<p>I enabled AGIC in the Azure portal and then created <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#simple-fanout" rel="nofollow noreferrer">Fanout Ingress</a>. But it's not working. I checked Rules (ingress-appgateway &gt; Rules &gt; Path-based routing) and paths are targeting correct backend pool.</p>
<p>When I am testing health probe, it's failing (&quot;MC_...&quot; resource group &gt; ingress-appgateway &gt; Health probes &gt; Click test) - showing error :</p>
<blockquote>
<p>One or more of your backend instances are unhealthy. It is recommended
to address this health issue first before attaching the probe</p>
</blockquote>
<p>I tried:</p>
<ul>
<li>disabling and enabling AGIC -&gt; <strong>did not work</strong></li>
<li>using <code>pathType: ImplementationSpecific</code> (instead of <code>pathType: Prefix</code>) -&gt; <strong>did not work</strong></li>
<li><code>nginx.ingress.kubernetes.io/rewrite-target: /$1</code> &amp; <code>/foo(/|$)(.*)</code> -&gt; <strong>did not work</strong></li>
</ul>
<p>At the top of the Overview page of &quot;ingress-appgateway&quot; (Azure portal), showing error:</p>
<blockquote>
<p>All the instances in one or more of your backend pools are unhealthy.
This will result in a 502 error when you try to access your
application hosted behind the Application Gateway. Please check the
backend health and resolve the issue.</p>
</blockquote>
<p>It works only If I remove paths (<code>/foo</code> &amp; <code>/bar</code>) and target a single service.</p>
<p>FYI, I am using Azure CNI networking and existing VNet (dedicated subnet).</p>
<p><code>deployment.yaml</code></p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: demo-web-app1
  namespace: demo
spec:
  selector:
    app: demo-web-app1
  type: ClusterIP
  ports:
  - protocol: TCP
    port: 4200
    targetPort: 80
    
---

apiVersion: v1
kind: Service
metadata:
  name: demo-web-app2
  namespace: demo
spec:
  selector:
    app: demo-web-app2
  type: ClusterIP
  ports:
  - protocol: TCP
    port: 8080
    targetPort: 80

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-web-app1
  namespace: demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: demo-web-app1
  template:
    metadata:
      labels:
        app: demo-web-app1
    spec:
      containers:
      - name: demo-web-app1
        image: myacr.azurecr.io/myacr6472:375
        ports:
        - containerPort: 80
        
---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-web-app2
  namespace: demo
spec:
  replicas: 3
  selector:
    matchLabels:
      app: demo-web-app2
  template:
    metadata:
      labels:
        app: demo-web-app2
    spec:
      containers:
      - name: demo-web-app2
        image: myacr.azurecr.io/myacr6472:375
        ports:
        - containerPort: 80

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-demo-web-app
  namespace: demo
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
spec:
  rules:
  - http:
      paths:
      - path: /foo
        pathType: Prefix
        backend:
          service:
            name: demo-web-app1
            port:
              number: 4200
      - path: /bar
        pathType: Prefix
        backend:
          service:
            name: demo-web-app2
            port:
              number: 8080
</code></pre>

<p><code>appgw.ingress.kubernetes.io/backend-path-prefix: /</code> solved the problem as pointed out by @Matt in the comment section.</p>
<p>I can now target multiple backend pools using different paths i.e. <code>/api</code> for API service &amp; <code>/app</code> for UI app.</p>
<p>I wrote <a href="https://hovermind.com/azure-kubernetes-service/application-gateway-ingress-controller#ingress-for-multiple-apis" rel="nofollow noreferrer">an article in my site about serving multiple APIs</a></p>
