无法访问AKS集群部署的应用：自建Basic负载均衡器未被使用

我是云服务新手，正在Azure平台搭建集群。用Terraform创建了ResourceGroup、Basic SKU的静态公网IP、Basic SKU的负载均衡器（关联该公网IP，前端端口80，后端端口3000）以及AKS集群。之后用Skaffold在AKS上部署了ClusterIP服务（端口3000，目标端口3000，关联服务器Pod）、监听3000端口的服务器Deployment和相关密钥。

部署后Pod日志显示应用正常监听3000端口，但通过自建负载均衡器的公网IP（20.218.249.246:80/api）或DNS（fixit.germanywestcentral.cloudapp.azure.com:80/api）访问时连接超时。测试部署Kubernetes LoadBalancer服务，用它的公网IP能正常访问服务器。排查发现集群实际用的是Standard负载均衡器，不是我创建的Basic款。

请问集群或公网IP配置里漏了什么？

资源组配置 #

resource "azurerm_resource_group" "resource_group" {
  name     = var.resource_group_name
  location = var.location
    tags = {
    Environment = "Production"
    Team = "DevOps"
  }
}

公网IP配置 #

resource "azurerm_public_ip" "public-ip" {
  name                = "fixit-public-ip"
  location            = var.location
  resource_group_name = var.resource_group_name
  allocation_method   = "Static"
  domain_name_label = "fixit"
  # sku = "Standard"
  # fixit.germanywestcentral.cloudapp.azure.com

}

负载均衡器配置 #

resource "azurerm_lb" "load-balancer" {
  name                = "fixit-load-balancer"
  location            = var.location
  resource_group_name = var.resource_group_name
  # sku = "Standard"

  frontend_ip_configuration {
    name                 = "PublicIPAddress"
    public_ip_address_id = azurerm_public_ip.public-ip.id
  }
  
  
}
resource "azurerm_lb_backend_address_pool" "address-pool" {
  name                = "fixit-backend-pool"
  loadbalancer_id     = azurerm_lb.load-balancer.id
  
}

resource "azurerm_lb_rule" "load-balancer-rule" {
  name = "fixit-load-balancer-rule"
  loadbalancer_id = azurerm_lb.load-balancer.id
  frontend_ip_configuration_name = "PublicIPAddress"
  protocol                       = "Tcp"
  frontend_port                  = 80
  # backend_port                   = 27017
  backend_port                   = 3000
  # disable_outbound_snat = true

}

AKS集群配置 #

resource "azurerm_kubernetes_cluster" "server_cluster" {
  name                = "server_cluster"
  location            = azurerm_resource_group.resource_group.location
  resource_group_name = azurerm_resource_group.resource_group.name
  dns_prefix          = "fixit"
  kubernetes_version = var.kubernetes_version
  # sku_tier = "Paid"

  default_node_pool {
    name       = "default"
    node_count = 1
    min_count = 1
    max_count = 3
    # vm_size    = "standard_b2s_v5"
    vm_size    = "standard_e2bs_v5"
    type = "VirtualMachineScaleSets"
    enable_auto_scaling = true
    enable_host_encryption = false
    # os_disk_size_gb = 30
    enable_node_public_ip = true
    
  }

  identity {
    type = "SystemAssigned"
  }

  tags = {
    Environment = "Production"
  }

  linux_profile {
    admin_username = "azureuser"
    ssh_key {
        key_data = var.ssh_key
    }
  }
  network_profile {
      network_plugin = "kubenet"
      # load_balancer_sku = "standard"
    
  }
  
}

ClusterIP服务配置 #

apiVersion: v1
kind: Service
metadata:
  name: server-clusterip-service
spec:
  type: ClusterIP
  selector:
    app: fixit-server-pod
  ports:
    - name: server-clusterip-service
      protocol: TCP
      port: 3000 # 服务端口
      targetPort: 3000 # 应用监听端口

服务器Deployment配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: fixit-server
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: fixit-server-pod
  template:
    metadata:
      labels:
        app: fixit-server-pod
    spec:
      imagePullSecrets:
        - name: docker-secret
      containers:
        - name: fixit-server-container
          image: vinnytwice/fixit-server:dev
          imagePullPolicy: 'Always'
          env:
            # - name: SERVER_DEV_IMAGE_TAG
            #   value: 'dev'

            # 服务器配置
            - name: APP_LISTENING_PORT
              value: '3000'
            - name: API_KEY
              valueFrom:
                secretKeyRef:
                  name: server-secret
                  key: api-key
            # Stripe配置
            - name: STRIPE_KEY
              valueFrom:
                secretKeyRef:
                  name: stripe-secret
                  key: stripe-key
            # MongoDB连接配置
            - name: MONGO_USERNAME_K8S
              valueFrom:
                secretKeyRef:
                  key: mongo-username-k8s
                  name: server-secret

            - name: MONGO_HOSTNAME_K8S
              valueFrom:
                secretKeyRef:
                  key: mongo-hostname-k8s
                  name: server-secret

            - name: MONGO_PORT_K8S
              valueFrom:
                secretKeyRef:
                  name: server-secret
                  key: mongo-port-k8s

            - name: MONGO_DB_K8S
              valueFrom:
                secretKeyRef:
                  key: mongo-db-k8s
                  name: server-secret

            # Neo4j连接配置
            - name: NEO4J_AURA_URI
               valueFrom:
                 secretKeyRef:
                   key: neo4j-aura-uri
                   name: neo4j-secret
            - name: NEO4J_AURA_USERNAME
               valueFrom:
                 secretKeyRef:
                   key: neo4j-aura-username
                   name: neo4j-secret
            - name: NEO4J_AURA_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: neo4j-aura-password
                   name: neo4j-secret
          resources:
            limits:
              memory: '2Gi'
              cpu: '500m'
              # cpu: '1.0'

核心问题 #

1. 自建LB未与AKS集群关联：你手动创建的Basic负载均衡器完全独立于AKS集群，AKS不会自动识别并使用它。当部署Kubernetes LoadBalancer服务时，AKS会默认创建Standard级别的LB，这就是你看到的集群实际使用的负载均衡器。

2. 自建LB配置缺失关键关联项：

   • 负载均衡器规则未绑定后端地址池，流量无法找到转发目标
   • AKS节点池的虚拟机规模集（VMSS）未加入到自建LB的后端地址池中

3. AKS负载均衡器SKU默认行为：使用kubenet网络插件时，AKS默认创建Standard SKU的LB，即使你注释了load_balancer_sku = "standard"。若要使用Basic SKU，必须显式指定。

修复步骤 #

方案一：让AKS自动创建Basic SKU的LB（推荐） #

修改AKS集群配置的network_profile，显式指定负载均衡器SKU为Basic：

network_profile {
    network_plugin = "kubenet"
    load_balancer_sku = "basic"
}

之后直接通过Kubernetes LoadBalancer服务关联这个自动创建的LB，无需手动搭建LB。

方案二：完善自建LB的关联配置 #

如果坚持使用手动创建的LB，需要补充以下配置：

1. 给LB规则绑定后端地址池：

resource "azurerm_lb_rule" "load-balancer-rule" {
  name = "fixit-load-balancer-rule"
  loadbalancer_id = azurerm_lb.load-balancer.id
  frontend_ip_configuration_name = "PublicIPAddress"
  protocol                       = "Tcp"
  frontend_port                  = 80
  backend_port                   = 3000
  # 添加后端地址池关联
  backend_address_pool_name      = azurerm_lb_backend_address_pool.address-pool.name
}

2. 将AKS节点池VMSS加入LB后端池：

resource "azurerm_virtual_machine_scale_set_extension" "lb_association" {
  name                 = "lb-association"
  virtual_machine_scale_set_id = azurerm_kubernetes_cluster.server_cluster.default_node_pool[0].vmss_id
  publisher            = "Microsoft.ContainerService"
  type                 = "AzureLoadBalancerForKubernetes"
  type_handler_version = "1.0"

  settings = jsonencode({
    "lbBackendAddressPoolIds" = [azurerm_lb_backend_address_pool.address-pool.id]
  })
}

3. 检查NSG规则：确保AKS节点的网络安全组允许80端口入站流量，以及3000端口的内部流量。

4. 修正ClusterIP配置错误：原配置中type: ClusterIP后多了无关文本，已在上面的配置中修正。

内容的提问来源于stack exchange，提问作者Vincenzo