Application-gateway-kubernetes-ingress: Enable the annotations to modify App gateway "rewrite" section from AGIC.

[porrascarlos802018]

We have a need to use the section called "rewrite' inside an application gateway , but every single update done by AGIC in yaml , will overwrite the values listed in the application gateway.

Which annotations or methods can be used to update from AGIC the section rewrite of the application gateway?

We have an alternative which is NGINX https://docs.microsoft.com/en-us/azure/application-gateway/tutorial-http-header-rewrite-powershell#specify-your-http-header-rewrite-rule-configuration , but , can the same be done using AGIC?

[ryandanieldonovan]

I believe I'm interested in something similar. I have a constructed rewrite set, which I apply to each of the routing rules into the ingress. I'm noticing that if a pod comes alive on a different node (IP address changes?), the applied Rewrite rules will be undone. (won't apply to the routing rules associated to the listerener/backend target). I assume we need an annotation which dictates any known ReWrite rules to apply as part of the ingress yaml/config.

Are you referring to something similar?

[hueseyinkilic]

Hey, thanks for submitting this issue @porrascarlos802018

I happen to be in a similar situation as @ryandanieldonovan

I have 1 rewrite set with actions (mainly Headers, such as: Server Header, XSS Protection, HSTS and CORS) applying on all (6) URLs I'm serving on my Application Gateway.

On every Kubernetes Deployment / Upgrade (new Pods starting up, with new IPs), I need to manually remap the rewriting rules inside Azure Portal

[Vishal2696]

@akshaysngupta I believe this can be achieved through the existing ProhibitedTarget feature itself, isn't it?

[jz-wilson]

Using ProhibitedTarget doesn't work if new pods are created since the backend pool IP will not get updated. Its not very feasible to use AGIC unless we can specify the ip range of the pods IPs and set them all manually one by one in the App Gateway or we can add the rewrite feature.

[MarcelT-NL]

I have the same problem as @hueseyinkilic. We use App Gw to add security headers, but every AGIC update destroys the link between the rewrite rules and the listeners.

I even tried listing the listeners using PowerShell and re-assign the rewrite rules, but because AGIC assigns listeners to the same port on App Gw, you cannot edit/assign rewrite rules.

@Vishal2696 How can we keep the rewrite rules assigned to a domain or listener, after AGIC updates the app gw?

[jz-wilson]

I got around this by using prohibited targets to prevent AGIC from updating the gateway. Then use Azure DevOps to check the pod IPs with kubectl for my pod and then update them through az cli.

Note: If you have pods being removed manually or through other means and not through a release, the IPs will be off.

[pbloigu]

This is relevant to my interests too. As it stands, using AGIC cripples Application Gateway by effectively preventing the use of one of the key features.

It seems that issues https://github.com/Azure/application-gateway-kubernetes-ingress/issues/1058 and https://github.com/Azure/application-gateway-kubernetes-ingress/issues/1066 might be related to this issue.

[MarcelT-NL]

I got around this by using prohibited targets to prevent AGIC from updating the gateway. Then use Azure DevOps to check the pod IPs with kubectl for my pod and then update them through az cli.

Note: If you have pods being removed manually or through other means and not through a release, the IPs will be off.

This workaround will fail if AKS scales and adds/removes nodes.

[bkarakashev]

Any ETA on this?

[Gh0s7]

We're trying to move from NGINX and have a fully managed solution for some of our clients, this is crucial for us.

[cdgipson]

This is a requirement for us as well. Much needed.

[mark-nexplore]

We have problem with this also as it we have no choice in AGIC to use proxies and wanting to do the rewrite in Application Gateway but not able to at the moment. So definitely love to have this feature!

[MarcelT-NL]

@akshaysngupta are there any plans to fix this? We get red lights in our pentest reports because we cannot keep the rewrite rules after an AGIC update. We have. Approximately 80 listeners and autoscaling AKS, so manually assigning the rewrite sets after an AGIC update is impossible.

[andrejbrummelhuis]

Any ETA on a feasible solution for this?

[javiermarasco]

Is this of any help?
https://azure.github.io/application-gateway-kubernetes-ingress/annotations/#backend-path-prefix

Using this annotation in your ingress should allow the rewrite:

appgw.ingress.kubernetes.io/backend-path-prefix: "/test/"

[MarcelT-NL]

Using this annotation in your ingress should allow the rewrite:
appgw.ingress.kubernetes.io/backend-path-prefix: "/test/"

my use case is:
Add security headers for HTTPS://domain and different ones for HTTP://domain
... for a lot of listeners

[ryandanieldonovan]

Is this of any help?
https://azure.github.io/application-gateway-kubernetes-ingress/annotations/#backend-path-prefix

Using this annotation in your ingress should allow the rewrite:

appgw.ingress.kubernetes.io/backend-path-prefix: "/test/"

We would be already using this. Ideally, an annotation to indicate which named re-write rule to apply to the ingress

annotations:
kubernetes.io/ingress.class: azure/application-gateway
appgw.ingress.kubernetes.io/appgw-ssl-certificate: "ourinstalledcert"
appgw.ingress.kubernetes.io/backend-path-prefix: "/ourpath/"

[bweitjensES]

We would like to be able to either create rewrite sets, or assign any rewrite set created in the application gateway (https://docs.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-portal) to our AGIC rules.

For our use case we need to rewrite Cache-Control HTTP headers.

[bweitjensES]

I was discussing this topic with a colleague, and he found issue https://github.com/Azure/application-gateway-kubernetes-ingress/issues/462, which is committed, but has been idle for a while.
Are these not duplicates?