Application Gateway Subnet Inbound Traffic Blocked By Network Security Group

[khowling]

Describe the bug

"ApplicationGatewaySubnetInboundTrafficBlockedByNetworkSecurityGroup "Network security group /subscriptions//resourceGroups/az-k8s-5jtu-rg/providers/Microsoft.Network/networkSecurityGroups/nsg-appgw-sn-az-k8s-5jtu blocks incoming internet traffic on ports 65200 - 65535 to subnet /subscriptions//resourceGroups/az-k8s-5jtu-rg/providers/Microsoft.Network/virtualNetworks/vnet-az-k8s-5jtu/subnets/appgw-sn, associated with Application Gateway /subscriptions/***/resourceGroups/az-k8s-5jtu-rg/providers/Microsoft.Network/applicationGateways/agw-az-k8s-5jtu. This is not permitted for Application Gateways that have V2 Sku.

To Reproduce

Provision a cluster with "I want a managed environment" & "Private cluster with isolating network". Then run the same script again

	resourceName=az-k8s-5jtu \
	agentCount=2 \
	upgradeChannel=stable \
	JustUseSystemPool=true \
	custom_vnet=true \
	CreateNetworkSecurityGroups=true \
	bastion=true \
	enable_aad=true \
	AksDisableLocalAccounts=true \
	enableAzureRBAC=true \
	adminPrincipalId=$(az ad signed-in-user show --query id --out tsv) \
	registries_sku=Premium \
	acrPushRolePrincipalId=$(az ad signed-in-user show --query id --out tsv) \
	imageNames="[\"k8s.gcr.io/external-dns/external-dns:v0.11.0\"]" \
	azureFirewalls=true \
	certManagerFW=true \
	privateLinks=true \
	kvIPAllowlist="[\"5.67.72.204/32\"]" \
	omsagent=true \
	retentionInDays=30 \
	networkPolicy=azure \
	azurepolicy=audit \
	enablePrivateCluster=true \
	dnsZoneId=/subscriptions/xxx/resourceGroups/kh-common/providers/Microsoft.Network/dnszones/xxx \
	ingressApplicationGateway=true \
	appGWcount=0 \
	appGWsku=WAF_v2 \
	appGWmaxCount=10 \
	appgwKVIntegration=true \
	azureKeyvaultSecretsProvider=true \
	createKV=true \
	kvOfficerRolePrincipalId=$(az ad signed-in-user show --query id --out tsv) \
	acrPrivatePool=true

Expected behavior Successful provisioning

[Gordonby]

This sounds like #206 @khowling

[github-actions[bot]]

Issue smells stale, no activity for 30 days. Stale Label will be removed if the issue is updated, otherwise closed in a month.

[github-actions[bot]]

Issue smells stale, no activity for 30 days. Stale Label will be removed if the issue is updated, otherwise closed in a month.