as i create the private link service from origin frontdoor ; it gives the same description for the origin though they are different ids

ashik 0

i created a private link service with internal IP from the nginx ingress as aks-ingress

then I configured a frontdoor and endpoint; origin group
in origin I created test1.dev.example.com and description as test1dev and assigned to aks-ingress privatelink service and similarly for test1.qa.example.com giving the description as test1qa and assigned to aks-ingress private link service.

but while I see the pending connections ; they are with the same description either test1dev or test1qa only one which created first.

how to resolve this.

1 answer

KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee

2024-08-14T11:02:22.4766667+00:00
@ashik ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Can you please elaborate on your scenario?

From your verbatim,

You have two Internal Load Balancers, each with Private Link Service created.

Then you create a single Origin Group, with two Origins

Each of these Origins are created with Private EndPoint enabled

Is my understanding correct?

Or are you using two PLS for a single Internal Load Balancer?

Or using a single PLS for a single Internal Load Balancer? And trying to create 2 Private EndPoints from two Origins?

NOTE : From AFD Perspective, it is only aware of the PLS. It has no awareness whether or not the service is AKS

Cheers,

Kapil
Please sign in to rate this answer.
ashik 0 Reputation points

2024-08-14T14:59:53.8766667+00:00

Hi @KapilAnanth-MSFT
okay
i will give the brief info

i created nginx ingress through helm ; with an internal load balancer and internal IP with private link service

helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx ` --namespace $(ingressNamespace) --create-namespace ` --values src/config/ingress-nginx/values.helm.yaml ` --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-ipv4"="$aksIngressIp" ` --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-internal"="true" ` --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-internal-subnet"="$loadBalancerSubnetName" ` --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-pls-create"="true" ` --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-pls-name"=ingress-aks-pls ` --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-pls-ip-configuration-subnet"="$privatelinkSubnetName" ` --version "$(ingressNginxVersion)" ` --wait ```================= now in front door I created as below configuration: frontdoor name: fdcdnakstest endpoint: test1dev origingroup: test1 origin: test1dev ==> custom ; hostname: test1dev.aks.example.com; enable private link service ==> name: ingress-aks-pls (choosen from the directory) ; description: test1dev route: test1 ==> path: /test1dev endpoint: test1qa ; origingroup: test1 origin: test1qa ==> custom ; hostname: test1qa.aks.example.com; enable private link service ==> name: ingress-aks-pls (choosen from the directory) ; description: test1qa route: test1 ==> path: /test1qa so I configured the frontdoor as above expectation: from the both origins; private link services to be created automatically with respect to their description and in pending state. issue: only one private link service in pending state gets deployed while doing the manual but the origins and everything exists as expected . i mean with the description test1dev or test1qa only one private connection which origin deployed first gets created; but not both please give the solution

KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee

2024-08-15T09:01:00.3066667+00:00

@ashik ,

I am not aware of "Helm" file configuration.

But from the looks of it, you are creating only one PLS Service overall, is that correct?

In that case, this is expected

See : Single private endpoint

Within a single Azure Front Door profile, if two or more Private Link enabled origins are created with the same set of Private Link, resource ID and group ID, then for all such origins only one private endpoint gets created.

If you create multiple Private Link enabled origins using the same set of Private Link location, resource ID, and group ID, you don't need to approve anymore private endpoints.

A new private endpoint gets created only and only if the region, resource ID or group ID changes. Refer : Multiple private endpoints

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

as i create the private link service from origin frontdoor ; it gives the same description for the origin though they are different ids

1 answer

Your answer