<p>I've created a Kubernetes cluster in Azure using the following Terraform</p>
<pre><code># Locals block for hardcoded names
locals {
  backend_address_pool_name      = &quot;appgateway-beap&quot;
  frontend_port_name             = &quot;appgateway-feport&quot;
  frontend_ip_configuration_name = &quot;appgateway-feip&quot;
  http_setting_name              = &quot;appgateway-be-htst&quot;
  listener_name                  = &quot;appgateway-httplstn&quot;
  request_routing_rule_name      = &quot;appgateway-rqrt&quot;
  app_gateway_subnet_name        = &quot;appgateway-subnet&quot;
}

data &quot;azurerm_subnet&quot; &quot;aks-subnet&quot; {
  name                 = &quot;aks-subnet&quot;
  virtual_network_name = &quot;np-dat-spoke-vnet&quot;
  resource_group_name  = &quot;ipz12-dat-np-connect-rg&quot;
}

data &quot;azurerm_subnet&quot; &quot;appgateway-subnet&quot; {
  name                 = &quot;appgateway-subnet&quot;
  virtual_network_name = &quot;np-dat-spoke-vnet&quot;
  resource_group_name  = &quot;ipz12-dat-np-connect-rg&quot;
}

# Create Resource Group for Kubernetes Cluster
module &quot;resource_group_kubernetes_cluster&quot; {
  source                  = &quot;./modules/resource_group&quot;
  count                   = var.enable_kubernetes == true ? 1 : 0
  #name_override          = &quot;rg-aks-spoke-dev-westus3-001&quot;
  app_or_service_name     = &quot;aks&quot;                                   # var.app_or_service_name
  subscription_type       = var.subscription_type                   # &quot;spoke&quot;   
  environment             = var.environment                         # &quot;dev&quot;    
  location                = var.location                            # &quot;westus3&quot;
  instance_number         = var.instance_number                     # &quot;001&quot;    
  tags                    = var.tags
}

resource &quot;azurerm_user_assigned_identity&quot; &quot;identity_uami&quot; {
  location            = var.location
  name                = &quot;appgw-uami&quot;
  resource_group_name = module.resource_group_kubernetes_cluster[0].name
}

# Application Gateway Public Ip 
resource &quot;azurerm_public_ip&quot; &quot;test&quot; {
  name                = &quot;publicIp1&quot;
  location            = var.location
  resource_group_name = module.resource_group_kubernetes_cluster[0].name
  allocation_method   = &quot;Static&quot;
  sku                 = &quot;Standard&quot;
}

resource &quot;azurerm_application_gateway&quot; &quot;network&quot; {
  name                = var.app_gateway_name
  resource_group_name = module.resource_group_kubernetes_cluster[0].name
  location            = var.location

  sku {
    name     = var.app_gateway_sku
    tier     = &quot;Standard_v2&quot;
    capacity = 2
  }

  identity {
    type = &quot;UserAssigned&quot;
    identity_ids = [
      azurerm_user_assigned_identity.identity_uami.id
    ]
  }

  gateway_ip_configuration {
    name      = &quot;appGatewayIpConfig&quot;
    subnet_id = data.azurerm_subnet.appgateway-subnet.id
  }

  frontend_port {
    name = local.frontend_port_name
    port = 80
  }

  frontend_port {
    name = &quot;httpsPort&quot;
    port = 443
  }

  frontend_ip_configuration {
    name                 = local.frontend_ip_configuration_name
    public_ip_address_id = azurerm_public_ip.test.id
  }

  backend_address_pool {
    name = local.backend_address_pool_name
  }

  backend_http_settings {
    name                  = local.http_setting_name
    cookie_based_affinity = &quot;Disabled&quot;
    port                  = 80
    protocol              = &quot;Http&quot;
    request_timeout       = 1
  }

  http_listener {
    name                           = local.listener_name
    frontend_ip_configuration_name = local.frontend_ip_configuration_name
    frontend_port_name             = local.frontend_port_name
    protocol                       = &quot;Http&quot;
  }

  request_routing_rule {
    name                       = local.request_routing_rule_name
    rule_type                  = &quot;Basic&quot;
    http_listener_name         = local.listener_name
    backend_address_pool_name  = local.backend_address_pool_name
    backend_http_settings_name = local.http_setting_name
    priority                   = 100
  }

  tags = var.tags

  depends_on = [azurerm_public_ip.test]

  lifecycle {
    ignore_changes = [
      backend_address_pool,
      backend_http_settings,
      request_routing_rule,
      http_listener,
      probe,
      tags,
      frontend_port
    ]
  }
}

# Create the Azure Kubernetes Service (AKS) Cluster
resource &quot;azurerm_kubernetes_cluster&quot; &quot;kubernetes_cluster&quot; {
  count                         = var.enable_kubernetes == true ? 1 : 0
  name                          = &quot;aks-prjx-${var.subscription_type}-${var.environment}-${var.location}-${var.instance_number}&quot;    
  location                      = var.location
  resource_group_name           = module.resource_group_kubernetes_cluster[0].name  # &quot;rg-aks-spoke-dev-westus3-001&quot;
  dns_prefix                    = &quot;dns-aks-prjx-${var.subscription_type}-${var.environment}-${var.location}-${var.instance_number}&quot; #&quot;dns-prjxcluster&quot;
  private_cluster_enabled       = false
  local_account_disabled        = true

  default_node_pool {
    name                        = &quot;npprjx${var.subscription_type}&quot; #&quot;prjxsyspool&quot; # NOTE: &quot;name must start with a lowercase letter, have max length of 12, and only have characters a-z0-9.&quot;
    vm_size                     = &quot;Standard_B8ms&quot;
    vnet_subnet_id              = data.azurerm_subnet.aks-subnet.id
    # zones                     = [&quot;1&quot;, &quot;2&quot;, &quot;3&quot;]
    enable_auto_scaling         = true
    max_count                   = 3
    min_count                   = 1
    # node_count                = 3
    os_disk_size_gb             = 50
    type                        = &quot;VirtualMachineScaleSets&quot;
    enable_node_public_ip       = false
    enable_host_encryption      = false

    node_labels = {
      &quot;node_pool_type&quot;          = &quot;npprjx${var.subscription_type}&quot;
      &quot;node_pool_os&quot;            = &quot;linux&quot;
      &quot;environment&quot;             = &quot;${var.environment}&quot;
      &quot;app&quot;                     = &quot;prjx_${var.subscription_type}_app&quot;
    }
    tags = var.tags
  }

  ingress_application_gateway {
    gateway_id = azurerm_application_gateway.network.id
  }

  # Enabled the cluster configuration to the Azure kubernets with RBAC
  azure_active_directory_role_based_access_control { 
    managed                     = true
    admin_group_object_ids      = var.active_directory_role_based_access_control_admin_group_object_ids
    azure_rbac_enabled          = true #false
  }

  network_profile {
    network_plugin              = &quot;azure&quot;
    network_policy              = &quot;azure&quot;
    outbound_type               = &quot;userDefinedRouting&quot;
  }

  identity {
    type = &quot;SystemAssigned&quot;
  }  

  oms_agent {
    log_analytics_workspace_id  = module.log_analytics_workspace[0].id
  }

  timeouts {
    create = &quot;20m&quot;
    delete = &quot;20m&quot;
  }

  depends_on = [
    azurerm_application_gateway.network
  ]
}
</code></pre>
<p>and provided the necessary permissions</p>
<pre><code># Get the AKS Agent Pool SystemAssigned Identity
data &quot;azurerm_user_assigned_identity&quot; &quot;aks-identity&quot; {
  name                = &quot;${azurerm_kubernetes_cluster.kubernetes_cluster[0].name}-agentpool&quot;
  resource_group_name = &quot;MC_${module.resource_group_kubernetes_cluster[0].name}_aks-prjx-spoke-dev-eastus-001_eastus&quot;
}

# Get the AKS SystemAssigned Identity
data &quot;azuread_service_principal&quot; &quot;aks-sp&quot; {
  display_name  = azurerm_kubernetes_cluster.kubernetes_cluster[0].name
}

# Provide ACR Pull permission to AKS SystemAssigned Identity
resource &quot;azurerm_role_assignment&quot; &quot;acrpull_role&quot; {
  scope                            = module.container_registry[0].id
  role_definition_name             = &quot;AcrPull&quot;
  principal_id                     = data.azurerm_user_assigned_identity.aks-identity.principal_id
  skip_service_principal_aad_check = true

  depends_on                       = [
    data.azurerm_user_assigned_identity.aks-identity
  ]
}

resource &quot;azurerm_role_assignment&quot; &quot;aks_id_network_contributor_subnet&quot; {
  scope                = data.azurerm_subnet.aks-subnet.id
  role_definition_name = &quot;Network Contributor&quot;
  principal_id         = data.azurerm_user_assigned_identity.aks-identity.principal_id

  depends_on = [data.azurerm_user_assigned_identity.aks-identity]
}

resource &quot;azurerm_role_assignment&quot; &quot;akssp_network_contributor_subnet&quot; {
  scope                = data.azurerm_subnet.aks-subnet.id
  role_definition_name = &quot;Network Contributor&quot;
  principal_id         = data.azuread_service_principal.aks-sp.object_id

  depends_on = [data.azuread_service_principal.aks-sp]
}

resource &quot;azurerm_role_assignment&quot; &quot;aks_id_contributor_agw&quot; {
  scope                = data.azurerm_subnet.appgateway-subnet.id
  role_definition_name = &quot;Network Contributor&quot;
  principal_id         = data.azurerm_user_assigned_identity.aks-identity.principal_id

  depends_on = [data.azurerm_user_assigned_identity.aks-identity]
}

resource &quot;azurerm_role_assignment&quot; &quot;akssp_contributor_agw&quot; {
  scope                = data.azurerm_subnet.appgateway-subnet.id
  role_definition_name = &quot;Network Contributor&quot;
  principal_id         = data.azuread_service_principal.aks-sp.object_id

  depends_on = [data.azuread_service_principal.aks-sp]
}

resource &quot;azurerm_role_assignment&quot; &quot;aks_ingressid_contributor_on_agw&quot; {
  scope                            = azurerm_application_gateway.network.id
  role_definition_name             = &quot;Contributor&quot;
  principal_id                     = azurerm_kubernetes_cluster.kubernetes_cluster[0].ingress_application_gateway[0].ingress_application_gateway_identity[0].object_id
  depends_on                       = [azurerm_application_gateway.network,azurerm_kubernetes_cluster.kubernetes_cluster]
  skip_service_principal_aad_check = true
}

resource &quot;azurerm_role_assignment&quot; &quot;aks_ingressid_contributor_on_uami&quot; {
  scope                            = azurerm_user_assigned_identity.identity_uami.id
  role_definition_name             = &quot;Contributor&quot;
  principal_id                     = azurerm_kubernetes_cluster.kubernetes_cluster[0].ingress_application_gateway[0].ingress_application_gateway_identity[0].object_id
  depends_on                       = [azurerm_application_gateway.network,azurerm_kubernetes_cluster.kubernetes_cluster]
  skip_service_principal_aad_check = true
}

resource &quot;azurerm_role_assignment&quot; &quot;uami_contributor_on_agw&quot; {
  scope                            = azurerm_application_gateway.network.id
  role_definition_name             = &quot;Contributor&quot;
  principal_id                     = azurerm_user_assigned_identity.identity_uami.principal_id
  depends_on                       = [azurerm_application_gateway.network,azurerm_user_assigned_identity.identity_uami]
  skip_service_principal_aad_check = true
}
</code></pre>
<p>and deployed the below mentioned application</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: aks-helloworld 
spec:
  replicas: 1
  selector:
    matchLabels:
      app: aks-helloworld-two
  template:
    metadata:
      labels:
        app: aks-helloworld-two
    spec:
      containers:
      - name: aks-helloworld-two
        image: mcr.microsoft.com/azuredocs/aks-helloworld:v1
        ports:
        - containerPort: 80
        env:
        - name: TITLE
          value: &quot;AKS Ingress Demo&quot;
---
apiVersion: v1
kind: Service
metadata:
  name: aks-helloworld 
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: aks-helloworld-two
</code></pre>
<p><a href="https://i.stack.imgur.com/4tU3n.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/4tU3n.png" alt="enter image description here" /></a></p>
<p>External IP got assigned</p>
<p><a href="https://i.stack.imgur.com/YOOZQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/YOOZQ.png" alt="enter image description here" /></a></p>
<p>however I am not able to access the External IP</p>
<p><a href="https://i.stack.imgur.com/bjuDM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bjuDM.png" alt="enter image description here" /></a></p>
<p><strong>Note:</strong> I have not deployed any Ingress controller separately like mentioned in the <a href="https://NAMESPACE=ingress-basic%20%20helm%20repo%20add%20ingress-nginx%20https://kubernetes.github.io/ingress-nginx%20helm%20repo%20update%20%20helm%20install%20ingress-nginx%20ingress-nginx/ingress-nginx%20%5C%20%20%20--create-namespace%20%5C%20%20%20--namespace%20$NAMESPACE%20%5C%20%20%20--set%20controller.service.annotations.%22service%5C.beta%5C.kubernetes%5C.io/azure-load-balancer-health-probe-request-path%22=/healthz" rel="nofollow noreferrer">Microsoft Article</a> as I am not sure this is required</p>

One Developer
<p><strong>I tried to reproduce the same in my environment to create Kubernetes Service Cluster with Application Gateway:</strong></p>
<p>Follow the <a href="https://stackoverflow.com/questions/75154385/aks-loadbalancer-external-ip-stuck-on-pending/75159961#75159961">Stack link</a>  to create <strong>Kubernetes Service Cluster</strong> with <strong>Ingress Application Gateway</strong>.</p>
<p>If you are unable to access your application using external Load balancer IP after deployment in <strong>Azure Kubernetes Service (AKS)</strong>, Verify the below setting in <strong>AKS Cluster</strong>.</p>
<p>1.check the status of the load balancer using the below cmd.</p>
<pre><code>kubectl get service &lt;your service name&gt;
</code></pre>
<p>Make sure that the <strong>External -IP</strong> field is not set to <strong>Pending</strong> state.</p>
<p><img src="https://i.stack.imgur.com/x3a4A.png" alt="enter image description here" /></p>
<ol start="2">
<li>Verify the security group associated with the load balancer. Make sure that the security group allows traffic on the desired port.</li>
</ol>
<p>Kindly follow the below steps to check <strong>NSG Security</strong> rules in <strong>AKS</strong> cluster.</p>
<p><strong>Go to Azure Portal &gt; Kubernetes services &gt; Select your Kubernetes services&gt; Properties &gt; Select your resource group under Infrastructure resource group &gt; overview &gt; Select your NSG Group.</strong></p>
<p><img src="https://i.stack.imgur.com/u661X.png" alt="enter image description here" /></p>
<p>I have disabled inbound <strong>http</strong> rule in <strong>Network Security Group</strong> for testing, got the same error.</p>
<p><img src="https://i.stack.imgur.com/vkI9h.png" alt="enter image description here" /></p>
<p>Application status, once disable the <strong>Port</strong> 80 in <strong>NSG</strong>.</p>
<p><img src="https://i.stack.imgur.com/GELUH.png" alt="enter image description here" /></p>
<ol start="3">
<li>check the routing rules on your virtual network. Make sure that traffic is being forwarded from the load balancer.</li>
</ol>
<p><img src="https://i.stack.imgur.com/4QjNX.png" alt="enter image description here" /></p>
