[Question] How to disable/delete default public facing ingress controller for application routing add-on (managed nginx)

[sanjaydebnath]

Describe scenario I want to make sure no public facing ingress controller / load balancer / IP is created when we enable the application routing add-on (managed nginx) for our private vnet integrated AKS cluster. The requirement is to reach the private LB from front door via private link service. This article has the same described.

As documented here, when we enable the add on today using az aks approuting enable command a LB with a public IP used by the ingress controller called 'default' is created. After that we can add additional ingress controllers with private LB/IP. I couldn't find any way to disable the default creation. I do not need the public LB/IP as everything is internal.

Question How can I stop creation of the default public facing ingress controller or how can I remove the same later post creation? I tried manually deleting the LBs from the AKS VMSSs but that didn't work and after certain time the 'default' ingress controller again popped up in system!

[JoeyC-Dev]

Why not replace the default one?

cat <<EOF | kubectl apply -f -
apiVersion: approuting.kubernetes.azure.com/v1alpha1
kind: NginxIngressController
metadata:
  name: default
spec:
  ingressClassName: webapprouting.kubernetes.azure.com
  controllerNamePrefix: nginx
  loadBalancerAnnotations: 
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
EOF

Wait two minutes and your default one's IP should be changed to internal IP.

---

If you really insist on deleting the default one and use your own one:

kubectl delete nginxingresscontrollers default

But make sure you create a new one before deleting the default one: because the operator will re-create the default one if no nginxingresscontrollers resource exists. So in the end, it is quicker if you just replace the default one, instead of deleting the default and creating the new one.

[sanjaydebnath]

Why not replace the default one?

cat <<EOF | kubectl apply -f -
apiVersion: approuting.kubernetes.azure.com/v1alpha1
kind: NginxIngressController
metadata:
  name: default
spec:
  ingressClassName: webapprouting.kubernetes.azure.com
  controllerNamePrefix: nginx
  loadBalancerAnnotations: 
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
EOF

Wait two minutes and your default one's IP should be changed to internal IP.

Oh that was easy enough :) Not sure why I didn't try that... I also verified that once you update it to a private LB, previously added public LB/IP are also removed after some time (took around 5 mins). Thanks a lot.