AKS Ingress Controller not accessible from external network despite correct configuration

Kevin Wang 0 Reputation points
2024-09-04T20:42:05.0066667+00:00

I'm encountering an issue with my Azure Kubernetes Service (AKS) cluster where I can't access my application through the Ingress Controller from the external network, despite seemingly correct configuration. Here are the details:

Environment:

  • AKS cluster in Azure (Italy North region)
  • Using Azure CNI for networking
  • Nginx Ingress Controller(and the default load balancer)
  • Application: Mealie (a recipe management app)
  • Domain: my custom domain

Configuration:

  1. Ingress Controller is deployed in the ingress-basic namespace
  2. Mealie application is deployed in the mealie namespace
  3. DNS A record for my domain points to 172.213.193.163 (load balancer's external IP)

What's Working:

  1. DNS resolution is correct (nslookup my domain returns 172.213.193.163)
  2. Internal cluster communication works (can access the service from within the cluster)
  3. Ingress Controller pod is running
  4. Mealie service and pods are running

What's Not Working:

  1. Unable to access the application from external network (browser or curl)
  2. Curl from Azure Cloud Shell also fails to connect

Troubleshooting Steps Taken:

  1. Verified Ingress resource configuration:
    
       apiVersion: networking.k8s.io/v1
    
       kind: Ingress
    
       metadata:
    
         annotations:
    
           kubernetes.io/ingress.class: nginx
    
         name: mealie-ingress
    
         namespace: mealie
    
       spec:
    
         rules:
    
         - host: my domain name
    
           http:
    
             paths:
    
             - backend:
    
                 service:
    
                   name: mealie-svc
    
                   port:
    
                     number: 80
    
               path: /
    
               pathType: Prefix
    
    
  2. Checked Ingress Controller logs - no apparent errors
  3. Verified Network Security Group (NSG) rules:
    • Allow inbound traffic from Internet to 172.213.193.163 on ports 80 and 443
    • Default rules for VNet communication are in place
  4. Confirmed Mealie service configuration:
    
       Name:              mealie-svc
    
       Namespace:         mealie
    
       Type:              ClusterIP
    
       IP:                10.0.183.178
    
       Port:              <unset>  80/TCP
    
       TargetPort:        9000/TCP
    
       Endpoints:         10.244.0.231:9000
    
    
  5. Tested internal cluster access - successful
  6. Checked AKS cluster status - shows as "Succeeded"
  7. Verified Azure Load Balancer configuration
  8. Examined kube-proxy and CoreDNS - appear to be functioning normally

I've gone through multiple rounds of troubleshooting, including all the standard checks for AKS and Ingress issues. The peculiar thing is that everything seems to be configured correctly, yet external access fails.

Error:

When trying to access my domain, the connection times out. Curl from Azure Cloud Shell shows:


* Trying 172.213.193.163:80...

and it times out eventually.

Any insights or suggestions would be greatly appreciated. I'm at a loss as to what could be preventing external access when all configurations appear to be correct.

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
2,073 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Nikhil Duserla 2,025 Reputation points Microsoft Vendor
    2024-09-05T04:16:05.1433333+00:00

    Hi @Kevin Wang,

    Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

    It might be the issue if you don't specify the health probe request path when your app doesn't respond to the root path ("/"). This can happen with some .NET applications where the default routing is set to "/api." In such cases, using a path like "/healthz" for health checks can be useful.

    I'd suggest you get a known good app working and then figure out the delta between that app and yours. If both don't work, then you likely have an infrastructure issue and not a cluster one (eg. an NSG blocking all incoming traffic).

    Install nginx again on the cluster with default config a different ingressClassName and see how you fare.

    Probably it might need a support request to troubleshoot further from networking point of view to validate if any of the NSGs are blocking the access.

    If you have any further queries, do let us know.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.