GitHub user dosubot[bot] added a comment to the discussion: Production
deployment issue in
<!-- Answer -->
To configure a private/internal load balancer for Superset on AKS, set the
service type to LoadBalancer and add the Azure internal LB annotation in your
values.yaml:
```yaml
service:
type: LoadBalancer
port: 8088
targetPort: http
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
```
This tells AKS to provision an internal-only load balancer with no public IP,
accessible only within your virtual network. The Superset Helm chart supports
this pattern out of the box—just update your values.yaml and redeploy with
Helm. You can verify the LB is private by running `kubectl get svc superset -n
<namespace> -o wide` (the EXTERNAL-IP will be an internal address) and checking
the Azure portal (the LB will show as "Internal").
If you’re using nginx ingress and want the ingress controller itself to be
exposed via a private LB, set the same annotation on the ingress controller’s
service (not the Superset service). For most nginx ingress Helm charts, you’d
set:
```yaml
controller:
service:
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
type: LoadBalancer
```
If you need to specify a particular subnet for the internal LB, add the
annotation `service.beta.kubernetes.io/azure-load-balancer-internal-subnet:
"<subnet-name>"` as well.
Make sure your DNS and network security groups allow access from your private
network as needed. If you run into issues, check that your Superset pods are
Ready and that the service has endpoints—otherwise, the LB won’t forward
traffic correctly.
Let me know if you want the private LB for the Superset service directly or for
ingress, or if you have specific subnet/networking requirements!
[Reference: Helm chart service
config](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/helm/superset/values.yaml)
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do?
[Good](https://app.dosu.dev/response-feedback/e137ca6d-14f8-4486-934a-cdbd48125c56?feedback_type=great_response)
|
[Irrelevant](https://app.dosu.dev/response-feedback/e137ca6d-14f8-4486-934a-cdbd48125c56?feedback_type=irrelevant_answer)
|
[Incorrect](https://app.dosu.dev/response-feedback/e137ca6d-14f8-4486-934a-cdbd48125c56?feedback_type=incorrect_sources)
|
[Verbose](https://app.dosu.dev/response-feedback/e137ca6d-14f8-4486-934a-cdbd48125c56?feedback_type=too_verbose)
|
[Hallucination](https://app.dosu.dev/response-feedback/e137ca6d-14f8-4486-934a-cdbd48125c56?feedback_type=hallucination)
| [Report
🐛](https://app.dosu.dev/response-feedback/e137ca6d-14f8-4486-934a-cdbd48125c56?feedback_type=bug_report)
|
[Other](https://app.dosu.dev/response-feedback/e137ca6d-14f8-4486-934a-cdbd48125c56?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/33957)
GitHub link:
https://github.com/apache/superset/discussions/33957#discussioncomment-13860162
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
