Cloud Experts Documentation

Configure a load balancer service to use a static public IP

This content is authored by Red Hat experts, but has not yet been tested on every supported configuration.

This guide demonstrates how to create and assign a static public IP address to an OpenShift service in Azure Red Hat OpenShift (ARO). By default, the public IP address assigned to an OpenShift service with a type of LoadBalancer created by an ARO cluster is only valid for the lifespan of that resource. If you delete the OpenShift service, the associated load balancer and IP address are also deleted. If you want to assign a specific IP address or retain an IP address for redeployed OpenShift services, you can create and use a static public IP address.

This guide will walk through the following steps:

  1. Create a new static public IP address.
  2. Grant the Azure Red Hat OpenShift (ARO) cluster’s service principal access to the parent resource group.
  3. Create the load balancer service and assign the static public IP address.


  • An existing ARO cluster. If you need an ARO cluster, see the quickstart here .
  • The Azure CLI. If you need to install the Azure CLI, see the Microsoft documentation hereexternal link (opens in new tab) .

Before you begin

Before we begin, we need to set a few environment variables that will help us run the commands included in the guide.

RESOURCE_GROUP=example-rg # Replace this with the name of your ARO cluster's resource group
CLUSTER_NAME=example-cluster # Replace this with the name of your ARO cluster
PUBLIC_IP_NAME=example-pip # Replace this with the name you want your static public IP to have

Create a new static public IP address

Create a static public IP address by using the az network public ip create command. The following command creates a static IP resource using the name you specified above in the parent resource group of the cluster object. To create the IP, run the following command:

az network public-ip create \
    --resource-group ${RESOURCE_GROUP} \
    --name ${PUBLIC_IP_NAME} \
    --sku Standard \
    --allocation-method static

The static public IP address provisioned is displayed as a part of the output of the command. It will look something like this:

  "publicIp": {
    "ipAddress": "",

Grant the Azure Red Hat OpenShift (ARO) cluster’s service principal access to the parent resource group

Next, we must grant the Azure Red Hat OpenShift (ARO) cluster’s service principal access to the network resources of the parent resource group where we’ve created the static public IP. This must be done because the public IP lives outside of the cluster’s managed resource group (which starts with aro-). To grant the necessary access, run the following command:

CLIENT_ID=$(az aro show --resource-group ${RESOURCE_GROUP} --name ${CLUSTER_NAME} --query "servicePrincipalProfile.clientId" --output tsv)
SUB_ID=$(az account show --query "id" --output tsv)
az role assignment create \
    --assignee ${CLIENT_ID} \
    --role "Network Contributor" \
    --scope /subscriptions/${SUB_ID}/resourceGroups/${RESOURCE_GROUP}

Create the load balancer service and assign the static public IP address.

Finally, we need to create a LoadBalancer service inside of OpenShift that specifies the static public IP address, as well as the parent resource group. Next, generate the necessary YAML for the LoadBalancer service with the loadBalancerIP property and resource group annotation set. To do so, run the following command, making sure to replace the variables specified:

PUBLIC_IP=$(az network public-ip show --resource-group ${RESOURCE_GROUP} --name ${PUBLIC_IP_NAME} --query ipAddress --output tsv)
cat << EOF > pip-service.yaml
apiVersion: v1
kind: Service
  annotations: ${RESOURCE_GROUP}
  name: static-ip-lb
  loadBalancerIP: ${PUBLIC_IP}
  type: LoadBalancer
  - port: 443
    app: static-ip-lb

Feel free to further modify this output (which is saved in your current directory as pip-service.yaml).

Finally, apply the service configuration to the cluster by running the following command (note this will deploy the service directly into the current namespace):

oc apply -f ./pip-service.yaml

The cluster should provision the load balancer within a minute or two. You can verify this by running the following command:

oc describe service static-ip-lb

The output will look similar to this:

Name:                     static-ip-lb
Namespace:                example
Labels:                   <none>
Annotations:     example-rg
Selector:                 app=static-ip-lb
Type:                     LoadBalancer
IP Family Policy:         SingleStack
IP Families:              IPv4
LoadBalancer Ingress:
Port:                     port-8080  443/TCP
TargetPort:               8080/TCP
NodePort:                 port-8080  31616/TCP
Session Affinity:         None
External Traffic Policy:  Cluster
  Type    Reason                Age   From                Message
  ----    ------                ----  ----                -------
  Normal  EnsuringLoadBalancer  31m   service-controller  Ensuring load balancer
  Normal  EnsuredLoadBalancer   31m   service-controller  Ensured load balancer

You can now access your load balancer using the IP address provided!

Interested in contributing to these docs?

Collaboration drives progress. Help improve our documentation The Red Hat Way.

Red Hat logo LinkedIn YouTube Facebook Twitter



Try, buy & sell


About Red Hat

We’re the world’s leading provider of enterprise open source solutions—including Linux, cloud, container, and Kubernetes. We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Subscribe to our newsletter, Red Hat Shares

Sign up now
© 2023 Red Hat, Inc.