<p><strong>Setup</strong>:</p>
<ul>
<li>Azure Kubernetes Service</li>
<li>Azure Application Gateway</li>
</ul>
<p>We have kubernetes cluster in Azure which uses Application Gateway for managing network trafic. We are using appgw over Load Balancer because we need to handle trafic at layer 7, hence path-based http rules. We use kubernetes ingress controller for configuring appgw. See config below.</p>
<p>Now I want a service that both accept requests on HTTP (layer 7) and TCP (layer  4).</p>
<p>How do I do that? The exposed port should not be public on the big internet, but public on the azure network. Do I need to add another Ingress Controller that is not configured to use appgw?</p>
<p>This is what I want to accomplish:
<a href="https://i.stack.imgur.com/oDJVd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/oDJVd.png" alt="enter image description here" /></a></p>
<p>This is the config for the ingress controller using appgw:</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: service1
  labels:
    app: service1
  annotations:
    appgw.ingress.kubernetes.io/backend-path-prefix: /
    appgw.ingress.kubernetes.io/use-private-ip: &quot;false&quot;
    kubernetes.io/ingress.class: azure/application-gateway
spec:
  tls:
    - hosts:
      secretName: &lt;somesecret&gt;
  rules:
    - host: &lt;somehost&gt;
      http:
        paths:
          - path: /service1/*
            backend:
              serviceName: service1
              servicePort: http
</code></pre>
<p>Current setup:
<a href="https://i.stack.imgur.com/nn3xt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/nn3xt.png" alt="enter image description here" /></a></p>

Michael
<p>Generally you have two straightforward options.</p>
<hr />
<p>Use direct pod IP or Headless ClusterIP Service.</p>
<p>I assume your AKS cluster employs either Azure CNI or Calico as a networking fabric.<br />
In both cases <strong>your Pods get routable ips in AKS subnet</strong>.<br />
<a href="https://learn.microsoft.com/en-us/azure/aks/concepts-network#azure-cni-advanced-networking" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/concepts-network#azure-cni-advanced-networking</a><br />
Thus, you can make them accessible directly across your VNet.</p>
<hr />
<p>Alternatively, you could use Service of type Internal Load Balancer.<br />
You can build Internal LB thru appropriate annotations.</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: &quot;true&quot;
spec:
  type: LoadBalancer
</code></pre>
<p><em>When you view the service details, the IP address of the internal load balancer is shown in the EXTERNAL-IP column. In this context, External is in relation to the external interface of the load balancer, not that it receives a public, external IP address.</em><br />
<a href="https://learn.microsoft.com/en-us/azure/aks/internal-lb#create-an-internal-load-balancer" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/internal-lb#create-an-internal-load-balancer</a></p>
<p>If needed, you can assign a predefined IP address to your LB and / or put it into a different subnet across your VNet or even into a private subnet, use VNet peering etc.<br />
Eventually you can make it routable from wherever you need.</p>
