Ingress-controller is removing the added rules in the azure application-gateway

[phani796]

Hi Team,

I have deployed the Application Gateway and enabled the kubernetes-ingress add-on to integrate the K8s-cluster with the App-gateway.
So, when I trying to deploy the yaml file to the one of the namespace in cluster, the rules which are already applied in the App-gateway are deleted and ingress is applying defaultpool and defaulthttpsetting.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: name
namespace: scope
annotations:
appgw.ingress.kubernetes.io/appgw-ssl-certificate: certificate
appgw.ingress.kubernetes.io/backend-protocol: http
appgw.ingress.kubernetes.io/ssl-redirect: 'true'
appgw.ingress.kubernetes.io/use-private-ip: 'true'
kubernetes.io/ingress.class: azure/application-gateway
appgw.ingress.kubernetes.io/cookie-based-affinity: 'true'
labels:
name: svc
spec:
rules:
- host: *********
http:
paths:
- path: /svc
pathType: Prefix
backend: service
service:
name:
port:
number: 8081

[dcaro]

@phani796 can you share more details about the command that you are using to create the application gateway?
I am trying to reproduce your issue.

[phani796]

I was manually creating the application-gateway from the portal

[dcaro]

@phani796 are you referring to a brownfield scenario as described here https://docs.microsoft.com/en-us/azure/application-gateway/tutorial-ingress-controller-add-on-existing ?
Also if there is no Azure PowerShell cmdlet involved, this may be an issue related to the service not the Azure PowerShell module. More details on the steps followed and the settings used could help identifying the cause of the issue.

[phani796]

Yes, I am using the same type of brownfield scenario.
Let me explain the complete scenario.
Resources available: K8-cluster, App-gateway, Virtual machine
K8-cluster: one application is running
Virtual machine : other application is running
Application-gateway: Required for maintaining the load balancing, ssl certificate(https) for both the applications running on VM and K8-cluster.
The application which is running on VM is incorporated with the SSL certificate(.crt. key).
For the application which is running on the nodepool of K8-cluster, I need to write a ingress rule for the https(ssl-certificate).
So, for the cluster to connect with the Application-gateway, I have enabled the ingress-controller add on option. After enabling the option, I have applied the ingress-rule to the namespace of the app running on k8-cluster. I have used the above ingress-rule to deploy to the namespace. The actual issue comes here now.
So, at that time of creation of the application-gateway, I am creating the http-listener, backend pool, rule and backend setting, health probe for the application which is running on VM.
But, when I apply the ingress-rule to the namespace of the k8-cluster, the ingress-deployment pod is creating http-listener, backend pool, rule and backend setting, health probe for the cluster application and it is deleting the settings(http-listerer, backendpool etc) in application-gateway for the application which running on VM.
So, I need a solution on this. the ingress-deployment pod should not disturb the applied configuration(http-listerner, backendpool etc) on application-gateway and should only apply the configuration which is required for application running on k8-cluster in app-gateway

[dcaro]

@phani796 it seems that the issue is due to the way AKS manages the ingress controller and not the PowerShell cmdlets since the rules are not managed by PowerShell cmdlets.
Can you open an issue with AKS to have them look into this issue?

[dingmeng-xue]

For this case, please raise issue with AKS. Close this discussion now.