Route public access to public dns on azure public ip to private addresses in azure.

Question

Hello,

I have the following scenario and need help:

• I have an Azure public ip that I registered three DNS names on.
• I have three private AKS clusters, each with an Azure Load Balancer, that I use for Ingress. Each cluster has a private IP and is registered to a private DNS zone.

I want to route traffic that goes to a specific public name on the public ip to a particular IP or private dns name.

I tried to use Azure Application Gateway but without success until now.

Glad to hear suggestions or get any help,
Thanks in advance.

Answer 1

@Igor Levin

Thank you for getting back.

Thanks for the suggestion, this solution sounds interesting and if one Application Gateway for Containers could sit Infront of three AKS clusters and serve requests to each on different hostnames it could work, maybe.

This will depend on the implementation. An Application Gateway for Containers association defines a connection point into a virtual network. An association is a 1:1 mapping of an association resource to an Azure Subnet that has been delegated. At this time, the current number of associations is currently limited to 1.

The issue with it is that my environment located in the Israel Central region and this resource is not yet available there.>

Yes Application Gateway for Containers is not available in Israel Central currently. I am reaching out to the team internally to see if there is any information I can share when this region will be available

Do you or anyone else have any other ideas that can suit me scenario? Also, I'm practically attached to Application Gateway. Any Azure solution (In Israel Central) is acceptable.

I understand you have already tried using the Azure Application Gateway in this case but not sure if you have tried using AGIC instead of the load balancer.

The Application Gateway Ingress Controller (AGIC) is a Kubernetes application, which makes it possible for Azure Kubernetes Service (AKS) customers to leverage Azure's native Application Gateway L7 load-balancer to expose cloud software to the Internet.

Although as documented here

Customers can only deploy one AGIC add-on per AKS cluster, and each AGIC add-on currently can only target one Application Gateway. For deployments that require more than one AGIC per cluster or multiple AGICs targeting one Application Gateway, please continue to use AGIC deployed through Helm.

As documented at Enable multiple Namespace support in an AKS cluster with Application Gateway Ingress Controller, a single instance of the Azure Application Gateway Kubernetes Ingress Controller (AGIC) can ingest events from and observe multiple namespaces.

Since there are three AKS clusters here let me confirm with the team to check if this can be achieved using a single Application Gateway or three Application Gateway's should be used.

Update 05/12:

I heard back from the team and currently we do not have an ETA on when Application Gateway to be available in Israel Central.

Also, regarding the AGIC approach three Application Gateway's should be used as there are three AKS clusters.

You can also explore for multi-cluster scenario; we would recommend an AppGW deployment for each cluster and then front the gateways with Traffic Manager or Azure Front Door.

Please let me know if you have any questions. Thanks!