Azure / Azure/aks-app-routing-operator
Silent Failure in Azure App Routing Add-on
- Dominant language
- Go
- Stars
- 40
- Forks
- 31
- PR merge metrics
- No merged PRs in 30d
Description
### Issue Report: Silent Failure in Azure App Routing Add-on
> Reference: https://learn.microsoft.com/en-us/azure/aks/app-routing#limitations
Currently, App Routing has prohibited syntax patterns:
```
load_module, lua_package, _by_lua, location, root, proxy_pass, serviceaccount, {, }, '
```
**Current Behavior:**
These are standard Ingress syntax patterns. When used, there are no issues at the YAML level, but the Azure NGINX Ingress Controller marks them as "invalid syntax" during configuration reload and ignores those settings. (Services appear to work normally at this point -> Silent Failure)
However, Azure periodically performs managed updates/restarts of the App Routing area. During this restart process, ingress resources with prohibited syntax are skipped entirely, causing complete service routing failure (CRITICAL).
**Production Impact:**
Our service experienced an outage due to this behavior. This issue can easily occur in other cases as well. Currently, only a WARNING level log is output:
```
W1016 07:07:50.791935 7 store.go:917] skipping ingress my-namspace/my-service: [nginx.ingress.kubernetes.io/configuration-snippet](http://nginx.ingress.kubernetes.io/configuration-snippet) annotation contains invalid word {
...(skip)
```
**Request:**
I think need a fail-fast strategy for this situation:
- Reject prohibited syntax at deployment time (admission control)
- Upgrade logging from WARNING to ERROR level
- Provide clear error messages indicating which syntax is prohibited
- Prevent silent failures that only manifest during managed restarts
This is a critical issue that can cause unexpected production outages without clear visibility.
Thank you.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the Azure App Routing limitations and the warning shown from store.go:917. Trace how prohibited syntax is detected and how ingress resources are skipped during configuration reloads or managed restarts. Done means the failure is surfaced before deployment or with an explicit error, with clear reporting of the prohibited syntax and coverage for the affected path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go, kubernetes
- Domain
- cloud, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100