<p>I deployed an Azure AKS cluster via the following terraform statements into an existing vnet. It worked, the AKS cluster is created with an Azure load balancer and an public IP address assigned to it. I need a setup with an internal Azure load balancer only. How do I have to change the terraform code to only get an internal Azure load balancer? Thanks</p>
<pre class="lang-hcl prettyprint-override"><code>resource &quot;azurerm_kubernetes_cluster&quot; &quot;aks&quot; {
  name                 = &quot;${var.tags.department}-${var.tags.stage}-${var.tags.environment}_aks&quot;
  location             = var.location
  resource_group_name  = azurerm_resource_group.aksrg.name
  dns_prefix           = lower(&quot;${var.tags.department}-${var.tags.stage}-${var.tags.environment}-aks&quot;)
  private_link_enabled = true
  node_resource_group  = &quot;${var.tags.department}-${var.tags.stage}-${var.tags.environment}_aks_nodes_rg&quot;

  linux_profile {
    admin_username = &quot;testadmin&quot;
    ssh_key {
      key_data = file(&quot;/ssh/id_rsa.pub&quot;) #ssh-keygen
    }
  }

  default_node_pool {
    name                  = &quot;default&quot;
    vm_size               = &quot;Standard_DS1_v2&quot;
    enable_auto_scaling   = false
    enable_node_public_ip = false
    node_count            = 1
    vnet_subnet_id        = azurerm_subnet.akssubnet.id
  }

  network_profile {
    network_plugin     = &quot;azure&quot;
    service_cidr       = &quot;172.100.0.0/24&quot;
    dns_service_ip     = &quot;172.100.0.10&quot;
    docker_bridge_cidr = &quot;172.101.0.1/16&quot;
    load_balancer_sku  = &quot;standard&quot;
  }

  service_principal {
    client_id     = azurerm_azuread_service_principal.aks_sp.application_id
    client_secret = azurerm_azuread_service_principal_password.aks_sp_pwd.value
  }
  addon_profile {
    kube_dashboard {
      enabled = true
    }
  }
  role_based_access_control {
    enabled = false
  }
}
</code></pre>

<p>This is configured in the Kubernetes LoadBalancer service using annotations. Specifically you need to add <code>service.beta.kubernetes.io/azure-load-balancer-internal: &quot;true&quot;</code> to the spec of your <code>LoadBalancer</code> service.</p>
<p>This is documented here <a href="https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard#additional-customizations-via-kubernetes-annotations" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard#additional-customizations-via-kubernetes-annotations</a></p>
