<p>I am configuring an ingress-nginx load balancer on Azure Kubernetes service. I have installed the load balancer using Helm, and set up ingress. Here is the behavior I'm encountering:</p>
<ul>
<li>When I include a host in my pathing rules in my ingress config, I cannot access service at that host URL. The request times out</li>
<li>When I don't include a host in my pathing rules, I can access the service at that host URL with no issues</li>
<li>Regardless of whether or not the host is included in the pathing rules, I can successfully access the service at the host URL when I CURL it from any pod in the cluster.</li>
<li>Nslookup successfully resolves the host on my machine</li>
</ul>
<p>I'm trying to figure out why I'm unable to reach my service when host is included in my ingress configuration. Any ideas? Technical details are below.</p>
<p>Note that the configuration is only pointing to one service currently, but filtering by host will eventually be necessary - I'm planning to have multiple services with different domains running through this load balancer.</p>
<p>Ingress controller configuration:</p>
<pre><code>helm install --replace ingress-nginx ingress-nginx/ingress-nginx \
  --create-namespace \
  --namespace $NAMESPACE \
  --set controller.service.annotations.&quot;service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path&quot;=127.0.0.1 \
  --set controller.service.annotations.&quot;service\.beta\.kubernetes\.io/azure-dns-label-name&quot;=$DNS_LABEL \
  --set controller.service.loadBalancerIP=$IP \
</code></pre>
<p>The ingress configuration:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hello-world-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - my.host.com
    secretName: tls-secret
  rules:
  - host: my.host.com //Removing this item makes the service reachable
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: xrcfrontend
            port:
              number: 80
</code></pre>
<p>This is the curl command I'm running. It returns the correct results when run inside the pod, and times out when run outside.</p>
<pre><code>curl https://my.host.com --insecure
</code></pre>

<p>If you are using AKS v&gt;=1.24, then try adding below annotation with path <strong>/healthz</strong> instead of <strong>127.0.0.1</strong> during nginx ingress controller installation or in nginx ingress controller service and use host based routing with nginx ingress routes -</p>
<blockquote>
<p>service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path&quot;=<strong>/healthz</strong></p>
</blockquote>
<p>If the above helps then
<strong>Why was it not working with host earlier?</strong></p>
<ul>
<li>because backend pool of LB goes unhealthy because of wrong health-probe path of ingress controller. Ingress route is only accepting traffic for the particular host name and hence health probe of ingress controller service(Azure LB) is failing because / or 127.0.0.1 for http protocol returns 404.</li>
</ul>
<p>Github discussion on changes - <a href="https://github.com/Azure/AKS/issues/2903#issuecomment-1115720970" rel="nofollow noreferrer">https://github.com/Azure/AKS/issues/2903#issuecomment-1115720970</a></p>
<p>More details on installation - <a href="https://learn.microsoft.com/en-us/azure/aks/ingress-basic?tabs=azure-cli#basic-configuration" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/ingress-basic?tabs=azure-cli#basic-configuration</a></p>
