Unable to create AzureIngressProhibitedTarget on AKS

[olee]

Unable to create AzureIngressProhibitedTarget on AKS

[williamalvvc]

Hi There, AzureIngressProhibitedTarget is a custom resource used by helm, afaik, enable-addon is only useful if you looking to setup AGIC for AKS only (No shared can be used since AGIC is fully managed by AKS), thus, if your looking for a shared configuration you should go for helm.

[olee]

Actually, I managed to resolve this by manually patching the configuration deployed through the addon. These were the steps I followed:

1. Apply CustomResourceDefinition AzureIngressProhibitedTarget with the yaml from the chart
2. Apply a patch to the ingress-appgw-cm config map and set APPGW_ENABLE_SHARED_APPGW: true.
   I did this through pulumi by creating a ConfigMapPatch resource:

  ConfigMapPatch("appgw-ingress-shared-mode", {
      metadata: {
          name: "ingress-appgw-cm",
          namespace: "kube-system",
      },
      data: {
          APPGW_ENABLE_SHARED_APPGW: "true",
      },
  }

Afterwards, the shared gateway was working correctly iirc (we are not using it yet, because we are busy with other stuff and are still evaluating out transition from the current ingress to appgw).
So as far as I can see it, this is just an issue of the shared option not being available through the addon.

PS: I also created an issue for the documentation on brownfield deployments over at microsoft to be updated to tell users that shared mode will not be used and all existing configuration would be overwritten once the ingress controller is enabled: MicrosoftDocs/azure-docs#119676