Skip to content

Commit 401688f

Browse files
claudiogodoy99claudiogodoy99
committed
chore: helm version step 4
1 parent 873f748 commit 401688f

File tree

1 file changed

+236
-0
lines changed

1 file changed

+236
-0
lines changed

‎support/azure/azure-kubernetes/load-bal-ingress-c/troubleshoot-agic-connectivity.md‎

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
---
2+
title: Troubleshoot Application Gateway Ingress Controller connectivity
3+
description: This file provides troubleshooting guidance for connectivity issues related to the Application Gateway Ingress Controller (AGIC) in Azure Kubernetes Service (AKS). It includes prerequisites, symptoms of common issues, and initial troubleshooting steps to ensure the application is functioning correctly. The metadata reflects its focus on AGIC connectivity troubleshooting for AKS users.
4+
ms.reviewer: claudiogodoy
5+
ms.service: azure-kubernetes-service
6+
ms.custom: sap:Load balancer and Ingress controller
7+
ms.date: 05/24/2025
8+
---
9+
# Troubleshoot Application Gateway Ingress Controller connectivity
10+
11+
The [Application Gateway Ingress Controller (AGIC)](/azure/application-gateway/ingress-controller-overview) is a Kubernetes application that enables [Azure Kubernetes Service (AKS)](/azure/aks/what-is-aks) customers to use Azure's native Application Gateway L7 load-balancer to expose cloud software to the Internet.
12+
13+
This article provides step-by-step guidance to troubleshoot `AGIC` connectivity issues effectively.
14+
15+
## Prerequisites
16+
17+
Before starting, ensure you have the following tools installed:
18+
19+
- **Kubernetes CLI (`kubectl`)**: Use [Azure CLI](/cli/azure/install-azure-cli) to install it by running the command `az aks install-cli`.
20+
- **Azure CLI**: Follow the [installation guide](/cli/azure/install-azure-cli).
21+
- **Client URL (`cURL`) tool**: Install it using [this guide](https://www.tecmint.com/install-curl-in-linux/).
22+
23+
## Common Symptoms
24+
25+
> [!NOTE]
26+
> This article focuses on `Application Gateway Ingress Controller` issues. Similar symptoms may arise from other problems. Refer to [Troubleshoot connection issues to an app hosted in an AKS cluster](/troubleshoot/azure/azure-kubernetes/connectivity/connection-issues-application-hosted-aks-cluster) for additional information.
27+
28+
| Symptom | Description |
29+
| --- | --- |
30+
| **Ingress without IP address** | Errors in assigning an `IP address` to the `ingress` indicate that `AGIC` is not functioning correctly. |
31+
| **HTTP Timeout** | If `DNS`, `Ingress`, and the `Application` are working, the issue likely lies with `AGIC`. |
32+
33+
## Step 1: Verify Application Functionality
34+
35+
Ensure your application is functioning correctly before troubleshooting `AGIC`. Follow these steps:
36+
37+
1. **Describe your service**:
38+
39+
```console
40+
kubectl describe service <YOUR_SERVICE> -n <YOUR_NAMESPACE>
41+
```
42+
43+
2. **Copy the port details**:
44+
45+
```console
46+
$ kubectl describe service <YOUR_SERVICE> -n <YOUR_NAMESPACE>
47+
Name: dummy-web
48+
Namespace: default
49+
Labels: app=dummy-web
50+
Annotations: <none>
51+
Selector: app=dummy-web
52+
Type: ClusterIP
53+
IP Family Policy: SingleStack
54+
IP Families: IPv4
55+
IP: 10.0.29.113
56+
IPs: 10.0.29.113
57+
Port: <unset> 8080/TCP
58+
TargetPort: 8080/TCP
59+
Endpoints: 10.224.0.49:8080,10.224.0.47:8080,10.224.0.4:8080 + 12 more...
60+
Session Affinity: None
61+
Internal Traffic Policy: Cluster
62+
Events:
63+
Type Reason Age From Message
64+
---- ------ ---- ---- -------
65+
```
66+
67+
3. **Port-forward your service**:
68+
69+
```console
70+
kubectl port-forward svc/<YOUR_SERVICE> 9090:<YOUR_SERVICE_PORT> -n <YOUR_NAMESPACE>
71+
```
72+
73+
4. **Test the application locally**:
74+
75+
```console
76+
curl -v http://localhost:9090
77+
```
78+
79+
5. **Validate application functionality**:
80+
81+
> [!NOTE]
82+
> Investigate and resolve any errors encountered during this step before proceeding.
83+
84+
```console
85+
$ curl -v http://localhost:9090
86+
* Host localhost:9090 was resolved.
87+
* IPv6: ::1
88+
* IPv4: 127.0.0.1
89+
* Trying [::1]:9090...
90+
* Connected to localhost (::1) port 9090
91+
> GET / HTTP/1.1
92+
> Host: localhost:9090
93+
> User-Agent: curl/8.5.0
94+
> Accept: */*
95+
>
96+
< HTTP/1.1 200 OK
97+
< Content-Type: text/html; charset=utf-8
98+
< Date: Tue, 27 May 2025 00:54:58 GMT
99+
< Server: Kestrel
100+
< Transfer-Encoding: chunked
101+
```
102+
103+
## Step 2: Inspect Ingress Settings
104+
105+
Verify that the `Ingress` was created correctly:
106+
107+
1. **Describe the specific ingress**:
108+
109+
```console
110+
kubectl describe ingress <YOUR_INGRESS> -n <YOUR_NAMESPACE>
111+
```
112+
113+
2. **Check events, rules, and address**:
114+
115+
```console
116+
$ kubectl describe ingress <YOUR_INGRESS> -n <YOUR_NAMESPACE>
117+
Name: dummy-web
118+
Labels: <none>
119+
Namespace: default
120+
Address:
121+
Ingress Class: azure-application-gateway
122+
Default backend: <default>
123+
Rules:
124+
Host Path Backends
125+
---- ---- --------
126+
*
127+
/ dummy-web:8080 (10.224.0.70:8080,10.224.0.72:8080,10.224.0.88:8080 + 12 more...)
128+
Annotations: <none>
129+
Events:
130+
Type Reason Age From Message
131+
---- ------ ---- ---- -------
132+
Normal ResetIngressStatus 13m (x5 over 13m) azure/application-gateway Reset IP for Ingress default/dummy-web. Application Gateway <APPLICATION_GATEWAY_ID> is in stopped state
133+
```
134+
135+
If the `Ingress` lacks an address or shows events indicating issues, investigate further.
136+
137+
## Step 3: Inspect Ingress Pod Logs
138+
139+
1. **Inspect the logs**:
140+
141+
```console
142+
kubectl logs -n kube-system -l=app=ingress-appgw
143+
```
144+
145+
Look for any errors or warnings that might indicate what is going wrong.
146+
147+
## Step 4: Check Application Gateway Operational State
148+
149+
This step focuses on understanding the operational state of the [Application Gateway](/azure/application-gateway/overview) used as [Ingress Controller on AKS](/azure/application-gateway/ingress-controller-overview).
150+
151+
### [Add-on](#tab/Add-on)
152+
153+
1. **Get the Application Gateway name**:
154+
155+
```console
156+
az aks show --name <YOUR_AKS_NAME> --resource-group <YOUR_RG_NAME> --query addonProfiles.ingressApplicationGateway
157+
```
158+
159+
> [!NOTE]
160+
> If you see any unexpected error on this step, you might have misconfigured `AGIC`, please read the guide: [Enable the ingress controller add-on for a new AKS cluster with a new application gateway instance](/azure/application-gateway/tutorial-ingress-controller-add-on-new).
161+
162+
```console
163+
{
164+
"config": {
165+
"applicationGatewayName": "<YOUR_APPLICATION_GATEWAY_NAME>",
166+
"effectiveApplicationGatewayId": "...",
167+
"subnetCIDR": "..."
168+
},
169+
"enabled": true,
170+
..
171+
}
172+
```
173+
174+
2. **Validate the Application Gateway operational state**:
175+
176+
```console
177+
az network application-gateway show --name <YOUR_APPLICATION_GATEWAY_NAME> --resource-group <YOUR_RG_NAME> --query operationalState
178+
```
179+
180+
### [Helm](#tab/helm)
181+
182+
1. **Get the Application Gateway name**:
183+
184+
```console
185+
helm show values agic-controller --jsonpath "appgw.name"
186+
```
187+
188+
> [!NOTE]
189+
> If you see any unexpected error on this step, you might have misconfigured `AGIC`, please read the guide: [Install AGIC by using a new Application Gateway deployment](/azure/application-gateway/ingress-controller-install-new).
190+
191+
2. **Validate the Application Gateway operational state**:
192+
193+
```console
194+
az network application-gateway show --name <YOUR_APPLICATION_GATEWAY_NAME> --resource-group <YOUR_RG_NAME> --query operationalState
195+
```
196+
197+
The expected `operationalState` is `Running`. If it's different, you may need to restart your Application Gateway.
198+
199+
## Step 5 (Optional): Inspect Mapped Kubernetes and Application Gateway IPs
200+
201+
The [AGIC](/azure/application-gateway/ingress-controller-overview) monitors the pod IPs and maps them to `backendAddressPools` in the `Application Gateway` instance. This step validates that integration.
202+
203+
1. **Get the Application Gateway `backendAddressPools`**:
204+
205+
```console
206+
az network application-gateway show --name <YOUR_APPLICATION_GATEWAY_NAME> --resource-group <YOUR_RG_NAME> --query backendAddressPools
207+
```
208+
209+
2. **Get the pod IPs using Kubernetes endpoints**:
210+
211+
```console
212+
kubectl describe endpoints <YOUR_SERVICE_NAME> -n <YOUR_NAMESPACE> | grep Addresses
213+
```
214+
215+
3. **Compare the results**:
216+
217+
Ensure the lists from steps 1 and 2 are equal. If not, `AGIC` may not be working correctly.
218+
219+
## Solution: Start/Restart the Application Gateway
220+
221+
If your `AGIC` is not working as expected, it might be stopped or misconfigured. If the Application Gateway operational state is not `Running`, start it, wait a few seconds, and test again.
222+
223+
```console
224+
az network application-gateway start --name <YOUR_APPLICATION_GATEWAY_NAME> --resource-group <YOUR_RG_NAME>
225+
```
226+
227+
## Additional Resources
228+
229+
- [Learn more about Azure Kubernetes Service (AKS) best practices](/azure/aks/best-practices)
230+
- [Monitor your Kubernetes cluster performance with Container insights](/azure/azure-monitor/containers/container-insights-analyze)
231+
232+
[!INCLUDE [Third-party information disclaimer](../../../includes/third-party-disclaimer.md)]
233+
234+
[!INCLUDE [Third-party contact information disclaimer](../../../includes/third-party-contact-disclaimer.md)]
235+
236+
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

0 commit comments

Comments
 (0)