question

IrvinWang-8626 avatar image
0 Votes"
IrvinWang-8626 asked TravisCragg-MSFT answered

How to preserve AKS outbound rule changes when AKS version upgrade

Due to SNAT port exhaustion issue, we made a change for AKS load balancer outbound rule, so that it can allocate 8000 ports per instance.

This changes is done from Azure Portal manually. However, we found this change rollback to the default by "AzureContainerService" after we upgrade AKS version. Nobody aware of this until there is issue reported.

What's the correct way to change this so that it can preserve the changes we made after AKS cluster upgrade?

![81776-image.png][1] [1]: /answers/storage/attachments/81776-image.png

azure-kubernetes-serviceazure-load-balancer
image.png (43.0 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

TravisCragg-MSFT avatar image
0 Votes"
TravisCragg-MSFT answered

Although you can set the outbound rules on an AKS Load Balancer, this is not a best practice. Outbound rules & Public IPs are designed to be controlled and managed by AKS. Future AKS upgrades will have the same effect on your outbound rules if you continue to do it this way.

The best way to do this in AKS is to configure your cluster to use multiple LB IPs, and it requires a simple 'az aks update' command using the '--load-balancer-managed-outbound-ip-count' flag as described in the doc. Each additional IP address provided by a frontend provides 64k ephemeral ports for Load Balancer to use as SNAT ports. Changes done this way will persist through version upgrades.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.