How to bind a fixed public IP in azure to my gateway

[supremefist]

Hi,

I'm running a kubernetes cluster in azure and I created this gateway:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared-nginx-gateway
spec:
  gatewayClassName: nginx
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
          namespaces:
            from: All
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        certificateRefs:
          - name: wildcard-tls
      allowedRoutes:
        namespaces:
          from: All

but the shared-nginx-gateway-nginx LoadBalancer was assigned a random IP, presumably provisioned behind the scenes in azure. Is it possible to configure this Gateway to have the LoadBalancer bind to a specific, already provisioned, public IP?

Thanks in advance!

[salonichf5]

Hey @supremefist, thanks for your interest in the project 👋

Yes, you can do this by specifying the addresses field on your Gateway and pointing it at the IP you’ve already provisioned. For example:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway
spec:
  gatewayClassName: nginx
  addresses:
    - type: IPAddress
      value: 192.0.2.1
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: "*.example.com"

Once applied, the loadBalancer IP will be set to it:

service/gateway-nginx   LoadBalancer   10.96.62.111   192.0.2.1   80:31596/TCP   6s

Please note: At the moment, we only support IPAddress type for this field.

[sjberman]

@supremefist You'll need to edit that resource and add the loadBalancerIP to the service section.

[supremefist]

It did however create this service also

Name:                     shared-nginx-gateway-nginx
Namespace:                gateway-system
Labels:                   app.kubernetes.io/instance=ngf
                          app.kubernetes.io/managed-by=ngf-nginx
                          app.kubernetes.io/name=shared-nginx-gateway-nginx
                          gateway.networking.k8s.io/gateway-name=shared-nginx-gateway
Annotations:              <none>
Selector:                 app.kubernetes.io/instance=ngf,app.kubernetes.io/managed-by=ngf-nginx,app.kubernetes.io/name=shared-nginx-gateway-nginx,gateway.networking.k8s.io/gateway-name=shared-nginx-gateway
Type:                     LoadBalancer
IP Family Policy:         PreferDualStack
IP Families:              IPv4
IP:                       10.0._._
IPs:                      10.0._._
External IPs:             y.y.y.y
LoadBalancer Ingress:     x.x.x.x (VIP)
Port:                     port-80  80/TCP
TargetPort:               80/TCP
NodePort:                 port-80  30588/TCP
Endpoints:                10.244._._:80
Port:                     port-443  443/TCP
TargetPort:               443/TCP
NodePort:                 port-443  32062/TCP
Endpoints:                10.244._._:443
Session Affinity:         None
External Traffic Policy:  Local
Internal Traffic Policy:  Cluster
HealthCheck NodePort:     31999
Events:                   <none>

however, without me defining an additional service on y.y.y.y, traffic never passes through this service

[supremefist]

@sjberman thanks! so the only way to fix this (without deploying my own service) is to patch the NginxProxy by hand?

[sjberman]

If you want a static IP, then yes, you need to set this value in the NginxProxy CRD because that's what our control plane uses to configure the loadBalancerIP field directly on the NGINX Service, which should then make it have a static external IP address.