多AKS集群共享App Gateway的AGIC棕地部署后端池配置咨询

可以通过AGIC专属注解appgw.ingress.kubernetes.io/backend-pool-name-suffix为后端池添加自定义后缀，让两个集群的Service生成独立的后端池，同时避免AGIC覆盖手动配置内容。

修改后的Ingress配置 #

生产环境Ingress #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: services-recruitment-api-prod
  namespace: services-recruitment
  annotations:
    appgw.ingress.kubernetes.io/ssl-redirect: "false"
    appgw.ingress.kubernetes.io/hostname-extension: "prod-XXX.XXX.XX"
    appgw.ingress.kubernetes.io/backend-hostname: "prod-XXX.XXX.XX"
    appgw.ingress.kubernetes.io/backend-pool-name-suffix: "-prod"  # 添加生产环境专属后缀
spec:
  ingressClassName: azure-application-gateway
  rules:
  - host: prod-XXX.XXX.XX
    http:
      paths:
      - path: /Recruitment/swagger/
        pathType: Prefix
        backend:
          service:
            name: recruitment-api-s
            port:
              number: 80

开发环境Ingress #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: services-recruitment-api
  namespace: services-recruitment
  annotations:
    appgw.ingress.kubernetes.io/ssl-redirect: "false"
    appgw.ingress.kubernetes.io/hostname-extension: "dev-XXX.XXX.XX"
    appgw.ingress.kubernetes.io/backend-hostname: "dev-XXX.XXX.XX"
    appgw.ingress.kubernetes.io/backend-pool-name-suffix: "-dev"  # 添加开发环境专属后缀
spec:
  ingressClassName: azure-application-gateway
  rules:
  - host: dev-XXX.XXX.XX
    http:
      paths:
      - path: /Recruitment/swagger/
        pathType: Prefix
        backend:
          service:
            name: recruitment-api-s
            port:
              number: 80

原理说明 #

AGIC默认根据Service的命名空间、名称、端口生成后端池的唯一标识，当两个AKS集群中存在同名、同命名空间、同端口的Service时，AGIC会将它们识别为同一个后端池，导致规则错误指向同一集群的端点。

添加backend-pool-name-suffix注解后，AGIC会将指定后缀追加到后端池名称中，从而为两个集群的Service生成独立的后端池，各自的Ingress规则也会关联到对应后缀的后端池，彻底解决规则和后端池合并的问题。

内容的提问来源于stack exchange，提问作者Kirill