<p>I am new to AKS and trying to set up the cluster and expose it via an app gateway ingress controller. While I was able to set up the cluster using az commands and was able to deploy and hit it using HTTP. I am having some challenges in enabling HTTPS over 443 in-app gateway ingress and looking to get some help.</p>
<ol>
<li>Below is our workflow and I am trying to setup app gateway listener on port 443</li>
<li>Below is the k8 we used for enabling the ingress. If I apply is without ssl cert it woks but if I give ssl cert I get a 502 bad gateway.</li>
<li>Cert is uploaded to KV and Cluster has KV add-on installed. But I am not sure how to attach this specific kv to cluster and whether the cert should be uploaded to gateway or Kubernetes.</li>
</ol>
<p><a href="https://i.stack.imgur.com/vDe9X.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vDe9X.png" alt="enter image description here" /></a></p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: frontend-web-ingress
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: workspace-dev-cluster-cert
    appgw.ingress.kubernetes.io/cookie-based-affinity: &quot;true&quot;
    appgw.ingress.kubernetes.io/request-timeout: &quot;90&quot;
    appgw.ingress.kubernetes.io/backend-path-prefix: &quot;/&quot;
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: frontend-svc
                port:
                  number: 80
</code></pre>

<p>This link can help you with KV add-on certificate on App GW: <a href="https://azure.github.io/application-gateway-kubernetes-ingress/features/appgw-ssl-certificate/" rel="nofollow noreferrer">https://azure.github.io/application-gateway-kubernetes-ingress/features/appgw-ssl-certificate/</a></p>
<p>I use different configuration to set certs on Appgw.</p>
<ol>
<li>I'm getting certificates via the <a href="https://akv2k8s.io/" rel="nofollow noreferrer">akv2k8s</a> tool. This creates secrets on k8s cluster.</li>
<li>Then I use those certs in the ingress configuration. Please check tls definition under spec.</li>
</ol>
<blockquote>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: frontend-web-ingress
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: workspace-dev-cluster-cert
    appgw.ingress.kubernetes.io/cookie-based-affinity: &quot;true&quot;
    appgw.ingress.kubernetes.io/request-timeout: &quot;90&quot;
    appgw.ingress.kubernetes.io/backend-path-prefix: &quot;/&quot;
spec:
  tls:
    - hosts:
      - yourdomain.com
      secretName: your-tls-secret-name
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: frontend-svc
                port:
                  number: 80
</code></pre>
</blockquote>
