Application-gateway-kubernetes-ingress: Routing to different namespace

[LirazRom]

i have created the ingress controller in the default namespace and i have a service in other namespace
when i try to route to the service - i cannot access the service

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: occm
namespace: scaleredis
annotations:
kubernetes.io/ingress.class: azure/application-gateway
spec:
rules:

• http:
  paths:
  
  
  
  • backend:
    
    serviceName: scaleredis-occm
    
    servicePort: 80
  
  

[akshaysngupta]

Did you specify watchNamespace in ingress controller's helm config ?

kubernetes:
  watchNamespace: "scaleredis"

[asridharan]

@akshaysngupta nice catch !! We probably need to introduce the ability to watch multiple namespaces.

@LirazRom as @akshaysngupta mentioned by default we only listen to the default namespace.

[LirazRom]

So I need to add it to the helm chart of the controller ?

On Fri, 2 Nov 2018 at 0:30 Avinash Sridharan [e-mail]
wrote:

@akshaysngupta https://github.com/akshaysngupta nice catch !! We
probably need to introduce the ability to watch multiple namespaces.

@LirazRom https://github.com/LirazRom as @akshaysngupta
https://github.com/akshaysngupta mentioned by default we only listen to
the default namespace.

—
You are receiving this because you were mentioned.

Reply to this email directly, view it on GitHub
https://github.com/Azure/application-gateway-kubernetes-ingress/issues/67#issuecomment-435209007,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AOexABlfWC6dRi9Ubkj_2kpCc8PdCxjLks5uq3YdgaJpZM4YIyrm
.

[asridharan]

@LirazRom yes. Just reinstall the controller using Helm, with the right watchNamespace.

[AndreasM009]

I had the same problem. Supporting multiple namespaces would be great.

[AndreasM009]

I tried your suggestion @asridharan but now I get the following error:

I1105 16:39:45.444266       1 main.go:60] Creating authorizer from MSI
F1105 16:39:45.724724       1 main.go:97] Error creating informers, namespace [mynamespace] is not found: namespaces "mynamespace" is forbidden: User "system:serviceaccount:default:appgatewayv2-ingress-azure" cannot get namespaces in the namespace "mynamespace"

[asridharan]

@AndreasM009 could you elaborate a bit more: You reinstalled with the watchNamepsace to mynamespace and the controller failed to listen to that namespace? Also, is this an RBAC enabled cluster? The service account that we create for the ingress controller during helm installation should have privileges to view all the namespaces. @akshaysngupta could you kindly take a look a this?

[AndreasM009]

Exactly, I reinstalled with watchNamespace to mynamespace. It is an RBAC enabled cluster.

[piizei]

I'm hitting this same problem with rbac enabled 1.11.3. Without RBAC watching the another namespace works fine.
When I provision the cluster as RBAC etc and set helm configuration to rbac=true, I can see cluster role created for the deployment with 'All namespaces' but still it gives the same error 'Forbidded ... cannot get namespace in namespaces'.

[asridharan]

@piizei @AndreasM009 @LirazRom apologize on the delay in looking into this. A bunch of us are out on vaccation and there is some holiday readiness going on our end because of which the response here is slow. Please bear with us as we try to get to it in the next week or so.

[asridharan]

@piizei @AndreasM009 @LirazRom
Could you update your helm charts to the latest and give this a try?

@akshaysngupta just committed a fix #74

[piizei]

I can confirm that now it works 🥇

[asridharan]

Awesome !! Thanks @akshaysngupta for fixing this !!

[AndreasM009]

@asridharan sorry for the delay. I can confirm that it works now, if you specify the namespace to listen on in the configuration. Thx. Is it possible to specify multiple namespaces?

[asridharan]

@AndreasM009 thanks. We currently don't support multiple namespaces, but lets create an enhancement issue for this and we can take it up. As you can see we are backed up a little on the issues, but we should be able to get traction on the enhancements after the holidays.

[dan-jackson-github]

@asridharan I can't see an enhancement for watching multiple namespaces, this would be really useful functionality, did this ever get created?

[Baklap4]

As of last weekend the gateway now also supports listening to multiple namespaces. See https://github.com/Azure/application-gateway-kubernetes-ingress/issues/113 for more details.

[arunroula]

Thanks all much for all the information provided here.

Can some one suggest me please how I can deploy AGIC to different namespace instead of deploying to default namespace?

Presently deploy of AGIC is failing due to the resource quota related error "must specify limits.cpu,limits.memory,requests.cpu,requests.memory"

I have cloned the AGIC repo, updated the resources for the container, still the pod is not getting created.

Is the same is not supported.

Please provide your thoughts.

Regards,
Aruna Kumar Roula

[ksanchez15]

Hey @LirazRom @akshaysngupta, i'm currently experiencing similar issues. I'm not quite sure what needs to be where. Meaning I'm not sure if I should put the controller in the same namespace as my deployments (for my app). And the ingress itself? And what about the the aad-pod-identity? it places itself in the default namespace by default, but doesn't this means that my deployments and pods (for my app) should be in the default workspace also?

TL;DR there are multiple resources that need to be deployed in the cluster. How do all of them relate to namespaces?

Thank you

[akshaysngupta]

@ksanchez15 You can deploy AGIC and AAD Pod identity in any namespace you like. They look at all resources on a cluster level.
So, you can deploy your apps in dev/test/prod namespace. Even the ingress resource can be in their respective namespace. dev namespace will contain the dev related ingresses and so forth.