Application-gateway-kubernetes-ingress: Issue using both public and private listener with different ports

[InsOpDe]

Describe the bug
I have Ingresses on Port 80 and 443 which are public. Now I am trying to create an Ingress for private-Ips. I know that I cannot reuse 80 and 443 for that, so I am trying to use different ports but with no success.

I am getting following Error:

E1126 13:22:55.640499 1 frontend_listeners.go:47] Can't assign port fp-80 to Private IP Listener fl-kiali.cloud.example.com-80-privateip; already assigned to Public IP Listener fl-admin-portal.cloud.example.com-80; Will not create listener {FrontendPort:80 HostName:kiali.cloud.example.com UsePrivateIP:true}

To Reproduce
Just apply both ingress-resources with their appurtenant services and deployments

Ingress Controller details

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    appgw.ingress.kubernetes.io/use-private-ip: "true"
    kubernetes.io/ingress.class: azure/application-gateway
  name: kiali
  namespace: istio-system
spec:
  rules:
  - host: kiali.cloud.example.com
    http:
      paths:
      - backend:
          serviceName: kiali
          servicePort: 20001
status:
  loadBalancer: {}

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    appgw.ingress.kubernetes.io/backend-path-prefix: /
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/acme-challenge-type: http01
    cert-manager.io/cluster-issuer: letsencrypt-staging
    kubernetes.io/ingress.class: azure/application-gateway
  name: admin-portal
  namespace: istio-system
spec:
  rules:
  - host: admin-portal.cloud.example.com
    http:
      paths:
      - backend:
          serviceName: istio-ingressgateway
          servicePort: 80
  tls:
  - hosts:
    - admin-portal.cloud.example.com
    secretName: admin-portal-staging
status:
  loadBalancer: {}

[akshaysngupta]

1. Ingress admin-portal has appgw.ingress.kubernetes.io/ssl-redirect: "true". So, AGIC will try to create a listener tied to public IP at port 80.
2. For Ingress kiali, AGIC will try to create a listener tied to private IP at port 80.

Unfortunately, Application Gateway doesn't support public/private IPs on same port. But the great news is that we are already working on removing this limitation and should be able to share some update soon.

[InsOpDe]

For Ingress kiali, AGIC will try to create a listener tied to private IP at port 80.

Why does AGIC create a listener on port 80 and not port 20001, since I explicitly stated that kiali should use service port 20001?

[akshaysngupta]

In Ingress resource, convention is to expose a service on either port 80 or 443. 443 is used when TLS is specified, otherwise, port 80 is used on the frontend.
We are planning to add an annotation by which you can specify frontend port to use on the gateway. I don't have an ETA yet.

[InsOpDe]

Thank you, both approaches would suffice!

[patrickheinzelmann]

@akshaysngupta Any updates on this topic?

[mhsh64]

@akshaysngupta
It seems this is high priority requirement, I found so many issues and requests and feedbacks on Azure to make appGw capable using same ports for public and private frontend ip
Do we have any ETA for it please?

[srikanthnd]

1. Ingress admin-portal has appgw.ingress.kubernetes.io/ssl-redirect: "true". So, AGIC will try to create a listener tied to public IP at port 80.
2. For Ingress kiali, AGIC will try to create a listener tied to private IP at port 80.

Unfortunately, Application Gateway doesn't support public/private IPs on same port. But the great news is that we are already working on removing this limitation and should be able to share some update soon.

Is there any update on this? This is kind of blocking for us that it doesn't support same ports on Public and Private Frontends.

[rohit-eaisystems]

In Ingress resource, convention is to expose a service on either port 80 or 443. 443 is used when TLS is specified, otherwise, port 80 is used on the frontend.
We are planning to add an annotation by which you can specify frontend port to use on the gateway. I don't have an ETA yet.

Hi any developments on it yet? we are also facing same issue like support reaching same ports on Public and Private Frontends.

[Adel-E]

@akshaysngupta do you have any update about this issue ? Maybe it's a duplicate of another one where we can follow the updates ?