External IP unable to access and met error of cannot connect to server for my AKS pod.

Tan Boon Huan 20

my AKS's pod service is load balancer and have external IP assigned, and I do not see any firewall and Network Security Group rules blocking the traffic, but Network Security Group did have one default rule set to "Deny".

User's image

my service does not have ingress explicitly restricts the traffic also. So, what is the other reason causing I unable to access it via external IP?

Nikhil Duserla 3,960 Reputation points Microsoft Vendor

2025-01-21T14:33:31.62+00:00

Hi @Tan Boon Huan,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Can you please share more details on the issue (yaml file), so that we can assist you further on this.

Tan Boon Huan 20

Service

kind: Service
apiVersion: v1
metadata:
  name: webui-service
  namespace: default-1737358973541
  uid: cba536bd-8140-44a9-8227-530e247579e6
  resourceVersion: '2638'
  creationTimestamp: '2025-01-20T07:43:08Z'
  finalizers:
    - service.kubernetes.io/load-balancer-cleanup
  managedFields:
    - manager: Mozilla
      operation: Update
      apiVersion: v1
      time: '2025-01-20T07:43:08Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:spec:
          f:allocateLoadBalancerNodePorts: {}
          f:externalTrafficPolicy: {}
          f:internalTrafficPolicy: {}
          f:ports:
            .: {}
            k:{"port":80,"protocol":"TCP"}:
              .: {}
              f:name: {}
              f:port: {}
              f:protocol: {}
              f:targetPort: {}
          f:selector: {}
          f:sessionAffinity: {}
          f:type: {}
    - manager: cloud-controller-manager
      operation: Update
      apiVersion: v1
      time: '2025-01-20T07:43:17Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:finalizers:
            .: {}
            v:"service.kubernetes.io/load-balancer-cleanup": {}
        f:status:
          f:loadBalancer:
            f:ingress: {}
      subresource: status
spec:
  ports:
    - name: port80
      protocol: TCP
      port: 80
      targetPort: 80
      nodePort: 31261
  selector:
    app: webui
  clusterIP: 10.0.98.238
  clusterIPs:
    - 10.0.98.238
  type: LoadBalancer
  sessionAffinity: None
  externalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  allocateLoadBalancerNodePorts: true
  internalTrafficPolicy: Cluster
status:
  loadBalancer:
    ingress:
      - ip: 20.56.197.49
        ipMode: VIP

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Tan Boon Huan 20

kind: Pod
apiVersion: v1
metadata:
  name: webui-6b7b4f896d-swj6t
  generateName: webui-6b7b4f896d-
  namespace: default-1737358973541
  uid: 31b7f130-f06a-4488-b697-2ce466ff97c6
  resourceVersion: '2698'
  creationTimestamp: '2025-01-20T07:43:08Z'
  labels:
    app: webui
    pod-template-hash: 6b7b4f896d
  ownerReferences:
    - apiVersion: apps/v1
      kind: ReplicaSet
      name: webui-6b7b4f896d
      uid: adcb45a4-361f-4e0b-a582-3b30f8d7104b
      controller: true
      blockOwnerDeletion: true
  managedFields:
    - manager: kube-controller-manager
      operation: Update
      apiVersion: v1
      time: '2025-01-20T07:43:08Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"adcb45a4-361f-4e0b-a582-3b30f8d7104b"}: {}
        f:spec:
          f:containers:
            k:{"name":"webui"}:
              .: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":80,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:protocol: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:terminationGracePeriodSeconds: {}
    - manager: kubelet.exe
      operation: Update
      apiVersion: v1
      time: '2025-01-20T07:43:31Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.244.1.121"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      subresource: status
spec:
  volumes:
    - name: kube-api-access-5n7sl
      projected:
        sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              name: kube-root-ca.crt
              items:
                - key: ca.crt
                  path: ca.crt
          - downwardAPI:
              items:
                - path: namespace
                  fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.namespace
        defaultMode: 420
  containers:
    - name: webui
      image: eccdemo.azurecr.io/webui:latest
      ports:
        - containerPort: 80
          protocol: TCP
      resources:
        limits:
          cpu: '256'
          memory: 11400G
        requests:
          cpu: '0'
          memory: '0'
      volumeMounts:
        - name: kube-api-access-5n7sl
          readOnly: true
          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      imagePullPolicy: Always
  restartPolicy: Always
  terminationGracePeriodSeconds: 30
  dnsPolicy: ClusterFirst
  nodeSelector:
    kubernetes.io/os: windows
  serviceAccountName: default
  serviceAccount: default
  nodeName: akseccnpl000000
  securityContext: {}
  schedulerName: default-scheduler
  tolerations:
    - key: node.kubernetes.io/not-ready
      operator: Exists
      effect: NoExecute
      tolerationSeconds: 300
    - key: node.kubernetes.io/unreachable
      operator: Exists
      effect: NoExecute
      tolerationSeconds: 300
    - key: node.kubernetes.io/memory-pressure
      operator: Exists
      effect: NoSchedule
  priority: 0
  enableServiceLinks: true
  preemptionPolicy: PreemptLowerPriority
status:
  phase: Running
  conditions:
    - type: PodReadyToStartContainers
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2025-01-20T07:43:31Z'
    - type: Initialized
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2025-01-20T07:43:08Z'
    - type: Ready
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2025-01-20T07:43:31Z'
    - type: ContainersReady
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2025-01-20T07:43:31Z'
    - type: PodScheduled
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2025-01-20T07:43:08Z'
  hostIP: 10.224.0.4
  hostIPs:
    - ip: 10.224.0.4
  podIP: 10.244.1.121
  podIPs:
    - ip: 10.244.1.121
  startTime: '2025-01-20T07:43:08Z'
  containerStatuses:
    - name: webui
      state:
        running:
          startedAt: '2025-01-20T07:43:30Z'
      lastState: {}
      ready: true
      restartCount: 0
      image: eccdemo.azurecr.io/webui:latest
      imageID: >-
        eccdemo.azurecr.io/webui@sha256:7fc8d545924e4f53bdae8a89ceec1b6cf8536ba142bb08343671a03ec3b52101
      containerID: >-
        containerd://d8cde75cd8ebc48bad61498196a8f268b7ecac34eaacbce14b86cad17d7713aa
      started: true
  qosClass: Burstable

Tan Boon Huan 20 Reputation points

2025-01-22T03:00:57.41+00:00

Note: I am new to Azure and AKS.
Tan Boon Huan 20 Reputation points

2025-01-22T03:03:01.3533333+00:00

btw I am new to Azure and AKS
Nikhil Duserla 3,960 Reputation points Microsoft Vendor

2025-01-22T12:30:55.56+00:00

Hi @Tan Boon Huan,

Thank you for sharing the information.

I kindly request that you share a standard YAML file before execution. Please do not share the kubectl edit content file, as providing the above files doesn’t help me identify the issue.

Tan Boon Huan 20

I deleted all and re-do everything, but I faced the other error now.
I met Public IP limit reached but I checked the Public IP Addresses only have two IPs. I do not know why causing this.

I am using Free Trial Subscription

- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: sample-app-pod
    namespace: eccdemo-ns
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: sample-app
    template:
      metadata:
        labels:
          app: sample-app
      spec:
        nodeSelector:
          kubernetes.io/os: windows
        containers:
          - name: server-container
            image: eccdemo.azurecr.io/effluxserver:latest
            env:
              - name: MONGO_DB_URI
                value: <hidden>
            volumeMounts:
              - mountPath: /data
                name: shared-storage
          - name: webui-container
            image: eccdemo.azurecr.io/webui:latest
            ports:
              - containerPort: 80
                name: webui-port
            volumeMounts:
              - mountPath: /var/lib/sqlite
                name: shared-storage
        volumes:
        - name: shared-storage
          persistentVolumeClaim:
            claimName: sqlite-db-claim
- apiVersion: v1
  kind: Service
  metadata:
    name: webui-service
    namespace: eccdemo-ns
  spec:
    selector:
      app: sample-app
    ports:
      - protocol: TCP
        name: eccdemo
        port: 80
        targetPort: webui-port
    type: LoadBalancer
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: sqlite-db-claim
    namespace: eccdemo-ns
  spec:
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: 5Gi

Tan Boon Huan 20

I deleted all and re-create everything, but I faced another error.

I met the error of Public IP limit reached, but I checked only have two records in public IP addresses. I not sure what happened.

- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: sample-app-pod
    namespace: eccdemo-ns
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: sample-app
    template:
      metadata:
        labels:
          app: sample-app
      spec:
        nodeSelector:
          kubernetes.io/os: windows
        containers:
          - name: server-container
            image: eccdemo.azurecr.io/effluxserver:latest
            env:
              - name: MONGO_DB_URI
                value: <xxx>
            volumeMounts:
              - mountPath: /data
                name: shared-storage
          - name: webui-container
            image: eccdemo.azurecr.io/webui:latest
            ports:
              - containerPort: 80
                name: webui-port
            volumeMounts:
              - mountPath: /var/lib/sqlite
                name: shared-storage
        volumes:
        - name: shared-storage
          persistentVolumeClaim:
            claimName: sqlite-db-claim
- apiVersion: v1
  kind: Service
  metadata:
    name: webui-service
    namespace: eccdemo-ns
  spec:
    selector:
      app: sample-app
    ports:
      - protocol: TCP
        name: eccdemo
        port: 80
        targetPort: webui-port
    type: LoadBalancer
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: sqlite-db-claim
    namespace: eccdemo-ns
  spec:
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: 5Gi

Nikhil Duserla 3,960 Reputation points Microsoft Vendor

2025-01-24T11:56:03.17+00:00

Hi @Tan Boon Huan ,

Checking to see whether you have resolved the issue with the solution provided above, or if you need any further assistance, please let us know. We are happy to help.

1 answer

Nikhil Duserla 3,960 Reputation points Microsoft Vendor

2025-01-23T10:11:21.4066667+00:00

Hi @Tan Boon Huan ,

Thank you for reaching us again.

I have tried working with the YAML script you provided, and it is working fine. I am able to deploy it successfully. The issue might be with your subscription, as you mentioned you are using the free trial version

Azure free trial subscriptions have limits on resources, including public IP addresses. Both static and dynamic IPs are supported, but static IPs count towards your limit, even if unused.

Navigate to Public IP addresses list and delete which is not associated.

If you need any further assistance, please let us know. We are happy to help.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

External IP unable to access and met error of cannot connect to server for my AKS pod.

Service

1 answer

Your answer