<p>I am trying to create a AKS Kubernetes cluster with <code>ingress_application_gateway</code> add-on which will create an Application Gateway. I am using <code>terraform</code> to create this. Please refer to my terraform code below.</p>
<pre><code>resource &quot;azurerm_kubernetes_cluster&quot; &quot;k8s_cluster&quot; {
  
  . . . 

  private_cluster_enabled = true
  

  ingress_application_gateway {
    gateway_name = &quot;${var.cluster_name}-agic&quot;
    subnet_cidr = &quot;172.29.20.0/22&quot; 
  }


  . . . 

}
</code></pre>
<p>And above code will create a Cluster with AGIC (Application Gateway Ingress Controller) installed.</p>
<p>So far everything is working fine.</p>
<p>Then I try to deploy an application with an <code>ingress</code> as below:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: aspnetapp
  labels:
    app: aspnetapp
spec:
  containers:
  - image: nginx
    name: aspnetapp-image
    ports:
    - containerPort: 80
      protocol: TCP

---

apiVersion: v1
kind: Service
metadata:
  name: aspnetapp
spec:
  selector:
    app: aspnetapp
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minimal-ingress
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/use-private-ip: &quot;true&quot;  
spec:
  rules:
  - host: foo.bar.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: aspnetapp
            port:
              number: 80
</code></pre>
<p>This will create a <code>pod</code>, a <code>service</code>, and an <code>ingress</code> as expected.</p>
<p><strong>But I need this pod to be internal (that it should be exposed through an ingress with a private IP)</strong> and that's the reason why I have put <code>appgw.ingress.kubernetes.io/use-private-ip: &quot;true&quot;</code> in the Ingress annotations.</p>
<p>But I get the following error:</p>
<blockquote>
<p>'Warning' reason: 'NoPrivateIP' ignoring Ingress default/minimal-ingress as it requires Application Gateway test-svg-cluster-agic has a private IP address</p>
</blockquote>
<p>This is because the Application Gateway Created when the ingress is created doesn't have a Private IP.</p>
<p>But also it is not possible to set these conditions (that the application gateway creates by the ingress should have a private ip along with the public ip) in the <code>terraform</code> as well, because all the supporting parameters for the <code>ingress_application_gateway</code> block is as follows:</p>
<ul>
<li><p>gateway_id - The ID of the Application Gateway to integrate with the ingress controller of this Kubernetes Cluster.</p>
</li>
<li><p>gateway_name - The name of the Application Gateway to be used or created in the Nodepool Resource Group, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.</p>
</li>
<li><p>subnet_cidr - The subnet CIDR to be used to create an Application Gateway, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.</p>
</li>
<li><p>subnet_id - ID of the subnet</p>
</li>
</ul>
<p>How can I specify in the <code>terraform</code> code so when an ingress is created, the <code>AGIC</code> will provision an application gateway also with a private IP instead of just having a public IP?</p>
<p>Can someone please help me?</p>

Jananath Banuka
<p>Then you need to create the application gateway with an azurerm_application_gateway resource, then reference it with the gateway_id property of the ingress_application_gateway block.</p>
