I had configured my APIM to be in internal mode and sharing the same vnet (different subnet) as an AKS cluster which is using an internal load balancer with the idea that these services will not be able to be reached by the internet except from the dedicated Application Gateway. Currently, I am able to establish connection between the Application Gateway and the internal API Management instance (endpoints accessible using AAG but not through API). But when I attempt to connect API Management to the private AKS I keep getting 404 status Code error. I figured it to be an issue regarding the AKS subnet’s NSG, so I created new inbound rules to allow connection from API Management’s internal IP:
Inbound Rules:
- Allow from APIM to VNET
- Allow APIM to AzureLoadBalancer
- APIM’s Internal IP to AzureLoadBalancer
- Application Gateway’s Private IP to VNET
Outbound Rules:
- AzureLoadBalancer to APIM’s Internal IP
- VNET to APIM
I thought I just need to allow traffic to go from APIM to AKS and out but this has not been working. With the current setup, I am able to access services hosted on a public AKS through AAG and APIM.
Ex: AAG endpoint -> Internal APIM -> Public AKS
I had been using this documentation to build these services. https://learn.microsoft.com/en-us/azure/api-management/api-management-using-with-internal-vnet?tabs=stv2
A nudge in the right direction would be appreciated. Thanks.