How to preserve AKS outbound rule changes when AKS version upgrade

Irvin Wang 21 Reputation points
2021-03-26T07:24:47.313+00:00

Due to SNAT port exhaustion issue, we made a change for AKS load balancer outbound rule, so that it can allocate 8000 ports per instance.

This changes is done from Azure Portal manually. However, we found this change rollback to the default by "AzureContainerService" after we upgrade AKS version. Nobody aware of this until there is issue reported.

What's the correct way to change this so that it can preserve the changes we made after AKS cluster upgrade?

![81776-image.png][1] [1]: /api/attachments/81776-image.png?platform=QnA

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,869 questions
Azure Load Balancer
Azure Load Balancer
An Azure service that delivers high availability and network performance to applications.
404 questions
0 comments
Accepted answer
  1. TravisCragg-MSFT 5,676 Reputation points Microsoft Employee
    2021-03-27T00:48:49.43+00:00

    Although you can set the outbound rules on an AKS Load Balancer, this is not a best practice. Outbound rules & Public IPs are designed to be controlled and managed by AKS. Future AKS upgrades will have the same effect on your outbound rules if you continue to do it this way.

    The best way to do this in AKS is to configure your cluster to use multiple LB IPs, and it requires a simple 'az aks update' command using the '--load-balancer-managed-outbound-ip-count' flag as described in the doc. Each additional IP address provided by a frontend provides 64k ephemeral ports for Load Balancer to use as SNAT ports. Changes done this way will persist through version upgrades.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest