I have created a ASP.NET CORE 2.x app Kestrel image stored in Azure Container Registry with a certificate stored on azure storage with secret for the cert password. I have confirmed that the image is running locally with a self signed cert. I have pushed the image to the ACR and it is pulling successfully into AKS. When I remote into the pod, I am able to curl and see kestrel responding.

I believe that the external load balancer that I have created in my AKS cluster is not forwarding to my POD. When I call the external IP endpoint provided, I get a timeout and I can't figure out why.

I followed the k8s debug service guide here, however, I still don't understand what I'm doing wrong: https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/

Here is my DockerFile:

FROM microsoft/dotnet:2.2-sdk AS build
WORKDIR /app

# set up node
ENV NODE_VERSION 10.15.1
ENV NODE_DOWNLOAD_SHA ca1dfa9790876409c8d9ecab7b4cdb93e3276cedfc64d56ef1a4ff1778a40214
RUN curl -SL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.gz" --output nodejs.tar.gz \
    && echo "$NODE_DOWNLOAD_SHA nodejs.tar.gz" | sha256sum -c - \
    && tar -xzf "nodejs.tar.gz" -C /usr/local --strip-components=1 \
    && rm nodejs.tar.gz \
    && ln -s /usr/local/bin/node /usr/local/bin/nodejs

# copy and build projects
COPY . .
RUN dotnet restore
RUN dotnet publish -c Release -o out
WORKDIR /app/MyApp


FROM microsoft/dotnet:2.2-aspnetcore-runtime AS runtime
WORKDIR /app
COPY --from=build /app/MyApp/out ./
ENV ASPNETCORE_URLS https://+:443
ENV ASPNETCORE_Kestrel__Certificates__Default__Path /mnt/certs/MyApp.pfx
ENTRYPOINT ["dotnet", "MyApp.dll"]

Here is my deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-website
  labels:
    app: myapp-website
spec:
  replicas: 1
  revisionHistoryLimit: 1
  selector:
    matchLabels:
      app: myapp-website
  template:
    metadata:
      labels:
        app: myapp-website
    spec:
      nodeSelector:
        "beta.kubernetes.io/os": linux    
      containers:
      - name: myapp-website
        image: myappdev.azurecr.io/myapp:v1
        ports:
        - containerPort: 443
        env:
        - name: ASPNETCORE_ENVIRONMENT
          value: dev
        - name: ASPNETCORE_Kestrel__Certificates__Default__Password
          valueFrom:
            secretKeyRef:
              name: myapp-secrets
              key: cert-pass   
        volumeMounts:
        - name: certs
          mountPath: /mnt/certs
          readOnly: true
      imagePullSecrets:
      - name: docker-reg-credential
      volumes:
      - name: certs
        azureFile:
          secretName: myapp-secrets
          shareName: myapp/certs
          readOnly: true   
---
kind: Service
apiVersion: v1
metadata:
  name: myapp-website
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
  type: LoadBalancer
  ports:
  - name:
    port: 443
    targetPort: 443
  selector:
    app: myapp-website

Kubectl descibe services:

# kubectl describe services                                                                               
Name:              kubernetes                                                                             
Namespace:         default                                                                                
Labels:            component=apiserver                                                                    
                   provider=kubernetes                                                                    
Annotations:       <none>                                                                                 
Selector:          <none>                                                                                 
Type:              ClusterIP                                                                              
IP:                10.0.0.1                                                                               
Port:              https  443/TCP                                                                         
TargetPort:        443/TCP                                                                                
Endpoints:         172.31.3.237:443                                                                       
Session Affinity:  None                                                                                   
Events:            <none>                                                                                 


Name:                     myapp-website                                                                    
Namespace:                default                                                                         
Labels:                   <none>                                                                          
Annotations:              kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"Serv
ice","metadata":{"annotations":{"service.beta.kubernetes.io/azure-load-balancer-internal":"true"},"name":"
myapp-website",...                                                                                         
                          service.beta.kubernetes.io/azure-load-balancer-internal=true                    
Selector:                 app=myapp-website                                                                
Type:                     LoadBalancer                                                                    
IP:                       10.0.194.20                                                                     
LoadBalancer Ingress:     10.240.0.7                                                                      
Port:                     <unset>  443/TCP                                                                
TargetPort:               443/TCP                                                                         
NodePort:                 <unset>  30872/TCP                                                              
Endpoints:                10.244.1.53:443                                                                 
Session Affinity:         None                                                                            
External Traffic Policy:  Cluster                                                                         
Events:                   <none> 

kubectl describe pods:

# kubectl describe pods
Name:               myapp-website-9d89dd8b-plvs8
Namespace:          default
Priority:           0
PriorityClassName:  <none>
Node:               aks-agentpool-20448790-1/10.240.0.5
Start Time:         Thu, 04 Jul 2019 23:36:11 -0700
Labels:             app=myapp-website
                    pod-template-hash=9d89dd8b
Annotations:        <none>
Status:             Running
IP:                 10.244.1.43
Controlled By:      ReplicaSet/myapp-website-9d89dd8b
Containers:
  myapp-website:
    Container ID:   docker://fb3c91fe13f74b8e970f786e3cb70e1875c3e2d1d2198ac2e761120dc4655134
    Image:          myappdev.azurecr.io/transimyappapp:v1
    Image ID:       docker-pullable://myappdev.azurecr.io/transimyappapp@sha256:1bb5cb2cae935866e538f231c08ff33188ac4bed94a662a86a3c859da3bb28db
    Port:           443/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Thu, 04 Jul 2019 23:36:12 -0700
    Ready:          True
    Restart Count:  0
    Environment:
      ASPNETCORE_ENVIRONMENT:                               dev
      ASPNETCORE_Kestrel__Certificates__Default__Password:  <set to the key 'cert-pass' in secret 'myapp-secrets'>  Optional: false
      KUBERNETES_PORT_443_TCP_ADDR:                         aks-tso-dev-dns-1b650af7.hcp.canadacentral.azmk8s.io
      KUBERNETES_PORT:                                      tcp://aks-tso-dev-dns-1b650af7.hcp.canadacentral.azmk8s.io:443
      KUBERNETES_PORT_443_TCP:                              tcp://aks-tso-dev-dns-1b650af7.hcp.canadacentral.azmk8s.io:443
      KUBERNETES_SERVICE_HOST:                              aks-tso-dev-dns-1b650af7.hcp.canadacentral.azmk8s.io
    Mounts:
      /mnt/certs from certs (ro)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-fs8sn (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  certs:
    Type:        AzureFile (an Azure File Service mount on the host and bind mount to the pod)
    SecretName:  myapp-secrets
    ShareName:   myapp/certs
    ReadOnly:    true
  default-token-fs8sn:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-fs8sn
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  beta.kubernetes.io/os=linux
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:          <none>

Get Endpoints:

# kubectl get endpoints myapp-website
NAME           ENDPOINTS         AGE
myapp-website   10.244.1.43:443   12h

remote into pod to ensure service responds.

root@myapp-website-9d89dd8b-plvs8:/app# nslookup myapp-website
Server:         10.0.0.10
Address:        10.0.0.10#53

Name:   myapp-website.default.svc.cluster.local
Address: 10.0.194.20

curl -k https://10.0.194.20
# kubectl exec -it myapp-website-9d89dd8b-plvs8 /bin/bash                                                  
root@myapp-website-9d89dd8b-plvs8:/app# curl                                                               
curl: try 'curl --help' or 'curl --manual' for more information                                           
root@myapp-website-9d89dd8b-plvs8:/app# curl -k https://10.0.194.20                                        


<!DOCTYPE html>                                                                                           
<html>... continues

It's probably something simple, however, I can't seem to figure it out. Coming up on 1.5 weeks of trying to make this work. Please help and many thanks in advance for any assistance.