How to disable port probes for AKS LoadBalancer?

Question

I'm trying to deploy an ftp server image in Azure AKS. To expose the server to public, I've added a service of type LoadBalancer.

apiVersion: v1
kind: Service
metadata:
  name: test-import-ftp
  namespace: staging
spec:
  loadBalancerIP: 168.63.x.x
  type: LoadBalancer
  ports:
  - port: 21
    name: ftp-control
    targetPort: 21
  - port: 50000
    name: ftp-data-0
  - port: 50001
    name: ftp-data-1
  - port: 50002
    name: ftp-data-2
  - port: 50003
    name: ftp-data-3
  - port: 50004
    name: ftp-data-4
  - port: 50005
    name: ftp-data-5
  - port: 50006
    name: ftp-data-6
  - port: 50007
    name: ftp-data-7
  - port: 50008
    name: ftp-data-8
  - port: 50009
    name: ftp-data-9 
  selector:
    app: test-import-ftp

It works fine for the control port but not for the data ports. Reason is, that it configures probes for all ports and ftp servers don't listen on data ports. These ports will be opened "on demand".

How can I disable health checks for data ports?

Try healthCheckNodePort: 21. Maybe it is supported by Azure. Doc: kubernetes.io/docs/tasks/access-application-cluster/… — Jan Garaj
@JanGaraj - thx, saw it but docs say "It only has an effect when … externalTrafficPolicy is set to “Local”" and I think that's not what I have? Also I normally don't know the nodePort - or should I know? — Christoph Lütjen

adhominem adhominem · Accepted Answer · 2019-01-18T16:30:19

AFAIK, you cannot disable health checks, but you can make them work with FTP servers.

Adapt your configuration like so:

[...]
spec:
  loadBalancerIP: 168.63.x.x
  type: LoadBalancer
  healthCheckNodePort: 30021
  externalTrafficPolicy: Local
  ports: [...]

So, you need to set healthCheckNodePort to a port in the legal nodePort range, and set externalTrafficPolicy to Local.

This will make the service open up a nodePort, and the LoadBalancer will now only check that port to determine availability. The drawback is that your health check now only checks that the node is up, not that the ftp service is running.

For this to work, you MUST set externalTrafficPolicy to Local. This means that the container will see the actual client source ip as the traffic source, not the internal kubernetes source. Adjust any of your service settings accordingly. For FTP, however, this is desirable, as it allows the server to check that a passive data connection attempt is done by the same client as the original control connection.

See https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/, section "Preserving the client source IP"

How to disable port probes for AKS LoadBalancer?

2 Answers