I have multiple VNET’s that connected each other with a Virtual Hub. My VNETs’ private subnets can connect internet via a Azure Firewall and my firewall rules are any to any for any ports temporarily.

I’ve created an AKS Cluster and my all nodes run in private subnets. The cluster also has overlay network. I just want to create a ingress-nginx and serve my applications outside and here is my dilemma:

I learnt by trying, AKS creates public load balancer into same subnet with your cluster node and it means my public load balancer traffic goes over firewall to internet. When i changed route table of my nodes from firewall to internet gateway i can access my ingress-nginx but this time my nodes lose their accessibility to my internal network.

The only way to do that was using application gateway and access my things with using application gateway as a proxy to my ingress-nginx but this time my overlay network makes my thing to complex. Application gateway backends uses overlay networks ip adresses. I can serve my apps over http by changing ingress-nginx backend ip address but this time i cannot upload my ssl certifications by cert manager because cert manager still use overlay networks ip adresses and these are not configurable.

Do you have any solution for this case?