I am very new to Azure, Kubernetes, even Docker itself, and playing with the system to learn and evaluate for a possible deployment later. I have so far dockerized my services and successfully deployed them and made the web frontend publicly visible using a service with type: LoadBalancer.

Now I would like to add TLS termination and have learned that for that I am supposed to configure an ingress controller with the most commonly mentioned one being nginx-ingress-controller.

Strictly monkeying examples and then afterwards trying to read up on the docs I have arrived at a setup that looks interesting but does not work. Maybe some kind soul can point out my mistakes and/or give me pointers on how to debug this and where to read more about it.

I have kubectl apply'd the following file:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: default-http-backend-deployment
  namespace: kube-system
spec:
  template:
    metadata:
      labels:
        app: default-http-backend
    spec:
      terminationGracePeriodSeconds: 60
      containers:
        - name: default-http-backend
          image: gcr.io/google_containers/defaultbackend:1.0
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: default-http-backend-service
  namespace: kube-system
spec:
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 80  
  selector:
    app: default-http-backend
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-ingress-controller-conf
  namespace: kube-system
data:
  # enable-vts-status: 'true'
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: nginx-ingress-controller-deployment
  namespace: kube-system
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: nginx-ingress-controller
    spec:
      terminationGracePeriodSeconds: 60
      containers:
        - image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.13
          name: nginx-ingress-controller
          ports:
            - containerPort: 80
              hostPort: 80
            - containerPort: 443
              hostPort: 443
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          args:
            - /nginx-ingress-controller
            - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
            - --configmap=$(POD_NAMESPACE)/nginx-ingress-controller-conf
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-controller-service
  namespace: kube-system
spec:
  ports:
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: nginx-ingress-controller
  sessionAffinity: None
  type: LoadBalancer
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: nginx-ingress
  namespace: kube-system
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
    - host: 
      http:
        paths:
          - path: /
            backend:
              serviceName: default-http-backend-service
              servicePort: 80

This gave me two pods:

c:\Projects\Release-Management\Azure>kubectl get pods --all-namespaces

NAMESPACE     NAME                                                   READY     STATUS    RESTARTS   AGE
<some lines removed>
kube-system   default-http-backend-deployment-3108185104-68xnk       1/1       Running   0          39m
<some lines removed>
kube-system   nginx-ingress-controller-deployment-4106313651-v7p03   1/1       Running   0          24s

Also two new services. Note that I have also configured the default-http-backend-service with type: LoadBalancer, this is for debugging only. I have included my web-frontend which is called webcms:

c:\Projects\Release-Management\Azure>kubectl get services --all-namespaces

NAMESPACE     NAME                               CLUSTER-IP     EXTERNAL-IP     PORT(S)                      AGE
<some lines removed>
default       webcms                             10.0.105.59    13.94.250.173   80:31400/TCP                 23h
<some lines removed>
kube-system   default-http-backend-service       10.0.106.233   13.80.68.38     80:31639/TCP                 41m
kube-system   nginx-ingress-controller-service   10.0.33.80     13.95.30.39     443:31444/TCP,80:31452/TCP   37m

And finally an ingress:

c:\Projects\Release-Management\Azure>kubectl get ingress --all-namespaces

NAMESPACE     NAME            HOSTS     ADDRESS      PORTS     AGE
kube-system   nginx-ingress   *         10.240.0.5   80        39m

No errors that I can immediately detect. I then went to the Azure Dashboard and looked at the loadbalancer and its rules and that looks good to my (seriously untrained) eye. I did not touch these, the loadbalancer and the rules were created by the system. There is a screenshot here:

https://qvwx.de/tmp/azure-loadbalancer.png

But unfortunately it does not work. I can curl my webcms-service:

c:\Projects\Release-Management\Azure>curl -v http://13.94.250.173
* Rebuilt URL to: http://13.94.250.173/
*   Trying 13.94.250.173...
* TCP_NODELAY set
* Connected to 13.94.250.173 (13.94.250.173) port 80 (#0)
<more lines removed, success>

But neither default-http-backend nor the ingress work:

c:\Projects\Release-Management\Azure>curl -v http://13.80.68.38
* Rebuilt URL to: http://13.80.68.38/
*   Trying 13.80.68.38...
* TCP_NODELAY set
* connect to 13.80.68.38 port 80 failed: Timed out
* Failed to connect to 13.80.68.38 port 80: Timed out
* Closing connection 0
curl: (7) Failed to connect to 13.80.68.38 port 80: Timed out

(ingress gives the same with a different IP)

If you read this far: Thank you for your time and I would appreciate any hints.

Marian