azure-aksazure-application-gateway

How to prevent AKS Ingress from overwriting Application Gateway's existing services?


I recently had connected an AKS cluster to an Application Gateway and had the services I hosted on the AKS cluster be made accessible through the gateway's public IP. However I realized that whenever I update the Ingress I created the AKS and gateway it overwrites all exisitng settings (pool, backend settings, health probe, etc. I was wondering if there is a way where when we update the Ingress it doesn't overwrite the whole gateway and it simply adds to it?

Also how can I achieve this as well if I were to connect 2 AKS to the one gateway without one of the AKS erasing the entire gateway whenever a new service is created on AKS?


Solution

  • Unfortunately, when installing the AGIC via the AKS add-on, you'll be forced to use the AGIC in the default behaviour, i.e. the AGIC will consider itself as the only one that uses the Application Gateway. That's why you see that behaviour.

    enter image description here

    At the moment, the only way where you can change this AGIC behaviour is by installing it via Helm. Helm enables you to configure the AGIC as shared, and only in this way you can use AzureIngressProhibitedTarget.

    enter image description here

    eg. AGIC configuration as shared

    appgw:
    subscriptionId: <subscriptionId>    # existing field
    resourceGroup: <resourceGroupName>  # existing field
    name: <applicationGatewayName>      # existing field
    shared: true                        # <<<<< Add this field to enable shared App Gateway >>>>>
    

    eg. AzureIngressProhibitedTarget

    apiVersion: "appgw.ingress.k8s.io/v1"
    kind: AzureIngressProhibitedTarget
    metadata:
      name: your-custom-prohibitions
    spec:
      hostname: your.own-hostname.com
    

    For more info:

    Multi-cluster / Shared App Gateway

    Difference between Helm deployment and AKS Add-On