<p>I've just finished setting up AKS with AGIC and using Azure CNI. I'm trying to deploy  NGINX to test if I set the AKS up correctly with the following configuration:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    kubernetes.io/ingress.allow-http: &quot;false&quot;
    appgw.ingress.kubernetes.io/use-private-ip: &quot;false&quot; 
    appgw.ingress.kubernetes.io/override-frontend-port: &quot;443&quot;
spec:
  tls:
    - hosts:
        - my.domain.com
      secretName: aks-ingress-tls
  rules:
    - host: my.domain.com
      http:
          paths:
          - path: /
            pathType: Prefix 
            backend:
              service:
                name: nginx-service
                port:
                  number: 80
</code></pre>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      component: nginx
  template:
    metadata:
      labels:
        component: nginx
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
            - containerPort: 80
</code></pre>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  type: ClusterIP
  selector:
    component: nginx
  ports:
    - port: 80
      protocol: TCP
</code></pre>
<p>There's no error or any other log message on apply the above configurations.</p>
<pre class="lang-bash prettyprint-override"><code>&gt; k apply -f nginx-test.yml
deployment.apps/nginx-deployment created
service/nginx-service created
ingress.networking.k8s.io/nginx-ingress created
</code></pre>
<hr />
<p>But after a further investigation in the Application Gateway I found these entries in the Activity log popped up at the same time I applied the said configuration.</p>
<p><a href="https://i.stack.imgur.com/RbXI6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RbXI6.png" alt="Activity log in AGIC" /></a></p>
<p>Further details in one of the entries is as follows:</p>
<ul>
<li><strong>Operation name</strong>: Create or Update Application Gateway</li>
<li><strong>Error code</strong>: RequestDisallowedByPolicy</li>
<li><strong>Message</strong>: Resource 'my-application-gateway' was disallowed by policy.
<pre class="lang-json prettyprint-override"><code>[
  {
    &quot;policyAssignment&quot;: {
      &quot;name&quot;: &quot;Encryption In Transit&quot;,
      &quot;id&quot;: &quot;/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policyAssignments/EncryptionInTransit&quot;
    },
    &quot;policyDefinition&quot;: {
      &quot;name&quot;: &quot;HTTPS protocol only on Application Gateway listeners&quot;,
      &quot;id&quot;: &quot;/providers/microsoft.management/managementgroups/***/providers/Microsoft.Authorization/policyDefinitions/HttpsOnly_App_Gateways&quot;
    },
    &quot;policySetDefinition&quot;: {
      &quot;name&quot;: &quot;Encryption In Transit&quot;,
      &quot;id&quot;: &quot;/providers/Microsoft.Management/managementgroups/***/providers/Microsoft.Authorization/policySetDefinitions/EncryptionInTransit&quot;
    }
  }
]
</code></pre>
</li>
</ul>
<p>My organization have a policy to enforce TLS but from my configuration I'm not sure what I did wrong as I have already configured the ingress to only use HTTPS and also have certificate (from the secret) installed.</p>
<p>I'm not sure where to look and wish someone could guide me in the correct direction. Thanks!</p>

<p>•   As you said, your organization has a <strong>policy for enforcing TLS for securing encrypted communication over HTTPS</strong>. Therefore, when you create an <strong>‘NGINX’ deployment through the ‘yaml’ file posted</strong>, you can see that the <strong>nginx application is trying to connect to the application gateway ingress controller over Port 80 which is reserved for HTTP communications. Thus, your nginx application has also disallowed the usage of private IPs with the AGIC due to which the nginx application is directly overriding the HTTPS 443 port for reaching out to the domain ‘my.domain.com’ over port 80 without using the SSL/TLS certificate-based port for communication</strong>.</p>
<p>Thus, would suggest you to please <em><strong>configure NGINX application for port 443 as the frontend port for the cluster IP and ensure ‘SSL redirection’ is set to enabled due to which when the NGINX application is deployed</strong></em>, it will be not face the policy restrictions and get failed. Also, refer to the below snapshot of the listeners in application gateway and load balancer when provisioning an AGIC for an AKS cluster.</p>
<p><a href="https://i.stack.imgur.com/lpx4N.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/lpx4N.png" alt="AKS application gateway backend port" /></a></p>
<p><a href="https://i.stack.imgur.com/QJNYT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QJNYT.png" alt="AKS application gateway frontend port" /></a></p>
<p>Also, for more detailed information on deploying the NGINX application in AKS cluster on ports, kindly refer to the below documentation link: -</p>
<p><strong><a href="https://learn.microsoft.com/en-us/azure/aks/ingress-basic?tabs=azure-cli" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/ingress-basic?tabs=azure-cli</a></strong></p>
