Application-gateway-kubernetes-ingress: Multiple namespaces support

[AresiusXP]

We're planning on provisioning an AKS for several users supporting multiple namespaces, one per project. Our idea is to deploy one ingress controller with one Application Gateway.

As I understand, this deployment only support one namespace that will be watched. Is there any plan on watching multiple namespaces for triggering the rules creation in the AppGw?

[asridharan]

Hi @AresiusXP yes we do plan to support multiple name spaces, though its slightly further down the list of priorities at this point.

[AresiusXP]

Hi @AresiusXP yes we do plan to support multiple name spaces, though its slightly further down the list of priorities at this point.

Well, it's a shame it's not higher in priority, since a multitenant cluster with several namespaces is something we're deploying really soon.

Do you have an estimate on when it may be a work in progress? Like Q4, or 2020? And is there any way to move it up the prio list? I don't want to be pushy nor annoying, sorry if i come across like that.

Thank you for the info.

[rhollins]

We are currently testing app GW as ingress and so far looks good but no support for multiple namespaces is a blocker, would be great to have some estimate on that.

[asridharan]

I am hoping we will have some resources to work on this and be able to add this support by June'19. Will update if we are not able to make it.

[tiholm]

We are planning to build a single AKS cluster with namespace per environment (test, dev, QA, prod). One application gateway would serve all these environments. Ingress controller would provide gateway configuration for all namespaces. Is this possible with single ingress controller?

Or do we need application gateway per environment or / and ingress controller per environment? What is recommend test/dev/QA/prod setup configuration from viewpoint of ingress controller?

[aleksmark]

Looking forward to this enhancement.

[DeanPH]

Any progress on this?

[tiholm]

Our team installed multiple ingress controllers, each watching separate namespace. That setup resolves this but support for single controller watching for multiple namespaces would be great.

[draychev]

Multiple namespace support is in active development. You'll see PRs this week building out the feature. Another release is coming very soon!

[robertprather]

Multiple watched namespaces is something our team would really benefit from and certainly aligns to a achieving cluster density through kubernetes. Good news and happy to test it out soon.

[Baklap4]

Linking #67 for temporary workaround to switch namespaces....

[DeanPH]

Still going to make the June timeframe @asridharan ?

[timja]

seems like support for it was merged here:
https://github.com/Azure/application-gateway-kubernetes-ingress/pull/263

[draychev]

@robertprather @Baklap4 @DeanPH -- @timja is right - the PR that enables multiple Namespace support was merged. I'd like for us to test the software a bit more before we cut a new release later this week.

[draychev]

Release candidate v0.7.0-rc1 of AGIC is out. This includes support for multiple namespaces.

We documented how it works and how to enable AGIC on multiple (or all) namespaces here.

@asridharan, @akshaysngupta, and I would love go get your feedback on how well AGIC works within your specific namespaced AKS!

[draychev]

Most recent release candidate is 0.7.0-rc2

Here are the instructions on how to upgrade your existing installation of the Ingress Controller: https://github.com/Azure/application-gateway-kubernetes-ingress/blob/master/docs/how-tos/helm-upgrade.md

Looking forward to your feedback!

[PatricioDanos]

Hi! I can see that multiple namespaces support has been released with version 0.7.0. That's great news!

Could we have some example on how to pass the needed variables to configure it? Right now, how-tos for installing Green/Brownfield scenarios still show the 1 namespace support only way.

Thank you!

[draychev]

Hi @PatricioDanos
The multiple namespace support is documented here. (It sounds like we have some work to do to make this easier to discover.)

Would love to get your feedback on the document as you are going through it!

[Baklap4]

The multiple namespace support is documented here. (It sounds like we have some work to do to make this easier to discover.)

We're trying to accomplish to get applicationgateway to watch all namespaces. We tried the suggestions in the link above here are our results....
if we leave out watchNamespace as suggested in the documentation we're getting the following response

template: ingress-azure/templates/configmap.yaml:18:99: executing "ingress-azure/templates/configmap.yaml" at <.Values.kubernetes.watchNamespace>: nil pointer evaluating interface {}.watchNamespace

If we set it to an empty string we're getting the following error:

.Values.kubernetes.watchNamespace>: error calling required: A valid kubernetes watch namespace is required!

If we delete the kubernetes key we're getting a working application gateway which watches the default namespace.

We're at version 0.7.0.

If we add more than one namespace to the watchNamespace keyword (comma sperated) we're able to use multiple namespaces

configmap.yaml

# This file contains the essential configs for the ingress controller helm chart

################################################################################
# Specify which application gateway the ingress controller will manage
#
appgw:
   subscriptionId: <our subscription id>
   resourceGroup: 't-rnd-aks-weu-rg'
   name: 't-rnd-aks-weu-ag'

################################################################################
# Specify the authentication with Azure Resource Manager
#
# Two authentication methods are available:
# - Option 1: AAD-Pod-Identity (https://github.com/Azure/aad-pod-identity)
armAuth:
   type: aadPodIdentity
   identityResourceID: '/subscriptions/<our subscription id>/resourcegroups/t-rnd-aks-weu-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/t-rnd-aks-weu-mi'
   identityClientID:  <yep, client id here>

################################################################################
# Specify if the cluster is RBAC enabled or not
rbac:
   enabled: true # true/false

################################################################################
# Specify aks cluster related information
aksClusterConfiguration:
   apiServerAddress: '<uniquehostrecord>.hcp.westeurope.azmk8s.io'
kubernetes:
   watchNamespace: default,namespace1,namespace2,namespace3
   #     watchNamespace: 'default,namespace1,namespace2,namespace3'

[draychev]

@Baklap4 It looks like we need to tweak the Helm chart so that it does not require the watchNamespace key. Fix is coming!

[draychev]

@Baklap4 Also - were you able to fix the issue causing this error: F0628 13:17:57.218627 1 main.go:133] Error creating informers; Namespaces do not exist or Ingress Controller has no access to: default,namespace2,namespace3 ?

[draychev]

@Baklap4 We released version 0.7.1 which addresses the issue you discovered with the Helm template. Thank you for reporting it and thank you for sharing your workaround.
Please do continue to give us feedback on your experience with the Ingress Controller!

[Baklap4]

@Baklap4 Also - were you able to fix the issue causing this error: F0628 13:17:57.218627 1 main.go:133] Error creating informers; Namespaces do not exist or Ingress Controller has no access to: default,namespace2,namespace3 ?

We had rbac_enabled on false while deploying thus the accounts were not reachable. This was changed by turning it to true. :)

@Baklap4 We released version 0.7.1 which addresses the issue you discovered with the Helm template. Thank you for reporting it and thank you for sharing your workaround.
Please do continue to give us feedback on your experience with the Ingress Controller!

We're going to try it today :) Thanks for so far!

[Baklap4]

Thanks we deployed our app and it worked right out of the box! Thanks for the quick support!