<p>I deployed an application in an Azure K8S cluster, using NGINX as gateway, with a public static IP, based on <a href="https://learn.microsoft.com/en-us/azure/aks/static-ip" rel="nofollow noreferrer">AKS &amp; PUBLIC-IP</a> and on <a href="https://learn.microsoft.com/en-us/azure/aks/ingress-static-ip." rel="nofollow noreferrer">AKS &amp; NGINX</a>.</p>

<p>Now I need to deploy the application in an Azure private cluster, ie, running in a private vnet (see <a href="https://learn.microsoft.com/en-us/azure/aks/configure-kubenet" rel="nofollow noreferrer">CREATE PRIVATE AKS</a>); attempting to assign a public static IP to NGINX does not work, which can be expected as the load-balancer expects a private IP, not a public IP.</p>

<p>How can I provide inbound access to my app hosted in a private cluster, using NGINX and a public static IP?</p>

<p>Hi you have two ways two achieve that...Depending on your needs (and Azure costs...):</p>

<p>1-Use <a href="https://learn.microsoft.com/en-us/azure/application-gateway/configure-application-gateway-with-private-frontend-ip" rel="nofollow noreferrer">Azure Application Gateway</a>. For myself I use <a href="https://learn.microsoft.com/en-us/azure/developer/terraform/create-k8s-cluster-with-aks-applicationgateway-ingress?WT.mc_id=docs-azuredevtips-micrum" rel="nofollow noreferrer">Terraform</a>. And here you can the see official documentation regarding <a href="https://azure.github.io/application-gateway-kubernetes-ingress/features/private-ip/" rel="nofollow noreferrer">internal IP address</a>.</p>

<p>Now you can use this one as your new Ingress (and get rid of NGINX) like:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: guestbook
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: frontend
          servicePort: 80
</code></pre>

<p>Or you could use NGINX internally as your ingress like explained on option 2.</p>

<p>2- First you must have a Public IP with a Load Balancer associated with it.The backend from that LB must be up to your needs.</p>

<p>But here is the trick...Do not create NGINX with that public IP but with an internal IP and an internal load balancer, you can see how to do that in the following url:</p>

<p><a href="https://learn.microsoft.com/en-us/azure/aks/ingress-internal-ip" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/ingress-internal-ip</a></p>

<p>And the important thing you must do is the nginx ovveride on the helm parameters:</p>

<pre><code>controller:
  service:
    loadBalancerIP: 10.240.0.42
    annotations:
      service.beta.kubernetes.io/azure-load-balancer-internal: "true"
</code></pre>

<p>Of course the internal VNET must be created an the load balancer IP must be a correct one.</p>

<p>And the final trick now that you have NGINX listening behind a private IP is to verify your traffic from the Public IP <strong>is redirected</strong> to that internal VNET...Of course it depends on how you have infrastructure setup behind that LB that holds the public IP.</p>
