Application Gateway Ingress Controller: 502 Bad Gateway #712

Tsovak · 2024-08-28T11:29:28Z

Tsovak
Aug 28, 2024

I'm trying to install an AKS cluster with Application Gateway Ingress Controller. But I get an 502 Bad Gateway by the following configuration.
I want to understand what I'm doing wrong and how to fix it. In the end, I want to have AGIC with letsencrypt issuer and available services from public internet

install aks az deployment group create -g az-k8s-agic--template-file aks.bicep
get a creds az aks get-credentials -g az-k8s-agic -n az-k8s-agic
install cert manager

helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.15.3 \
  --set crds.enabled=true

install letsencrypt ClusterIssuer k apply -f cluster-issuer.yaml
install a simple app aspnetapp.

trying to somehow expose the service via ingress but I get 502 Bad Gateway

 curl --header "Host: aspnetapp.xxx.com" http://<public IP> --insecure
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>Microsoft-Azure-Application-Gateway/v2</center>
</body>
</html>

aks.bicep file

@minLength(1)
@description('Primary location for all resources')
@allowed(['germanywestcentral'])
param location string

@description('Resource group name')
param resourceGroupName string = 'az-k8s-agic'

param managedNodeResourceGroup string = 'az-k8s-agic-managed-rg'

param kubernetesVersion string = '1.29.7'

@secure()
// az ad signed-in-user show --query id --out tsv
param adminPrincipalId string = '76ef1985-.....'

//---------Kubernetes Construction---------
module aksconst './aks-construction/bicep/main.bicep' = {
  name: 'aksconstruction'
  params: {
    location: location
    resourceName: resourceGroupName
    managedNodeResourceGroup: managedNodeResourceGroup
    upgradeChannel: 'stable'
    AksPaidSkuForSLA: true
    SystemPoolType: 'CostOptimised'
    agentCount: 1
    agentCountMax: 5
    custom_vnet: true
    enable_aad: true
    AksDisableLocalAccounts: true
    enableAzureRBAC: true
    adminPrincipalId:adminPrincipalId
    registries_sku: 'Premium'
    acrPushRolePrincipalId: adminPrincipalId
    omsagent: true
    retentionInDays: 30
    networkPolicy: 'azure'
    azurepolicy: 'audit'
    availabilityZones: ['1', '2', '3']
    authorizedIPRanges: ['95.91.242.204/32']
    ingressApplicationGateway: true
    appGWcount: 1
    appGWmaxCount: 10
    appGWsku: 'WAF_v2'
    appgwKVIntegration: true
    keyVaultAksCSI: true
    keyVaultCreate: true
    keyVaultOfficerRolePrincipalId: adminPrincipalId
    JustUseSystemPool: true
    agentVMSize: 'Standard_D4ds_v5'
    enablePrivateCluster: false
    kubernetesVersion: kubernetesVersion
    oidcIssuer: true
    workloadIdentity: true
  }
}

output aksClusterName string = aksconst.outputs.aksClusterName
output ApplicationGatewayName string = aksconst.outputs.ApplicationGatewayName

aspnetapp.yaml file

apiVersion: v1
kind: Pod
metadata:
  name: aspnetapp
  labels:
    app: aspnetapp
spec:
  containers:
  - image: "mcr.microsoft.com/dotnet/samples:aspnetapp"
    name: aspnetapp-image
    ports:
    - containerPort: 8080
      protocol: TCP

---

apiVersion: v1
kind: Service
metadata:
  name: aspnetapp
spec:
  selector:
    app: aspnetapp
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080

---

#apiVersion: networking.k8s.io/v1
#kind: Ingress
#metadata:
#  name: aspnetapp
#  # annotations:
#  #   kubernetes.io/ingress.class: azure/application-gateway
#spec:
#  ingressClassName: azure-application-gateway
#  rules:
#  - http:
#      paths:
#      - path: /
#        backend:
#          service:
#            name: aspnetapp
#            port:
#              number: 80
#        pathType: Exact

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: aspnetapp-https
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: azure-application-gateway
  tls:
    - hosts:
      - aspnetapp.xxx.com
      secretName: aspnetapp-tls
  rules:
  - host: "aspnetapp.xxx.com"
    http:
      paths:
      - path: /
        backend:
          service:
            name: aspnetapp
            port:
              number: 80
        pathType: Exact

Answered by Tsovak

Sep 6, 2024

this was a bug. here the solution #679

View full answer

Tsovak · 2024-09-06T14:36:15Z

Tsovak
Sep 6, 2024
Author

this was a bug. here the solution #679

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Application Gateway Ingress Controller: 502 Bad Gateway #712

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Application Gateway Ingress Controller: 502 Bad Gateway #712

Uh oh!

Tsovak Aug 28, 2024

Replies: 1 comment

Uh oh!

Tsovak Sep 6, 2024 Author

Tsovak
Aug 28, 2024

Tsovak
Sep 6, 2024
Author