> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qodo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Azure Application Gateway ingress

> Use Azure Application Gateway Ingress Controller with Qodo's TLS Secret, private frontend, timeouts, and backend readiness probes.

* **Deployment model**: On-premises
* **Configuration reference**: Qodo Helm chart `7.22.0`.

Use this pattern with an existing Application Gateway Ingress Controller
(AGIC), an Application Gateway private frontend, and network reachability
from the gateway to Qodo Pods. The controller needs permission to manage
that gateway. Prepare a `qodo-tls` Secret covering all resolved Qodo hosts.
For more information, see [Configure ingress](https://docs.qodo.ai/on-prem/ingress.md).

This example uses AGIC annotations. Application Gateway for Containers and
other AKS ingress controllers use different contracts. For more information,
see [Application Gateway Ingress Controller annotations](https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations).

## Configure values

Download [`ingress-azure-values.yaml` in the values archive](https://docs.qodo.ai/examples/on-prem/values-examples.zip)
and apply it after your customer values:

```yaml ingress-azure-values.yaml theme={null}
# Qodo chart values for Azure Application Gateway Ingress Controller (AGIC).
# qodo-tls must already contain the certificate and key for all six hosts.
global:
  tlsSecretName: qodo-tls
  ingress:
    enabled: true
    className: ""
    annotations:
      kubernetes.io/ingress.class: azure/application-gateway
      appgw.ingress.kubernetes.io/use-private-ip: "true"
      appgw.ingress.kubernetes.io/ssl-redirect: "true"
      appgw.ingress.kubernetes.io/backend-protocol: http
      appgw.ingress.kubernetes.io/request-timeout: "3600"
      appgw.ingress.kubernetes.io/connection-draining: "true"
      appgw.ingress.kubernetes.io/connection-draining-timeout: "60"
zitadel:
  deployments:
    probes:
      readiness:
        # AGIC derives each backend's health probe from its HTTP readiness probe.
        exec: null
        httpGet:
          path: /debug/healthz
          port: 8083

```

AGIC selects the Ingress through the class annotation. The gateway terminates
TLS and sends HTTP to the chart's plaintext Services. The private-IP setting
requires a configured private frontend and caller connectivity.

AGIC can derive backend health checks from HTTP readiness probes. Qodo's
Zitadel readiness probe normally uses an executable command, so this overlay
replaces that handler with its HTTP health endpoint. Keep per-backend probe
paths: a global health-probe path would apply to all Services in this Ingress.
For more information, see
[AGIC health probes](https://azure.github.io/application-gateway-kubernetes-ingress/features/probes/).

This profile covers HTTP APIs and browser/OIDC traffic. AGIC's HTTP backend
setting does not configure a public gRPC route; if your integration requires
external Zitadel gRPC, have your platform team choose and verify an ingress
path that supports it.

## Deploy and verify

```bash theme={null}
helm upgrade --install qodo ./qodo-onprem \
  --kube-context "$KUBE_CONTEXT" --namespace "$NAMESPACE" \
  -f qodo-onprem/onprem-base.yaml -f my-values.yaml \
  -f ingress-azure-values.yaml
```

Define `KUBE_CONTEXT` and `NAMESPACE` as in the shared ingress page. Check
the gateway's backend health for each Service, its certificate, private
frontend, and redirect behavior. Complete SSO, portal and SDK access, and a
real webhook-driven code review. For more information, see
[Configure ingress](https://docs.qodo.ai/on-prem/ingress.md).

| Symptom | Check and recovery |
| - | - |
| Ingress is ignored | Check the AGIC class annotation, controller scope, and gateway permissions |
| `NoPrivateIP` event | Configure a private frontend or review a public exposure design before changing the private-IP annotation |
| One backend is unhealthy | Inspect its derived probe path, port, Service endpoints, and gateway-to-Pod network path |
| Login fails behind the gateway | Check TLS termination, forwarded HTTPS scheme, auth discovery, and both registered OIDC callbacks |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.