Tutorial: Enable the ingress controller add-on for a new AKS cluster with a new application gateway instance

In this page in the screenshot, you can create it simply by selecting the checkbox. If you want to specify a subnet prefix, select Create new and configure it manually.

You can give the name of the application gateway as well as subnet CIDR by the command. appgw-subnet-cidr should be in the address prefixes in your virtual network. Please change 10.0.250.0/24 to your preferred application gateway subnet CIDR. This must always be within the address space range of your virtual network.

$ az aks enable-addons --resource-group ${RG_NAME} --name ${CLUSTER_NAME} --addons ingress-appgw --appgw-subnet-cidr "10.0.250.0/24"

In most cases, enabling the add-on automatically assigns the required permissions. However, depending on the environment, the permissions may not be granted automatically. In such cases, you should verify the permissions and assign them manually if necessary.

# Get application gateway id from AKS addon profile
appGatewayId=$(az aks show -n myCluster -g myResourceGroup -o tsv --query "addonProfiles.ingressApplicationGateway.config.effectiveApplicationGatewayId")

# Get Application Gateway subnet id
appGatewaySubnetId=$(az network application-gateway show --ids $appGatewayId -o tsv --query "gatewayIPConfigurations[0].subnet.id")

# Get AGIC addon identity
agicAddonIdentity=$(az aks show -n myCluster -g myResourceGroup -o tsv --query "addonProfiles.ingressApplicationGateway.identity.clientId")

# Assign network contributor role to AGIC addon identity to subnet that contains the Application Gateway
az role assignment create --assignee $agicAddonIdentity --scope $appGatewaySubnetId --role "Network Contributor"

To configure more parameters for the above command, see az aks create.

Deploy a sample application by using AGIC

You'll now deploy a sample application to the AKS cluster that you created. The application will use the AGIC add-on for ingress and connect the application gateway instance to the AKS cluster.

First, get credentials to the AKS cluster by running the az aks get-credentials command:

az aks get-credentials -n myCluster -g myResourceGroup

Now that you have credentials, run the following command to set up a sample application that uses AGIC for ingress to the cluster. AGIC will update the application gateway instance that you set up earlier with corresponding routing rules to the sample application you're deploying.

kubectl apply -f https://raw.githubusercontent.com/Azure/application-gateway-kubernetes-ingress/master/docs/examples/aspnetapp.yaml 

Check that the application is reachable

Now that the application gateway instance is set up to serve traffic to the AKS cluster, let's verify that your application is reachable. First, get the IP address of the ingress:

kubectl get ingress

Check that the sample application that you created is running by either:

• Visiting the IP address of the application gateway instance that you got from running the preceding command.
• Using curl.

Application gateway might take a minute to get the update. If application gateway is still in an Updating state on the portal, let it finish before you try to reach the IP address.

Clean up resources

When you no longer need them, delete all resources created in this tutorial by deleting myResourceGroup and MC_myResourceGroup_myCluster_chinanorth2 resource groups:

az group delete --name myResourceGroup
az group delete --name MC_myResourceGroup_myCluster_chinanorth2

Next steps

In this tutorial, you:

• Created new AKS cluster with the AGIC add-on enabled
• Deployed a sample application by using AGIC for ingress on the AKS cluster

To learn more about AGIC, see What is Application Gateway Ingress Controller and Disable and re-enable AGIC add-on for your AKS cluster.

To learn how to enable application gateway ingress controller add-on for an existing AKS cluster with an existing application gateway, advance to the next tutorial.