Context

• AKS(Azure Kubernetes Service)
• nginx-ingress helm chart as ingress controller

What am I trying to do?

• Whitelisting IP ranges that can access service from internet through ingress controller
• Whitelisting azure network service tag "ApplicationInsightsAvailability", so availability test does not get blocked

The tests I have done

1. Test: When whitelisting service tag "ApplicationInsightsAvailability" only

controller:
  service:
    annotations:
      service.beta.kubernetes.io/azure-allowed-service-tags: "ApplicationInsightsAvailability"

This snippet is "nginx-ingress" ingress controller configuration information in yaml format

Result: The availability test traffic can reach the service

2. Test:

• Whitelisting service tag "ApplicationInsightsAvailability"
• whitelisting ip ranges

controller:
  service:
    loadBalancerSourceRanges:
    - 1.1.1.1/32 # this is a dummy ip range for demonstration
    annotations:
      service.beta.kubernetes.io/azure-allowed-service-tags: "ApplicationInsightsAvailability"

Result:

• The availability test traffic can not reach the service
• IP range whitelisting works

3. Test

• Whitelisting service tag "ApplicationInsightsAvailability"
• Manually apply ip ranges inbound security rule on NSG(Network Security Group)

Result:

• The availability test traffic can reach the service
• IP range whitelisting works

Question

What might be the cause of availability test not working?