AKS Nginx ingress private and public loadbalancer config - kubernetes

Question

I have followed the docs for an AKS internal nginx ingress while still having the public one at the same time.
https://github.com/kubernetes/ingress-nginx/tree/main/charts/ingress-nginx#additional-internal-load-balancer
https://github.com/kubernetes/ingress-nginx/blob/e8e793bb6270448960d53d9c3fbaa927ce8fbe4c/charts/ingress-nginx/values.yaml#L472
controller:
service:
loadBalancerIP: x.x.x.x
internal:
enabled: true
loadBalancerIP: y.y.y.y
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
Note that my use cases are diverse:
Some services need to be accessible from both the public lb ip as well as the private lb ip
Other services need to be accessible only by 1 ip and choose which of them it is.
Based on the docs in the ingress-nginx repo, this should be possible without the need for multiple ingress controllers or objects
Following the docs I was able to create an ingress controller and an internal one in the same namespace under the same Ingress Controller (IC)
But what my problem is that I do not know how to reference the load balancers in the actual ingress objects.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: some-service
namespace: shared
labels:
app.kubernetes.io/component: udp
app.kubernetes.io/instance: some-service
app.kubernetes.io/name: some-service
annotations:
cert-manager.io/cluster-issuer: letsencrypt-dev
clusterIssuerEnv: dev
kubernetes.io/ingress.class: nginx
meta.helm.sh/release-name: some-service
meta.helm.sh/release-namespace: shared
kubernetes.io/tls-acme: "true"
spec:
tls:
- hosts:
- some-service.my-domain.com
secretName: wildcard.x.my-domain-tls-some-service
rules:
- host: some-service.my-domain.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: some-service
port:
number: 12201
The kubernetes.io/ingress.class: nginx annotation references the ingress class but it obtains only the public loadbalancer IP. How do I reference the private one and also how do I do this to be able to have both?

Answer 1

i see two options:
for your current setup create a new ingress-class for example nginx-internal and point that to your 2nd IC installation. The downside is here that you would need two ingress Manifests defined per Application bcs of the new ingressClass.
better option IMO: use one Ingress Controller (IC) installation, create two services for the IC (default one with external IP & new one as copy of the default one but with the internal IP) that are pointing to your IC installation. Now resolve some-service.my-domain.com where needed to the internal IP (DNS config).
BTW: The ingress class annotation should ne bot used anymore, there is an own field for the ingressClass now.