Configure Azure Application Gateway ingress

Deployment model: On-premises
Configuration reference: Qodo Helm chart 7.22.0.

Use this pattern with an existing Application Gateway Ingress Controller (AGIC), an Application Gateway private frontend, and network reachability from the gateway to Qodo Pods. The controller needs permission to manage that gateway. Prepare a qodo-tls Secret covering all resolved Qodo hosts. For more information, see Configure ingress. This example uses AGIC annotations. Application Gateway for Containers and other AKS ingress controllers use different contracts. For more information, see Application Gateway Ingress Controller annotations.

Configure values

Download ingress-azure-values.yaml in the values archive and apply it after your customer values:

ingress-azure-values.yaml

# Qodo chart values for Azure Application Gateway Ingress Controller (AGIC).
# qodo-tls must already contain the certificate and key for all six hosts.
global:
  tlsSecretName: qodo-tls
  ingress:
    enabled: true
    className: ""
    annotations:
      kubernetes.io/ingress.class: azure/application-gateway
      appgw.ingress.kubernetes.io/use-private-ip: "true"
      appgw.ingress.kubernetes.io/ssl-redirect: "true"
      appgw.ingress.kubernetes.io/backend-protocol: http
      appgw.ingress.kubernetes.io/request-timeout: "3600"
      appgw.ingress.kubernetes.io/connection-draining: "true"
      appgw.ingress.kubernetes.io/connection-draining-timeout: "60"
zitadel:
  deployments:
    probes:
      readiness:
        # AGIC derives each backend's health probe from its HTTP readiness probe.
        exec: null
        httpGet:
          path: /debug/healthz
          port: 8083

AGIC selects the Ingress through the class annotation. The gateway terminates TLS and sends HTTP to the chart’s plaintext Services. The private-IP setting requires a configured private frontend and caller connectivity. AGIC can derive backend health checks from HTTP readiness probes. Qodo’s Zitadel readiness probe normally uses an executable command, so this overlay replaces that handler with its HTTP health endpoint. Keep per-backend probe paths: a global health-probe path would apply to all Services in this Ingress. For more information, see AGIC health probes. This profile covers HTTP APIs and browser/OIDC traffic. AGIC’s HTTP backend setting does not configure a public gRPC route; if your integration requires external Zitadel gRPC, have your platform team choose and verify an ingress path that supports it.

Deploy and verify

helm upgrade --install qodo ./qodo-onprem \
  --kube-context "$KUBE_CONTEXT" --namespace "$NAMESPACE" \
  -f qodo-onprem/onprem-base.yaml -f my-values.yaml \
  -f ingress-azure-values.yaml

Define KUBE_CONTEXT and NAMESPACE as in the shared ingress page. Check the gateway’s backend health for each Service, its certificate, private frontend, and redirect behavior. Complete SSO, portal and SDK access, and a real webhook-driven code review. For more information, see Configure ingress.

Symptom	Check and recovery
Ingress is ignored	Check the AGIC class annotation, controller scope, and gateway permissions
`NoPrivateIP` event	Configure a private frontend or review a public exposure design before changing the private-IP annotation
One backend is unhealthy	Inspect its derived probe path, port, Service endpoints, and gateway-to-Pod network path
Login fails behind the gateway	Check TLS termination, forwarded HTTPS scheme, auth discovery, and both registered OIDC callbacks

Helm charts

Operations

Git Integration

Configure Azure Application Gateway ingress

Configure values

Deploy and verify

​Configure values

​Deploy and verify

Configure values

Deploy and verify