<p>I have an Azure kubernetes cluster created using the following Terraform code</p>
<pre><code># Required Provider
terraform {
  required_providers {
    azurerm = {
      source  = &quot;hashicorp/azurerm&quot;
      version = &quot;~&gt; 3.0.2&quot;
    }
  }
  required_version = &quot;&gt;= 1.1.0&quot;
}

data &quot;azurerm_client_config&quot; &quot;current&quot; {}

provider &quot;azurerm&quot; {
  subscription_id = local.subscription_id
  tenant_id       = local.tenant_id
  client_id       = local.client_id
  client_secret   = local.client_secret

  features {}
}

resource &quot;random_pet&quot; &quot;rg-name&quot; {
  prefix = var.resource_group_name_prefix
}

resource &quot;azurerm_resource_group&quot; &quot;rg&quot; {
  name     = random_pet.rg-name.id
  location = var.resource_group_location
}

resource &quot;azurerm_virtual_network&quot; &quot;test&quot; {
  name                = var.virtual_network_name
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = [var.virtual_network_address_prefix]

  subnet {
    name           = var.aks_subnet_name
    address_prefix = var.aks_subnet_address_prefix
  }

  tags = var.tags
}

data &quot;azurerm_subnet&quot; &quot;kubesubnet&quot; {
  name                 = var.aks_subnet_name
  virtual_network_name = azurerm_virtual_network.test.name
  resource_group_name  = azurerm_resource_group.rg.name
  depends_on           = [azurerm_virtual_network.test]
}

resource &quot;azurerm_kubernetes_cluster&quot; &quot;k8s&quot; {
  name       = var.aks_name
  location   = azurerm_resource_group.rg.location
  dns_prefix = var.aks_dns_prefix
  private_cluster_enabled = var.private_cluster
  resource_group_name = azurerm_resource_group.rg.name

  http_application_routing_enabled = false

  linux_profile {
    admin_username = var.vm_user_name

    ssh_key {
      key_data = file(var.public_ssh_key_path)
    }
  }

  default_node_pool {
    name            = &quot;agentpool&quot;
    node_count      = var.aks_agent_count
    vm_size         = var.aks_agent_vm_size
    os_disk_size_gb = var.aks_agent_os_disk_size
    vnet_subnet_id  = data.azurerm_subnet.kubesubnet.id
  }

  service_principal {
    client_id     = local.client_id
    client_secret = local.client_secret
  }

  network_profile {
    network_plugin     = &quot;azure&quot;
    dns_service_ip     = var.aks_dns_service_ip
    docker_bridge_cidr = var.aks_docker_bridge_cidr
    service_cidr       = var.aks_service_cidr
    load_balancer_sku  = &quot;standard&quot;
  }

  # Enabled the cluster configuration to the Azure kubernets with RBAC
  azure_active_directory_role_based_access_control { 
    managed                     = var.azure_active_directory_role_based_access_control_managed
    admin_group_object_ids      = var.active_directory_role_based_access_control_admin_group_object_ids
    azure_rbac_enabled          = var.azure_rbac_enabled
  }

  timeouts {
    create = &quot;20m&quot;
    delete = &quot;20m&quot;
  }  

  depends_on = [data.azurerm_subnet.kubesubnet,module.log_analytics_workspace]
  tags       = var.tags
}
</code></pre>
<p>It creates the Load Balancer with Public IP as shown below</p>
<p><a href="https://i.stack.imgur.com/jQTPT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jQTPT.png" alt="enter image description here" /></a></p>
<p>However, I don't want to have a public IP for the Load balancer instead it should have the Internal Private IP.</p>
<p><a href="https://i.stack.imgur.com/RV9I8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RV9I8.png" alt="enter image description here" /></a></p>
<p>What should I to do have this load balancer with Internal Private IP and Service is not exposed over the Internet using the Public IP?</p>
<p><strong>Note:</strong> As per the <a href="https://learn.microsoft.com/en-us/azure/aks/internal-lb#:%7E:text=internal%2Dapp%20%20%20LoadBalancer%20%20%2010.0.248.59%20%20%2010.240.0.7%20%20%20%2080%3A30555/TCP%20%20%202m" rel="nofollow noreferrer">Microsoft documentation</a>, even if you annotate with <strong>annotations:     service.beta.kubernetes.io/azure-load-balancer-internal: &quot;true&quot;</strong>, external IP is still assigned which I am trying to avoid.</p>

<p>The load balancer that gets created with the AKS cluster (usually called kubernetes) is used for egress (not ingress) traffic and is a public LB, and it cannot be private. This is part of the outbound type configuration.</p>
<p>The &quot;outbound type&quot; of the AKS cluster can be set to &quot;LoadBalancer, UserDefinedRouting or managedNatGateway&quot;. if you choose any option other than LB, then you would need to configure your network to route the traffic externally. check <a href="https://learn.microsoft.com/en-us/azure/aks/egress-outboundtype" rel="nofollow noreferrer">this doc</a> for more info.</p>
<p>For ingress traffic, you have the choice to use public or private LB. This is configured in the service resource (of type LoadBalancer) under kubernetes, where you would use the annotation that you mentioned to create a private LB. Public rules will use the same public LB created with the cluster.</p>
<p>You can set the private Ip of the LB using annotations as well:</p>
<pre><code>  annotations:
    service.beta.kubernetes.io/azure-load-balancer-ipv4: 10.240.0.25
    service.beta.kubernetes.io/azure-load-balancer-internal: &quot;true&quot;
</code></pre>
<p>This is mentioned in the <a href="https://learn.microsoft.com/en-us/azure/aks/internal-lb" rel="nofollow noreferrer">same doc</a> that you shared.</p>
