Azure / Azure/aks-app-routing-operator

Silent Failure in Azure App Routing Add-on

Open
#503 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
40
Forks
31
PR merge metrics
No merged PRs in 30d

Description

### Issue Report: Silent Failure in Azure App Routing Add-on
> Reference: https://learn.microsoft.com/en-us/azure/aks/app-routing#limitations

Currently, App Routing has prohibited syntax patterns:
```
load_module, lua_package, _by_lua, location, root, proxy_pass, serviceaccount, {, }, '
```

**Current Behavior:**
These are standard Ingress syntax patterns. When used, there are no issues at the YAML level, but the Azure NGINX Ingress Controller marks them as "invalid syntax" during configuration reload and ignores those settings. (Services appear to work normally at this point -> Silent Failure)
However, Azure periodically performs managed updates/restarts of the App Routing area. During this restart process, ingress resources with prohibited syntax are skipped entirely, causing complete service routing failure (CRITICAL).

**Production Impact:**
Our service experienced an outage due to this behavior. This issue can easily occur in other cases as well. Currently, only a WARNING level log is output:
```
W1016 07:07:50.791935 7 store.go:917] skipping ingress my-namspace/my-service: [nginx.ingress.kubernetes.io/configuration-snippet](http://nginx.ingress.kubernetes.io/configuration-snippet) annotation contains invalid word {
...(skip)
```

**Request:**
I think need a fail-fast strategy for this situation:

- Reject prohibited syntax at deployment time (admission control)
- Upgrade logging from WARNING to ERROR level
- Provide clear error messages indicating which syntax is prohibited
- Prevent silent failures that only manifest during managed restarts

This is a critical issue that can cause unexpected production outages without clear visibility.

Thank you.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the Azure App Routing limitations and the warning shown from store.go:917. Trace how prohibited syntax is detected and how ingress resources are skipped during configuration reloads or managed restarts. Done means the failure is surfaced before deployment or with an explicit error, with clear reporting of the prohibited syntax and coverage for the affected path.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go, kubernetes
Domain
cloud, devops, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.