Load Balancer

Introduction

Azure Load Balancer distributes inbound TCP and UDP traffic across a pool of backend instances, such as virtual machines and scale set instances, at layer 4. A load balancer has frontend IP configurations that receive traffic, backend address pools that serve it, load-balancing rules and inbound NAT rules that map frontend ports to backend ports, health probes that decide which backends receive traffic, and outbound rules for outbound connectivity. For more information, see What is Azure Load Balancer?.

LocalStack for Azure provides a local environment for building and testing applications that make use of Azure Load Balancer. The supported APIs are available on our API Coverage section, which provides information on the extent of Load Balancer’s integration with LocalStack.

Getting started

This guide is designed for users new to Azure Load Balancer and assumes basic knowledge of the Azure CLI and our lstk az proxy.

Launch LocalStack using your preferred method. For more information, see Introduction to LocalStack for Azure. Once the container is running, enable Azure CLI interception by running:

lstk az start-interception

This command points the az CLI away from the public Azure management REST API and toward the LocalStack for Azure emulator API. To revert this configuration, run:

lstk az stop-interception

This reconfigures the az CLI to send commands to the official Azure management REST API.

Create a resource group and a network

Create a resource group, a virtual network with a backend subnet, and a Standard public IP address for the load balancer’s frontend:

az group create \
  --name rg-lb-demo \
  --location westeurope

az network vnet create \
  --name vnet-lb-demo \
  --resource-group rg-lb-demo \
  --location westeurope \
  --address-prefixes 10.1.0.0/16 \
  --subnet-name subnet-backend \
  --subnet-prefixes 10.1.1.0/24

az network public-ip create \
  --name pip-lb-demo \
  --resource-group rg-lb-demo \
  --location westeurope \
  --sku Standard \
  --allocation-method Static

Output

{
  "publicIp": {
    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/publicIPAddresses/pip-lb-demo",
    "ipAddress": "20.114.33.207",
    "location": "westeurope",
    "name": "pip-lb-demo",
    "provisioningState": "Succeeded",
    "publicIPAllocationMethod": "Static",
    "sku": {
      "name": "Standard",
      "tier": "Regional"
    },
    "type": "Microsoft.Network/publicIPAddresses"
    ...
  }
}

Create a load balancer

Create a Standard load balancer with a public frontend and an empty backend address pool:

az network lb create \
  --name lb-demo \
  --resource-group rg-lb-demo \
  --location westeurope \
  --sku Standard \
  --public-ip-address pip-lb-demo \
  --frontend-ip-name fe-public \
  --backend-pool-name be-pool

Output

{
  "loadBalancer": {
    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo",
    "location": "westeurope",
    "name": "lb-demo",
    "properties": {
      "backendAddressPools": [
        {
          "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/backendAddressPools/be-pool",
          "name": "be-pool",
          ...
        }
      ],
      "frontendIPConfigurations": [
        {
          "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/frontendIPConfigurations/fe-public",
          "name": "fe-public",
          "properties": {
            "privateIPAllocationMethod": "Dynamic",
            "provisioningState": "Succeeded",
            "publicIPAddress": {
              "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/publicIPAddresses/pip-lb-demo",
              "resourceGroup": "rg-lb-demo"
            },
            ...
          },
          ...
        }
      ],
      "inboundNatRules": [],
      "loadBalancingRules": [],
      "outboundRules": [],
      "probes": [],
      "provisioningState": "Succeeded"
    },
    "resourceGroup": "rg-lb-demo",
    "sku": {
      "name": "Standard",
      "tier": "Regional"
    },
    "type": "Microsoft.Network/loadBalancers"
  }
}

Add a health probe and a load-balancing rule

Create an HTTP health probe:

az network lb probe create \
  --lb-name lb-demo \
  --resource-group rg-lb-demo \
  --name probe-http \
  --protocol Http \
  --port 80 \
  --path /

Output

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/probes/probe-http",
  "intervalInSeconds": 15,
  "loadBalancingRules": [],
  "name": "probe-http",
  "numberOfProbes": 2,
  "port": 80,
  "probeThreshold": 1,
  "protocol": "Http",
  "provisioningState": "Succeeded",
  "requestPath": "/",
  "resourceGroup": "rg-lb-demo",
  "type": "Microsoft.Network/loadBalancers/probes"
}

Then create a rule that balances TCP port 80 across the backend pool, using the probe:

az network lb rule create \
  --lb-name lb-demo \
  --resource-group rg-lb-demo \
  --name rule-http \
  --protocol Tcp \
  --frontend-port 80 \
  --backend-port 80 \
  --frontend-ip-name fe-public \
  --backend-pool-name be-pool \
  --probe-name probe-http

Output

{
  "backendAddressPool": {
    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/backendAddressPools/be-pool",
    "resourceGroup": "rg-lb-demo"
  },
  "backendPort": 80,
  "enableFloatingIP": false,
  "enableTcpReset": false,
  "frontendIPConfiguration": {
    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/frontendIPConfigurations/fe-public",
    "resourceGroup": "rg-lb-demo"
  },
  "frontendPort": 80,
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/loadBalancingRules/rule-http",
  "idleTimeoutInMinutes": 4,
  "loadDistribution": "Default",
  "name": "rule-http",
  "probe": {
    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/probes/probe-http",
    "resourceGroup": "rg-lb-demo"
  },
  "protocol": "Tcp",
  "provisioningState": "Succeeded",
  "type": "Microsoft.Network/loadBalancers/loadBalancingRules"
  ...
}

Add an inbound NAT rule

Map frontend port 50001 to SSH on a backend instance:

az network lb inbound-nat-rule create \
  --lb-name lb-demo \
  --resource-group rg-lb-demo \
  --name nat-ssh \
  --protocol Tcp \
  --frontend-port 50001 \
  --backend-port 22 \
  --frontend-ip-name fe-public

Output

{
  "backendPort": 22,
  "enableFloatingIP": false,
  "enableTcpReset": false,
  "frontendIPConfiguration": {
    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/frontendIPConfigurations/fe-public",
    "resourceGroup": "rg-lb-demo"
  },
  "frontendPort": 50001,
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/inboundNatRules/nat-ssh",
  "idleTimeoutInMinutes": 4,
  "name": "nat-ssh",
  "protocol": "Tcp",
  "provisioningState": "Succeeded",
  "resourceGroup": "rg-lb-demo",
  "type": "Microsoft.Network/loadBalancers/inboundNatRules"
}

Add a network interface to the backend pool

Create a network interface in the backend subnet and add its IP configuration to the backend pool:

az network nic create \
  --name nic-lb-demo \
  --resource-group rg-lb-demo \
  --location westeurope \
  --vnet-name vnet-lb-demo \
  --subnet subnet-backend \
  --lb-name lb-demo \
  --lb-address-pools be-pool

The backend pool now lists the network interface’s IP configuration:

az network lb address-pool show \
  --lb-name lb-demo \
  --resource-group rg-lb-demo \
  --name be-pool

Output

{
  "backendIPConfigurations": [
    {
      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/networkInterfaces/nic-lb-demo/ipConfigurations/ipconfig1",
      "resourceGroup": "rg-lb-demo"
    }
  ],
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-demo/backendAddressPools/be-pool",
  "inboundNatRules": [],
  "loadBalancerBackendAddresses": [],
  "loadBalancingRules": [],
  "name": "be-pool",
  "outboundRules": [],
  "provisioningState": "Succeeded",
  "resourceGroup": "rg-lb-demo",
  "tunnelInterfaces": [],
  "type": "Microsoft.Network/loadBalancers/backendAddressPools"
}

List and delete load balancers

List the load balancers in the resource group:

az network lb list \
  --resource-group rg-lb-demo \
  --output table

Output

Location    Name     ProvisioningState    ResourceGroup
----------  -------  -------------------  ---------------
westeurope  lb-demo  Succeeded            rg-lb-demo

Delete the network interface and the load balancer, then list the load balancers again to confirm the deletion:

az network nic delete \
  --name nic-lb-demo \
  --resource-group rg-lb-demo

az network lb delete \
  --name lb-demo \
  --resource-group rg-lb-demo

az network lb list \
  --resource-group rg-lb-demo

Output

[]

Features

The Load Balancer emulator supports the following features:

• Create and manage load balancers: Full lifecycle management including create, get, update tags, list, and delete, with Basic and Standard SKUs.
• Frontend IP configurations: Public frontends that reference a public IP address, and private frontends whose IP address is allocated from the subnet (dynamic) or reserved (static), and released again when the load balancer is deleted.
• Child resources: Backend address pools and inbound NAT rules can be managed on their own; frontend IP configurations, load-balancing rules, health probes and outbound rules are managed through the load balancer, as the az network lb subcommands do.
• Backend pool membership: Network interfaces that join a backend pool appear in the pool’s backendIPConfigurations.
• AKS integration: Each AKS cluster gets a Standard load balancer named kubernetes in its node resource group, which the cluster’s cloud controller manager updates for LoadBalancer services.

Limitations

• No traffic distribution: Load balancers are stored and returned faithfully, but no traffic is balanced, probed, or translated by inbound NAT or outbound rules.
• Limited validation: Rules and probes are not validated against each other; for example, a rule that references a probe that does not exist is accepted. Port ranges are not checked.
• Some properties are not stored: For example, a load-balancing rule’s disableOutboundSnat is always returned as false.
• Back-references stay empty: A frontend IP configuration does not list the rules that use it, and the list of network interfaces of a load balancer is always empty.
• Inbound NAT pools: Inbound NAT pools are accepted as part of the load balancer, but they are only stored.

API Coverage

23 of 26 operations implemented

Formats for tools and AIPage MarkdownCoverage MarkdownCoverage JSONCoverage catalog

Operation ▲	Implemented ▼

PreviousPage 1 of 0Next