<p>I am using Azure AKS and Application Gateway. (And get new to Kubernetes)</p>
<p>Is it possible to have a deployment/service that can only be called from other services within that cluster? But have a single endpoint exposed to the outside world?</p>
<p>E.g.
I have api end points to CRUD a record used by other services within the cluster and default namespace. None of these should be accessible from external calls.</p>
<p>BUT. There is a single GET request endpoint which is open to the public.</p>
<p>If this is possible where would the config go? In the Kubernetes yaml or some ingress rule i have to manually manage within Azure?</p>
<p>Is there any documentation? I'm not even sure what to search for</p>

user3067684
<blockquote>
<p>BUT. There is a single GET request endpoint which is open to the public.</p>
</blockquote>
<p>you can expose a specific path of the application to the external world using <code>ingress path</code>, for example, the <code>GET</code> path is <code>api/get/user/profiler</code>
you can create an ingress like this</p>
<p><a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">services-networking-ingress</a></p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: &quot;true&quot;
    nginx.ingress.kubernetes.io/server-snippet: |2
      location /internal {
        deny all;
        return 403;
      }
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
  name: myapp
  namespace: default
spec:
  rules:
  - host: mydomain.example.com
    http:
      paths:
      - backend:
          service:
            name: app
            port:
              number: 80
        path: /api/get/user
        pathType: Prefix
  tls:
  - hosts:
    - mydomain.example.com
    secretName: mydomain.example.tls
</code></pre>
<p>The client will be able to reach all path having prefix like <code>/api/get/user/profile/88</code>, but if the path is static you can convert nginx path type to <code>Exact</code></p>
<p><a href="https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types" rel="nofollow noreferrer">better-path-matching-with-path-types</a></p>
<p>within cluster, you can simply use <code>servicename.namespace:service-port/api/getuser/profile</code> and it should work inside the Kubernetes cluster.</p>
