title: Kubernetes nginx ingress-controller on Azure not reachable
body: <p>I am very new to Azure, Kubernetes, even Docker itself, and playing with the system to learn and evaluate for a possible deployment later. I have so far dockerized my services and successfully deployed them and made the web frontend publicly visible using a service with type: LoadBalancer.</p>
  
  <p>Now I would like to add TLS termination and have learned that for that I am supposed to configure an ingress controller with the most commonly mentioned one being nginx-ingress-controller.</p>
  
  <p>Strictly monkeying examples and then afterwards trying to read up on the docs I have arrived at a setup that looks interesting but does not work. Maybe some kind soul can point out my mistakes and/or give me pointers on how to debug this and where to read more about it.</p>
  
  <p>I have kubectl apply'd the following file:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Deployment
  metadata:
    name: default-http-backend-deployment
    namespace: kube-system
  spec:
    template:
      metadata:
        labels:
          app: default-http-backend
      spec:
        terminationGracePeriodSeconds: 60
        containers:
          - name: default-http-backend
            image: gcr.io/google_containers/defaultbackend:1.0
            ports:
              - containerPort: 80
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: default-http-backend-service
    namespace: kube-system
  spec:
    type: LoadBalancer
    ports:
      - port: 80
        targetPort: 80  
    selector:
      app: default-http-backend
  ---
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: nginx-ingress-controller-conf
    namespace: kube-system
  data:
    # enable-vts-status: 'true'
  ---
  apiVersion: extensions/v1beta1
  kind: Deployment
  metadata:
    name: nginx-ingress-controller-deployment
    namespace: kube-system
  spec:
    replicas: 1
    template:
      metadata:
        labels:
          app: nginx-ingress-controller
      spec:
        terminationGracePeriodSeconds: 60
        containers:
          - image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.13
            name: nginx-ingress-controller
            ports:
              - containerPort: 80
                hostPort: 80
              - containerPort: 443
                hostPort: 443
            env:
              - name: POD_NAME
                valueFrom:
                  fieldRef:
                    fieldPath: metadata.name
              - name: POD_NAMESPACE
                valueFrom:
                  fieldRef:
                    fieldPath: metadata.namespace
            args:
              - /nginx-ingress-controller
              - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
              - --configmap=$(POD_NAMESPACE)/nginx-ingress-controller-conf
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-ingress-controller-service
    namespace: kube-system
  spec:
    ports:
      - name: https
        port: 443
        protocol: TCP
        targetPort: 443
      - name: http
        port: 80
        protocol: TCP
        targetPort: 80
    selector:
      app: nginx-ingress-controller
    sessionAffinity: None
    type: LoadBalancer
  ---
  apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: nginx-ingress
    namespace: kube-system
    annotations:
      kubernetes.io/ingress.class: nginx
  spec:
    rules:
      - host: 
        http:
          paths:
            - path: /
              backend:
                serviceName: default-http-backend-service
                servicePort: 80
  </code></pre>
  
  <p>This gave me two pods:</p>
  
  <pre><code>c:\Projects\Release-Management\Azure&gt;kubectl get pods --all-namespaces
  
  NAMESPACE     NAME                                                   READY     STATUS    RESTARTS   AGE
  &lt;some lines removed&gt;
  kube-system   default-http-backend-deployment-3108185104-68xnk       1/1       Running   0          39m
  &lt;some lines removed&gt;
  kube-system   nginx-ingress-controller-deployment-4106313651-v7p03   1/1       Running   0          24s
  </code></pre>
  
  <p>Also two new services. Note that I have also configured the default-http-backend-service with type: LoadBalancer, this is for debugging only. I have included my web-frontend which is called webcms:</p>
  
  <pre><code>c:\Projects\Release-Management\Azure&gt;kubectl get services --all-namespaces
  
  NAMESPACE     NAME                               CLUSTER-IP     EXTERNAL-IP     PORT(S)                      AGE
  &lt;some lines removed&gt;
  default       webcms                             10.0.105.59    13.94.250.173   80:31400/TCP                 23h
  &lt;some lines removed&gt;
  kube-system   default-http-backend-service       10.0.106.233   13.80.68.38     80:31639/TCP                 41m
  kube-system   nginx-ingress-controller-service   10.0.33.80     13.95.30.39     443:31444/TCP,80:31452/TCP   37m
  </code></pre>
  
  <p>And finally an ingress:</p>
  
  <pre><code>c:\Projects\Release-Management\Azure&gt;kubectl get ingress --all-namespaces
  
  NAMESPACE     NAME            HOSTS     ADDRESS      PORTS     AGE
  kube-system   nginx-ingress   *         10.240.0.5   80        39m
  </code></pre>
  
  <p>No errors that I can immediately detect. I then went to the Azure Dashboard and looked at the loadbalancer and its rules and that looks good to my (seriously untrained) eye. I did not touch these, the loadbalancer and the rules were created by the system. There is a screenshot here:</p>
  
  <p><a href="https://qvwx.de/tmp/azure-loadbalancer.png" rel="nofollow noreferrer">https://qvwx.de/tmp/azure-loadbalancer.png</a></p>
  
  <p>But unfortunately it does not work. I can curl my webcms-service:</p>
  
  <pre><code>c:\Projects\Release-Management\Azure&gt;curl -v http://13.94.250.173
  * Rebuilt URL to: http://13.94.250.173/
  *   Trying 13.94.250.173...
  * TCP_NODELAY set
  * Connected to 13.94.250.173 (13.94.250.173) port 80 (#0)
  &lt;more lines removed, success&gt;
  </code></pre>
  
  <p>But neither default-http-backend nor the ingress work:</p>
  
  <pre><code>c:\Projects\Release-Management\Azure&gt;curl -v http://13.80.68.38
  * Rebuilt URL to: http://13.80.68.38/
  *   Trying 13.80.68.38...
  * TCP_NODELAY set
  * connect to 13.80.68.38 port 80 failed: Timed out
  * Failed to connect to 13.80.68.38 port 80: Timed out
  * Closing connection 0
  curl: (7) Failed to connect to 13.80.68.38 port 80: Timed out
  </code></pre>
  
  <p>(ingress gives the same with a different IP)</p>
  
  <p>If you read this far: Thank you for your time and I would appreciate any hints.</p>
  
  <p>Marian</p>