Azure application gateway giving BAD Gateway 502

Question

Hi everyone,

When deploying ingress with Azure Kubernetes service with Azure Application Gateway enabled at the cluster level. The ingress controller fails to route to the back end.

Followed the documentation at https://stackoverflow.com/questions/67915527/aks-bad-gateway-502-error-when-accessing-gateway-ip to configure the annotation
kubernetes.io/ingress.class: azure/application-gateway
appgw.ingress.kubernetes.io/use-private-ip: "false"

But Still the gateway give 502.

Please find the configuration below

Am i missing something?

Regards,
Aldrine

Answer 1

Adding some additional information. the Application Gateway reports, the backend is unhealthy. But the Backend is healthy in service level.

Answer 2

Please find my configuration below:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hello-world-ingress
  namespace: dev-api
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    deployment.time: ${CI_PIPELINE_CREATED_AT}
spec:
  rules:
    - http:
        paths:
          - path: /hello
            pathType: Exact
            backend:
              service:
                name: aks-helloworld-one
                port:
                  number: 80

Additionally, the ing is listed down as

hello-world-ingress <none> * <Public IP of APP Gateway> 80 5m11s

Answer 3

Hello @Aldrine Einsteen ,
There can be many reasons for AppGW 502 errors , mainly if the backend health shows as 'unhealthy' in appgw:

• Can you check if readiness probe or liveness probe was defined in your application ?
• If they are defined just make sure the path of those probes is correct.

From the document: https://azure.github.io/application-gateway-kubernetes-ingress/features/probes/

• readinessProbe and livenessProbe are supported when configured with httpGet.
• Probing on a port other than the one exposed on the pod is currently not supported.
• HttpHeaders, InitialDelaySeconds, SuccessThreshold are not supported.

Have a look at : https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-troubleshooting-502

Can you try out the below mentioned sample YAML files :
https://learn.microsoft.com/en-us/azure/aks/ingress-tls?tabs=azure-cli

If you are still facing the issue, please post below files:

• POD YAML
• Service YAML

Answer 4

Finally got the solution to work. Below are my consolidated changes.

Ingress Annotations:

1. kubernetes.io/ingress.class: azure/application-gateway
2. appgw.ingress.kubernetes.io/health-probe-path: "/actuator/health"

Deployment:

1. livenessProbe
2. readinessProbe

Then the access is available.