将静态公共 IP 地址和 DNS 标签用于 Azure Kubernetes 服务 (AKS) 负载均衡器Use a static public IP address and DNS label with the Azure Kubernetes Service (AKS) load balancer

默认情况下,分配给 AKS 群集创建的负载均衡器资源的公共 IP 地址仅在该资源的保留期内有效。By default, the public IP address assigned to a load balancer resource created by an AKS cluster is only valid for the lifespan of that resource. 如果删除 Kubernetes 服务,则会同时删除关联的负载均衡器和 IP 地址。If you delete the Kubernetes service, the associated load balancer and IP address are also deleted. 如果要分配特定 IP 地址或保留已重新部署的 Kubernetes 服务的 IP 地址,请创建并使用静态公共 IP 地址。If you want to assign a specific IP address or retain an IP address for redeployed Kubernetes services, you can create and use a static public IP address.

本文介绍如何创建静态公共 IP 地址并将其分配给 Kubernetes 服务。This article shows you how to create a static public IP address and assign it to your Kubernetes service.

准备阶段Before you begin

本文假定你拥有现有的 AKS 群集。This article assumes that you have an existing AKS cluster. 如果需要 AKS 群集,请参阅 AKS 快速入门使用 Azure CLI使用 Azure 门户If you need an AKS cluster, see the AKS quickstart using the Azure CLI or using the Azure portal.

还需安装并配置 Azure CLI 2.0.59 或更高版本。You also need the Azure CLI version 2.0.59 or later installed and configured. 运行  az --version 即可查找版本。Run az --version to find the version. 如果需要进行安装或升级,请参阅 安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

本文介绍如何将标准 SKU IP 与 标准 SKU 负载均衡器结合使用。 This article covers using a Standard SKU IP with a Standard SKU load balancer. 有关详细信息,请参阅 Azure 中的 IP 地址类型和分配方法For more information, see IP address types and allocation methods in Azure.

创建静态 IP 地址Create a static IP address

使用 az network public ip create 命令创建静态公共 IP 地址。Create a static public IP address with the az network public ip create command. 以下代码在 myResourceGroup 资源组中创建名为 myAKSPublicIP 的静态 IP 资源:The following creates a static IP resource named myAKSPublicIP in the myResourceGroup resource group:

az network public-ip create \
    --resource-group myResourceGroup \
    --name myAKSPublicIP \
    --sku Standard \
    --allocation-method static

备注

如果在 AKS 群集中使用基本 SKU 负载平衡器,请在定义公共 IP 时对 sku 参数使用 BasicIf you are using a Basic SKU load balancer in your AKS cluster, use Basic for the sku parameter when defining a public IP. 仅基本 SKU IP 兼容基本 SKU 负载均衡器,仅标准 SKU IP 兼容标准 SKU 负载均衡器。 Only Basic SKU IPs work with the Basic SKU load balancer and only Standard SKU IPs work with Standard SKU load balancers.

将显示 IP 地址,如以下精简版示例输出中所示:The IP address is displayed, as shown in the following condensed example output:

{
  "publicIp": {
    ...
    "ipAddress": "40.121.183.52",
    ...
  }
}

稍后可以使用 az network public-ip list 命令获取公共 IP 地址。You can later get the public IP address using the az network public-ip list command. 指定节点资源组的名称和创建的公共 IP 地址,然后查询 ipAddress,如以下示例中所示:Specify the name of the node resource group and public IP address you created, and query for the ipAddress as shown in the following example:

$ az network public-ip show --resource-group myResourceGroup --name myAKSPublicIP --query ipAddress --output tsv

40.121.183.52

使用静态 IP 地址创建服务Create a service using the static IP address

在创建服务之前,请确保 AKS 群集使用的服务主体已将权限委托给其他资源组。Before creating a service, ensure the service principal used by the AKS cluster has delegated permissions to the other resource group. 例如:For example:

az role assignment create \
    --assignee <SP Client ID> \
    --role "Network Contributor" \
    --scope /subscriptions/<subscription id>/resourceGroups/<resource group name>

若要使用静态公共 IP 地址创建 LoadBalancer 服务,请将 loadBalancerIP 属性和静态公共 IP 地址的值添加到 YAML 清单。To create a LoadBalancer service with the static public IP address, add the loadBalancerIP property and the value of the static public IP address to the YAML manifest. 创建名为 load-balancer-service.yaml 的文件,并将其复制到以下 YAML 中。Create a file named load-balancer-service.yaml and copy in the following YAML. 提供在前面的步骤中创建的你自己的公共 IP 地址。Provide your own public IP address created in the previous step. 以下示例还将注释设置为名为 myResourceGroup 的资源组。The following example also sets the annotation to the resource group named myResourceGroup. 提供自己的资源组名称。Provide your own resource group name.

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-resource-group: myResourceGroup
  name: azure-load-balancer
spec:
  loadBalancerIP: 40.121.183.52
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: azure-load-balancer

使用 kubectl apply 命令创建服务和部署。Create the service and deployment with the kubectl apply command.

kubectl apply -f load-balancer-service.yaml

向服务应用 DNS 标签Apply a DNS label to the service

如果服务使用动态或静态公共 IP 地址,则可使用服务批注 service.beta.kubernetes.io/azure-dns-label-name 来设置面向公众的 DNS 标签。If your service is using a dynamic or static public IP address, you can use the service annotation service.beta.kubernetes.io/azure-dns-label-name to set a public-facing DNS label. 这将使用 Azure 的公共 DNS 服务器和顶级域为你的服务发布完全限定的域名。This publishes a fully qualified domain name for your service using Azure's public DNS servers and top-level domain. 批注值在 Azure 位置中必须唯一,因此建议使用进行了足够限定的标签。The annotation value must be unique within the Azure location, so it's recommended to use a sufficiently qualified label.

然后,Azure 会自动将 <location>.cloudapp.chinacloudapi.cn(其中的 location 是所选的区域)之类的默认子网追加到提供的名称后面,以创建完全限定的 DNS 名称。Azure will then automatically append a default subnet, such as <location>.cloudapp.chinacloudapi.cn (where location is the region you selected), to the name you provide, to create the fully qualified DNS name. 例如:For example:

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel
  name: azure-load-balancer
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: azure-load-balancer

备注

若要在自己的域中发布服务,请参阅 Azure DNSexternal-dns 项目。To publish the service on your own domain, see Azure DNS and the external-dns project.

故障排除Troubleshoot

如果 Kubernetes 服务清单的 loadBalancerIP 属性中定义的静态 IP 地址不存在或尚未在节点资源组中创建,并且尚未配置其他托管,则负载均衡器服务创建将失败。If the static IP address defined in the loadBalancerIP property of the Kubernetes service manifest does not exist, or has not been created in the node resource group and no additional delegations configured, the load balancer service creation fails. 若要排除此故障,请用 kubectl describe 命令查看服务创建事件。To troubleshoot, review the service creation events with the kubectl describe command. 提供 YAML 清单中指定的服务的名称,如以下示例中所示:Provide the name of the service as specified in the YAML manifest, as shown in the following example:

kubectl describe service azure-load-balancer

将显示有关 Kubernetes 服务资源的信息。Information about the Kubernetes service resource is displayed. 以下示例输出末尾的“事件”指示“找不到用户提供的 IP 地址”。The Events at the end of the following example output indicate that the user supplied IP Address was not found. 在这些情况下,请验证是否已在节点资源组中创建静态公共 IP 地址,以及在 Kubernetes 服务清单中指定的 IP 地址是否正确。In these scenarios, verify that you have created the static public IP address in the node resource group and that the IP address specified in the Kubernetes service manifest is correct.

Name:                     azure-load-balancer
Namespace:                default
Labels:                   <none>
Annotations:              <none>
Selector:                 app=azure-load-balancer
Type:                     LoadBalancer
IP:                       10.0.18.125
IP:                       40.121.183.52
Port:                     <unset>  80/TCP
TargetPort:               80/TCP
NodePort:                 <unset>  32582/TCP
Endpoints:                <none>
Session Affinity:         None
External Traffic Policy:  Cluster
Events:
  Type     Reason                      Age               From                Message
  ----     ------                      ----              ----                -------
  Normal   CreatingLoadBalancer        7s (x2 over 22s)  service-controller  Creating load balancer
  Warning  CreatingLoadBalancerFailed  6s (x2 over 12s)  service-controller  Error creating load balancer (will retry): Failed to create load balancer for service default/azure-load-balancer: user supplied IP Address 40.121.183.52 was not found

后续步骤Next steps

如需获得对流向应用程序的网络流量的额外控制,你需要改为创建入口控制器For additional control over the network traffic to your applications, you may want to instead create an ingress controller. 此外,还可以使用静态公共 IP 地址创建入口控制器You can also create an ingress controller with a static public IP address.