Unable to create type 'loadbalancer' in Azure with a private IP.

Please use this to only for bug reports. For questions or when you need help, you can use the GitHub Discussions, our #strimzi Slack channel or out user mailing list.

Describe the bug I’m trying to create a load balancer listener in Azure AKS for the kafka nodes with a private IP address following the documentation. Every time I try, the load balancer fails to create since it tries to attach to the public IP, which the cluster identity does not have permissions on (by design). I tried the template snippit below, first without the ‘template:’ section per the docs when running strimzi > 0.20, then tried adding it just to see if it would help, but it still tried to bind to the public IP.

To Reproduce Steps to reproduce the behavior:

1. Deploy the template below (kubectl apply -f template.yml)

Expected behavior Create a load balancer for the kafka nodes using a private IP, not public.

Environment (please complete the following information):

• Strimzi version: 0.22.1
• Installation method: helm
• Kubernetes cluster: Kubernetes 1.20.5
• Infrastructure: Azure AKS

YAML files and logs

kind: Kafka
metadata:
  name: <my cluster name>
  namespace: <my namespace>
spec:
  kafka:
    replicas: 3
    version: 2.7.0
    listeners:
      - name: private
        port: 9092
        type: loadbalancer
        tls: true
        authentication:
          type: scram-sha-512
        configuration:
          bootstrap:
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: "true"
          brokers:
          - broker: 0
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: "true"
          - broker: 1
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: "true"
          - broker: 2
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: "true"
    template:
      externalBootstrapService:
        metadata:
          annotations:
            service.beta.kubernetes.io/azure-load-balancer-internal: "true"
      perPodService:
        metadata:
          annotations:
            service.beta.kubernetes.io/azure-load-balancer-internal: "true"

Additional context none

[justin-silveri]

Update: It turns out this was a permissions issue on the Azure AKS side. It required adding the AKS ServicePrinciple as ‘Contributor’ to the AKS managed Resource Group, and ‘Network Contributor’ to the user managed AKS Resource Group. Why it’s trying to touch the public loadbalancer/pip when creating an internal only service makes no sense at all to me, but it’s working now.

[justin-silveri]

Yes, the issue can be closed. Posted the update for exactly that reason, in case anyone else has the same issue in Azure with AKS.