<p>we have a basic AKS cluster setup and we need to whitelist this AKS outbound ipadress in one of our services, i scanned the AKS cluster setting in Azure portal, i was not able to find any outbound IpAddress.</p>
<p>how do we get the outboud IP ?</p>
<p>Thanks -Nen</p>

nen
<p>If you are using an AKS cluster with a <strong>Standard SKU Load Balancer</strong> i.e.</p>
<pre><code>$ az aks show -g $RG -n akstest --query networkProfile.loadBalancerSku -o tsv
Standard
</code></pre>
<p>and the <code>outboundType</code> is set to <code>loadBalancer</code> i.e.</p>
<pre><code>$ az aks show -g $RG -n akstest --query networkProfile.outboundType -o tsv
loadBalancer
</code></pre>
<p>then you should be able to fetch the outbound IP addresses for the AKS cluster like (mind the capital <code>IP</code>):</p>
<pre><code>$ az aks show -g $RG -n akstest --query networkProfile.loadBalancerProfile.effectiveOutboundIPs[].id
[
    &quot;/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/MC_xxxxxx_xxxxxx_xxxxx/providers/Microsoft.Network/publicIPAddresses/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&quot;
]
# Using $PUBLIC_IP_RESOURCE_ID obtained from the last step
$  az network public-ip show --ids $PUBLIC_IP_RESOURCE_ID --query ipAddress -o tsv
xxx.xxx.xxx.xxx
</code></pre>
<p>For more information please check <a href="https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard" rel="noreferrer">Use a public Standard Load Balancer in Azure Kubernetes Service (AKS)</a></p>
<hr />
<p>If you are using an AKS cluster with a <strong>Basic SKU Load Balancer</strong> i.e.</p>
<pre><code>$ az aks show -g $RG -n akstest --query networkProfile.loadBalancerSku -o tsv
Basic
</code></pre>
<p>and the <code>outboundType</code> is set to <code>loadBalancer</code> i.e.</p>
<pre><code>$ az aks show -g $RG -n akstest --query networkProfile.outboundType -o tsv
loadBalancer
</code></pre>
<p>Load Balancer Basic chooses a single frontend to be used for outbound flows when multiple (public) IP frontends are candidates for outbound flows. This <strong>selection is not configurable</strong>, and you should <strong>consider the selection algorithm to be</strong> <em><strong>random</strong></em>. This public IP address is only valid for the lifespan of that resource. If you delete the Kubernetes <code>LoadBalancer</code> service, the associated load balancer and IP address are also deleted. If you want to assign a specific IP address or retain an IP address for redeployed Kubernetes services, you can <a href="https://learn.microsoft.com/en-us/azure/aks/egress" rel="noreferrer">create and use a static public IP address</a>, as @nico-meisenzahl mentioned.</p>
<p>The static IP address works only as long as you have one Service on the AKS cluster (with a Basic Load Balancer). When multiple addresses are configured on the Azure Load Balancer, any of these public IP addresses are a candidate for outbound flows, and one is selected at random. Thus every time a Service gets added, you will have to add that corresponding IP address to the whitelist which isn't very scalable. [<a href="https://learn.microsoft.com/en-us/azure/aks/egress#create-a-service-with-the-static-ip" rel="noreferrer">Reference</a>]</p>
<hr />
<p>In the latter case, we would recommend setting <code>outBoundType</code> to <code>userDefinedRouting</code> at the time of AKS cluster creation. If <code>userDefinedRouting</code> is set, AKS won't automatically configure egress paths. The egress setup must be done by you.</p>
<p>The AKS cluster must be deployed into an existing virtual network with a subnet that has been previously configured because when not using standard load balancer (SLB) architecture, you must establish explicit egress. As such, this architecture requires explicitly sending egress traffic to an appliance like a firewall, gateway, proxy or to allow the Network Address Translation (NAT) to be done by a public IP assigned to the standard load balancer or appliance.</p>
<h5>Load balancer creation with userDefinedRouting</h5>
<p>AKS clusters with an outbound type of UDR receive a standard load balancer (SLB) only when the first Kubernetes service of type 'loadBalancer' is deployed. The load balancer is configured with a public IP address for inbound requests and a backend pool for <em>inbound</em> requests. Inbound rules are configured by the Azure cloud provider, but no <strong>outbound public IP address or outbound rules</strong> are configured as a result of having an outbound type of UDR. Your UDR will still be the only source for egress traffic.</p>
<p>Azure load balancers <a href="https://azure.microsoft.com/pricing/details/load-balancer/" rel="noreferrer">don't incur a charge until a rule is placed</a>.</p>
<p>[<strong>!! Important:</strong> Using outbound type is an advanced networking scenario and requires proper network configuration.]</p>
<p>Here's instructions to <a href="https://learn.microsoft.com/en-us/azure/aks/egress-outboundtype#deploy-a-cluster-with-outbound-type-of-udr-and-azure-firewall" rel="noreferrer">Deploy a cluster with outbound type of UDR and Azure Firewall</a></p>
