Customize cluster egress with outbound types in Azure Kubernetes Service (AKS)

You can customize egress for an AKS cluster to fit specific scenarios. By default, AKS creates a Standard Load Balancer to be set up and used for egress. However, the default setup may not meet the requirements of all scenarios if public IPs are disallowed or extra hops are required for egress.

This article covers the various types of outbound connectivity that are available in AKS clusters.

Limitations

• Setting outboundType requires AKS clusters with a vm-set-type of VirtualMachineScaleSets and load-balancer-sku of Standard.

Outbound types in AKS

You can configure an AKS cluster using the following outbound types: load balancer, NAT gateway, or user-defined routing. The outbound type impacts only the egress traffic of your cluster. For more information, see setting up ingress controllers.

Outbound type of loadBalancer

The load balancer is used for egress through an AKS-assigned public IP. An outbound type of loadBalancer supports Kubernetes services of type loadBalancer, which expect egress out of the load balancer created by the AKS resource provider.

If loadBalancer is set, AKS automatically completes the following configuration:

• A public IP address is created for cluster egress.
• The public IP address is assigned to the load balancer resource.
• Backend pools for the load balancer are set up for agent nodes in the cluster.

For more information, see using a standard load balancer in AKS.

Outbound type of managedNatGateway or userAssignedNatGateway

If managedNatGateway or userAssignedNatGateway are selected for outboundType, AKS relies on Azure Networking NAT gateway for cluster egress.

• Select managedNatGateway when using managed virtual networks. AKS provisions a NAT gateway and attach it to the cluster subnet.
• Select userAssignedNatGateway when using bring-your-own virtual networking. This option requires that you have a NAT gateway created before cluster creation.

For more information, see using NAT gateway with AKS.

Outbound type of userDefinedRouting

If userDefinedRouting is set, AKS doesn't automatically configure egress paths. The egress setup is completed by you.

You must deploy the AKS cluster into an existing virtual network with a subnet that is configured. Since you're not using a standard load balancer (SLB) architecture, you must establish explicit egress. This architecture requires explicitly sending egress traffic to an appliance like a firewall, gateway, proxy or to allow NAT to be done by a public IP assigned to the standard load balancer or appliance.

For more information, see configuring cluster egress via user-defined routing.

Outbound type of none

If none is set, AKS won't automatically configure egress paths. This option is similar to userDefinedRouting but does not require a default route as part of validation.

The none outbound type is supported in both bring-your-own (BYO) virtual network scenarios and managed VNet scenarios. However, you must ensure that the AKS cluster is deployed into a network environment where explicit egress paths are defined if needed. For BYO VNet scenarios, the cluster must be deployed into an existing virtual network with a subnet that is already configured. Since AKS doesn't create a standard load balancer or any egress infrastructure, you must establish explicit egress paths if needed. Egress options can include routing traffic to a firewall, proxy, gateway, or other custom network configurations.

Outbound type of block (Preview)

If block is set, AKS configures network rules to actively block all egress traffic from the cluster. This option is useful for highly secure environments where outbound connectivity must be restricted.

When using block:

• AKS ensures that no public internet traffic can leave the cluster through network security group (NSG) rules. VNet traffic isn't affected.
• You must explicitly allow any required egress traffic through extra network configurations.

The block option provides another level of network isolation but requires careful planning to avoid breaking workloads or dependencies.

Updating outboundType after cluster creation

Changing the outbound type after cluster creation deploys or removes resources as required to put the cluster into the new egress configuration.

The following tables show the supported migration paths between outbound types for managed and BYO virtual networks.

Supported Migration Paths for Managed VNet

Each row shows whether the outbound type can be migrated to the types listed across the top. "Supported" means migration is possible, while "Not Supported" or "N/A" means it isn't.

Supported Migration Paths for BYO VNet

Migration is only supported between loadBalancer, managedNATGateway (if using a managed virtual network), userAssignedNATGateway and userDefinedRouting (if using a custom virtual network).

Update cluster to use a new outbound type

• Update the outbound configuration of your cluster using the az aks update command.

Update cluster from loadbalancer to managedNATGateway

az aks update --resource-group <resourceGroup> --name <clusterName> --outbound-type managedNATGateway --nat-gateway-managed-outbound-ip-count <number of managed outbound ip>

Update cluster from managedNATGateway to loadbalancer

az aks update --resource-group <resourceGroup> --name <clusterName> \
--outbound-type loadBalancer \
<--load-balancer-managed-outbound-ip-count <number of managed outbound ip>| --load-balancer-outbound-ips <outbound ip ids> | --load-balancer-outbound-ip-prefixes <outbound ip prefix ids> >

Update cluster from managedNATGateway to userDefinedRouting

• Add route 0.0.0.0/0 default route table. Please see Customize cluster egress with a user-defined routing table in Azure Kubernetes Service (AKS)

az aks update --resource-group <resourceGroup> --name <clusterName> --outbound-type userDefinedRouting

Update cluster from loadbalancer to userAssignedNATGateway in BYO vnet scenario

• Associate nat gateway with subnet where the workload is associated with. Refer to Create a managed or user-assigned NAT gateway

az aks update --resource-group <resourceGroup> --name <clusterName> --outbound-type userAssignedNATGateway

Next steps

• Configure standard load balancing in an AKS cluster
• Configure NAT gateway in an AKS cluster
• Configure user-defined routing in an AKS cluster
• NAT gateway documentation
• Azure networking UDR overview
• Manage route tables