "dnsSettings": null,
    "etag": "W/\"6b6fb15c-5281-4f64-b332-8f68f46e1358\"",
    "id": "/subscriptions/<SubscriptionID>/resourceGroups/MC_myResourceGroup_myAKSCluster_chinaeast2/providers/Microsoft.Network/publicIPAddresses/myAKSPublicIP",
    "idleTimeoutInMinutes": 4,
    "ipAddress": "40.121.183.52",
    [..]
  }

稍后可以使用 az network public-ip list 命令获取公共 IP 地址。You can later get the public IP address using the az network public-ip list command. 指定节点资源组的名称,然后查询 ipAddress,如以下示例中所示:Specify the name of the node resource group, and then query for the ipAddress as shown in the following example:

$ az network public-ip list --resource-group MC_myResourceGroup_myAKSCluster_chinaeast2 --query [0].ipAddress --output tsv

40.121.183.52

使用静态 IP 创建服务Create a service with the static IP

若要使用静态公共 IP 地址创建服务,请将 loadBalancerIP 属性和静态公共 IP 地址的值添加到 YAML 清单。To create a service with the static public IP address, add the loadBalancerIP property and the value of the static public IP address to the YAML manifest. 创建名为 egress-service.yaml 的文件,并将其复制到以下 YAML 中。Create a file named egress-service.yaml and copy in the following YAML. 提供在前面的步骤中创建的你自己的公共 IP 地址。Provide your own public IP address created in the previous step.

apiVersion: v1
kind: Service
metadata:
  name: azure-egress
spec:
  loadBalancerIP: 40.121.183.52
  type: LoadBalancer
  ports:
  - port: 80

使用 kubectl apply 命令创建服务和部署。Create the service and deployment with the kubectl apply command.

kubectl apply -f egress-service.yaml

此服务将在 Azure 负载均衡器上配置一个新的前端 IP。This service configures a new frontend IP on the Azure Load Balancer. 如果没有配置任何其他 IP,则所有出口流量现在都应当使用此地址。If you do not have any other IPs configured, then all egress traffic should now use this address. 当在 Azure 负载均衡器上配置了多个地址时,出口将使用该负载均衡器上的第一个 IP。When multiple addresses are configured on the Azure Load Balancer, egress uses the first IP on that load balancer.

验证出口地址Verify egress address

若要验证是否正在使用静态公共 IP 地址,可以使用 DNS 查找服务,例如 checkip.dyndns.orgTo verify that the static public IP address is being used, you can use DNS look-up service such as checkip.dyndns.org.

启动并附加到基本 Debian pod:Start and attach to a basic Debian pod:

kubectl run -it --rm aks-ip --image=debian --generator=run-pod/v1

若要从容器中访问网站,请使用 apt-getcurl 安装到容器。To access a web site from within the container, use apt-get to install curl into the container.

apt-get update && apt-get install curl -y

现在,使用 curl 访问 checkip.dyndns.org 站点。Now use curl to access the checkip.dyndns.org site. 将显示出口 IP 地址,如以下示例输出中所示。The egress IP address is shown, as displayed in the following example output. 此 IP 地址与为负载均衡器服务创建和定义的静态公共 IP 地址相匹配:This IP address matches the static public IP address created and defined for the loadBalancer service:

$ curl -s checkip.dyndns.org

<html><head><title>Current IP Check</title></head><body>Current IP Address: 40.121.183.52</body></html>

后续步骤Next steps

若要避免在 Azure 负载均衡器上维护多个公共 IP 地址,可以使用入口控制器。To avoid maintaining multiple public IP addresses on the Azure Load Balancer, you can instead use an ingress controller. 入口控制器提供的其他好处包括:SSL/TLS 终止、对 URI 重写的支持以及上游 SSL/TLS 加密。Ingress controllers provide additional benefits such as SSL/TLS termination, support for URI rewrites, and upstream SSL/TLS encryption. 有关详细信息,请参阅在 AKS 中创建基本入口控制器For more information, see Create a basic ingress controller in AKS.