Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: is the recommended way to configure the outbound networks together with Azure standard loadbalancer (SLB). However, for load balancer rules are disabled by default. That means all frontend IPs would be used as the SNAT IPs for virtual machines, according to . This would introduce troubles for various security scenarios, as there's no way to get a stable list of egress IPs. Azure cloud provider should support this scenario, and disable the outbound SNAT when outbound rules are configured by provisioning tools. What you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Others: /kind bug /sig azure /priority critical-urgent

Discussion:
var ( // Master nodes are not added to standard load balancer by default. defaultExcludeMasterFromStandardLB = true <ins> // Outbound SNAT is enabled by default. defaultDisableOutboundSNAT = false </ins> ) // Config holds the configuration parsed from the --cloud-config flag

// ExcludeMasterFromStandardLB excludes master nodes from standard load balancer. // If not set, it will be default to true. ExcludeMasterFromStandardLB *bool `json:"excludeMasterFromStandardLB" yaml:"excludeMasterFromStandardLB"` <ins> // DisableOutboundSNAT disables the outbound SNAT for public load balancer rules. // It should only be set when loadBalancerSku is standard. If not set, it will be default to false. DisableOutboundSNAT *bool `json:"disableOutboundSNAT" yaml:"disableOutboundSNAT"` </ins> // Maximum allowed LoadBalancer Rule Count is the limit enforced by Azure Load balancer MaximumLoadBalancerRuleCount int `json:"maximumLoadBalancerRuleCount" yaml:"maximumLoadBalancerRuleCount"`

config.CloudProviderBackoffDuration = backoffDurationDefault } <del> // Do not add master nodes to standard LB by default. if config.ExcludeMasterFromStandardLB == nil { config.ExcludeMasterFromStandardLB = &defaultExcludeMasterFromStandardLB </del> <ins> if strings.EqualFold(config.LoadBalancerSku, loadBalancerSkuStandard) { // Do not add master nodes to standard LB by default. if config.ExcludeMasterFromStandardLB == nil { config.ExcludeMasterFromStandardLB = &defaultExcludeMasterFromStandardLB } // Enable outbound SNAT by default. if config.DisableOutboundSNAT == nil { config.DisableOutboundSNAT = &defaultDisableOutboundSNAT } } else { if config.DisableOutboundSNAT != nil && *config.DisableOutboundSNAT { return nil, fmt.Errorf("disableOutboundSNAT should only set when loadBalancerSku is standard") } </ins> } azClientConfig := &azClientConfig{

BackendAddressPool: &network.SubResource{ ID: to.StringPtr(lbBackendPoolID), }, <del> LoadDistribution: loadDistribution, FrontendPort:     to.Int32Ptr(port.Port), BackendPort:      to.Int32Ptr(port.Port), EnableFloatingIP: to.BoolPtr(true), </del> <ins> LoadDistribution:    loadDistribution, FrontendPort:        to.Int32Ptr(port.Port), BackendPort:         to.Int32Ptr(port.Port), EnableFloatingIP:    to.BoolPtr(true), DisableOutboundSnat: to.BoolPtr(az.disableLoadBalancerOutboundSNAT()), </ins> }, } if protocol == v1.ProtocolTCP {

return az.ExcludeMasterFromStandardLB != nil && *az.ExcludeMasterFromStandardLB } <ins> func (az *Cloud) disableLoadBalancerOutboundSNAT() bool { if !az.useStandardLoadBalancer() || az.DisableOutboundSNAT == nil { return false } return *az.DisableOutboundSNAT } </ins> // IsNodeUnmanaged returns true if the node is not managed by Azure cloud provider. // Those nodes includes on-prem or VMs from other clouds. They will not be added to load balancer // backends. Azure routes and managed disks are also not supported for them.