code: func (az *Cloud) EnsureLoadBalancer(ctx context.Context, clusterName string, service *v1.Service, nodes []*v1.Node) (*v1.LoadBalancerStatus, error) {
  	// When a client updates the internal load balancer annotation,
  	// the service may be switched from an internal LB to a public one, or vise versa.
  	// Here we'll firstly ensure service do not lie in the opposite LB.
  	serviceName := getServiceName(service)
  	klog.V(5).Infof("ensureloadbalancer(%s): START clusterName=%q", serviceName, clusterName)
  
  	lb, err := az.reconcileLoadBalancer(clusterName, service, nodes, true /* wantLb */)
  	if err != nil {
  		return nil, err
  	}
  
  	lbStatus, err := az.getServiceLoadBalancerStatus(service, lb)
  	if err != nil {
  		return nil, err
  	}
  
  	var serviceIP *string
  	if lbStatus != nil && len(lbStatus.Ingress) > 0 {
  		serviceIP = &lbStatus.Ingress[0].IP
  	}
  	klog.V(2).Infof("EnsureLoadBalancer: reconciling security group for service %q with IP %q, wantLb = true", serviceName, logSafe(serviceIP))
  	if _, err := az.reconcileSecurityGroup(clusterName, service, serviceIP, true /* wantLb */); err != nil {
  		return nil, err
  	}
  
  	updateService := updateServiceLoadBalancerIP(service, to.String(serviceIP))
  	flippedService := flipServiceInternalAnnotation(updateService)
  	if _, err := az.reconcileLoadBalancer(clusterName, flippedService, nil, false /* wantLb */); err != nil {
  		return nil, err
  	}
  
  	if _, err := az.reconcilePublicIP(clusterName, updateService, lb, true /* wantLb */); err != nil {
  		return nil, err
  	}
  
  	return lbStatus, nil
  }
docs: // EnsureLoadBalancer creates a new load balancer 'name', or updates the existing one. Returns the status of the balancer