Hello experts, We have 2 AKS clusters in the same region that run applications served by different contexts but same URLs otherwise. This is done for organizational purposes. For example, in AKS1, there are 2 applications served with the following URLs - https://us.east/application1 https://us.east/application2 And in AKS2, we have 2 applications served with the following URLs - https://us.east/application3 https://us.east/application4 Depending upon the context in the URL, we need to send the request to the corresponding application in one of the 2 clusters. Could someone please let me know how to achieve this routing and what options are available? Regards, Sam

Hello Kailash As per my understanding, you need guidance about an Azure product that you can use to expose different applications that are running on different AKS clusters which are in the same region on the same host name but different paths, so you are interested in path-based routing. For that, you can use an Application Gateway, which is a regional product. This is the link on how to create an Application Gateway with path-based routing rules: https://learn.microsoft.com/en-us/azure/application-gateway/create-url-route-portal You may also take in consideration Azure Front Door, which is a global product. Useful links: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview https://learn.microsoft.com/en-us/azure/frontdoor/front-door-route-matching?pivots=front-door-standard-premium https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-multi-region#application-routing-with-azure-front-door-service I hope this is helpful. If any clarification needed, let me know and I will do my best to answer. Please "Accept as Answer" and Upvote if it helped, so that it can help others in the community looking for help on similar topics. Thank you!

How to distribute traffic to applications running on multiple AKS clusters based on the URL context?

Accepted answer

Andrei Barbu 2,576 Reputation points Microsoft Employee

2023-03-20T07:24:56.66+00:00

Hello Kailash

As per my understanding, you need guidance about an Azure product that you can use to expose different applications that are running on different AKS clusters which are in the same region on the same host name but different paths, so you are interested in path-based routing.

For that, you can use an Application Gateway, which is a regional product. This is the link on how to create an Application Gateway with path-based routing rules: https://learn.microsoft.com/en-us/azure/application-gateway/create-url-route-portal

You may also take in consideration Azure Front Door, which is a global product. Useful links:

https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview

https://learn.microsoft.com/en-us/azure/frontdoor/front-door-route-matching?pivots=front-door-standard-premium

https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-multi-region#application-routing-with-azure-front-door-service

I hope this is helpful. If any clarification needed, let me know and I will do my best to answer.

Please "Accept as Answer" and Upvote if it helped, so that it can help others in the community looking for help on similar topics.

Thank you!
Please sign in to rate this answer.
Kailash 51 Reputation points

2023-03-20T07:51:19.9466667+00:00

Hello Andrei,

Thanks for the response and your understanding of my requirement is absolutely correct. I went through [https://learn.microsoft.com/en-us/azure/application-gateway/create-url-route-portal](https://learn.microsoft.com/en-us/azure/application-gateway/create-url-route-portal) and it says the following -

For the Application Gateway v2 SKU, you can only choose Public frontend IP configuration. Private frontend IP configuration is currently not enabled for this v2 SKU.

The access to applications that I am talking about here are restricted to internal corporate users only and not exposed to internet. Given that, would my assumption that this solution won't suit us be correct?

Haven't gone through the Front Door doc yet.

Best regards

Andrei Barbu 2,576 Reputation points Microsoft Employee

2023-03-20T08:13:37.0866667+00:00

That is correct. A common solution if you want to expose internally using path-based routing is the nginx-ingress-controller deployed as Internal Load Balancer: https://learn.microsoft.com/en-us/azure/aks/ingress-basic?tabs=azure-cli#create-an-ingress-controller-using-an-internal-ip-address

However, I am not sure how you would integrate between multiple clusters. You may probably need to install it on each and expose each app separately, but I've never tested such scenario.

Kailash 51 Reputation points

2023-03-20T11:22:32.03+00:00

Yes. until recently we had just one cluster with multiple applications running inside and we setup an ingress controller to distribute traffic to these applications based on the context. Actually, we have 2 ingress controllers - 1 that front ends all the traffic and directs it to the 2nd controller that in turn distributes to the multiple end points.

Now that we are planning to have multiple clusters, we need some kind of load balancer that can distribute traffic directly to service endpoints within those clusters.

So the alternate solution would be to look at Azure Front Door. Do you know if it can be used with private IP or does it work with Public IP only?

Andrei Barbu 2,576 Reputation points Microsoft Employee

2023-03-20T12:42:05.1333333+00:00

No, Azure Front Door does not support static or dedicated frontend IPs at all. However, you can lock down the access to your backend to only Azure Front Door by using a private endpoint. Network traffic between Front Door and the backend will traverse over the virtual network and a private link on the Microsoft backbone network, eliminating exposure from the public internet. You can also lock down your backend to accept traffic only from your specific Front Door instance by setting up IP access control lists (ACLs) for your backend and restricting the traffic of your backend to the specific value of the header 'X-Azure-FDID' sent by Front Door. You can find more information on this topic in the following articles:
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/frontdoor/front-door-custom-domain-https.md
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/frontdoor/standard-premium/how-to-enable-private-link-web-app.md
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/frontdoor/standard-premium/faq.md
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/frontdoor/origin-security.md

Please "Accept as Answer" and Upvote if it helped, so that it can help others in the community looking for help on similar topics.
Sign in to comment

Share via

How to distribute traffic to applications running on multiple AKS clusters based on the URL context?

0 additional answers