Application Gateway Ingress Controller (AGIC) Made Easy

Learn how containers differ from virtual machines, including isolation via namespaces and cgroups, lightweight portability, faster startup, and their role in microservices architectures.

Explore how microservices split a monolithic app into independent services, boosting flexibility and scalability, with containers providing portability and resilient cloud deployments.

Provision an Azure Ubuntu VM, install Docker Engine and Docker CLI, then install Azure CLI and test with hello world; manage Docker permissions and stop the VM to save costs.

Understand how Docker enables containerized apps by building images with a Dockerfile, running containers with docker run, and storing them in Docker Hub registries.

Create and test a containerized Flask web app, log request data across routes, and build, tag, push, and run its Docker image on port 80 via Docker Hub.

Discover how the Azure application gateway acts as the front door to web apps, providing load balancing, URL-based routing and security with an application firewall, with AGC integration for AKS.

Explore how Kubernetes and Azure Kubernetes Service (AKS) simplify deploying, scaling, and upgrading containerized apps; discover how the Application Gateway Ingress Controller integrates with AKS for seamless traffic management.

Explore basic Kubernetes objects like pods, deployments, services, and ingresses, and learn how an ingress controller routes external traffic using ingress class and the application gateway.

Manually create an AKS cluster and an application gateway to understand the difficulty and downsides of configuring them without AGIC.

Boost your kubectl productivity by enabling bash autocompletion and aliases (such as k for kubectl) with persistent bashrc configuration, and speed up terminal commands in VS Code using keyboard shortcuts.

Understand how AGIC integrates Azure application gateway with AKS, watching ingress and service objects to automatically configure the gateway via Azure Resource Manager.

Explore AGIC pricing with pay-as-you-go, reserved, and spot options for V2 application gateway and AKS, plus region-based costs, free Azure accounts, and fixed versus variable costs.

Learn AGIC installation methods for greenfield and brownfield deployments, using add-on or helm, and compare identities, complexity, version updates, and features like prohibited targets across AKs.

Explore networking considerations for AKS and AGIC, comparing Azure CNI and Kubenet network plugins, and how subnets, vnets, and route tables shape communication between application gateway instances, pods, and backends.

Deploy an AKS cluster with the greenfield method and the Azure CNI add-on using the Azure CLI, provisioning an application gateway within the infrastructure resource group.

Deploy an application gateway ingress controller using the brownfield method and kubenet add-on, creating a resource group, vnet, public IP, and gateway, then enable the add-on and configure subnet permissions.

Learn to deploy the application gateway ingress controller using helm with greenfield and brownfield methods, adopting workload identity (version 1.7+) for secure federated credentials and resource setup.

Learn how to stop and start the AKS cluster and application gateway to save compute costs, while understanding impacts on the control plane, IP changes, and node pools.

Learn to deploy an application in an AKS cluster and automatically configure the Azure Application Gateway with the ingress pod and AGIC, exposing the app via an ingress rule.

Understand how application gateway components—backend pool, listener, rule, backend settings, and health probes—work together to route traffic from a front-end IP to Kubernetes pods, with basic and path-based routing.

Assess application gateway backend health by evaluating health probes and monitoring server status to route traffic to healthy backends.

Learn to create an Azure Kubernetes cluster with the application gateway ingress controller, configure an application gateway with public and private frontends, and control access using ingress annotations.

Create an application gateway with a private IP only using AGIC, including enabling the preview network isolation feature, deploying with helm, and testing with nginx behind the private gateway.

Pair two Azure virtual networks using Vnet peering on the Azure Backbone Network to enable application gateway and cluster connectivity, solving backend health issues.

Learn how annotations attach metadata to Kubernetes ingresses to enable application gateway features in AGIC, translating to http settings, backend pools, listeners, and SSL/TLS for advanced routing.

Configure a custom domain with an Azure public DNS zone, delegate name servers from Namecheap, and expose your application via a domain name to the application gateway.

Configure a single application gateway to host multiple sites by creating two listeners and backend pools, updating DNS A records, and mapping Kubernetes ingresses to nginx and httpd deployments.

Host multiple subdomains on a single domain by configuring nginx and httpd via ingress, updating YAML rules, and pointing A records to the application gateway for subdomain routing.

Implement url or path based routing with an application gateway, directing requests to images and videos backends via ingress rules and Dockerized Flask apps.

Clarifies URL and path based routing in the application gateway ingress controller. Shows that paths must be defined at the application level to avoid not found and 502 errors.

Expose a web app behind AGIC by rewriting backend paths with a path prefix annotation, mapping routes for images and videos in the ingress resource.

Set and adjust rule priorities in Azure application gateway to control traffic routing between multi-site listeners, using lower values (1–20000) for higher priority, ensuring specific hosts override wildcard.

Use the hostname extension annotation to append extra hostnames to the ingress resource’s primary host, enabling subdomains like football.app.com and soccer.app.com to share identical outputs.

Use the backend host annotation to specify the hostname the application gateway uses when talking to pods, and see how hostname override directs traffic for domains like football.com and basketball.com.

Configure the front end listener with the overwrite front end port annotation to use ports other than 80 or 443 for http or https, such as 8080, then verify behavior.

Learn to use a rewrite rule set with an annotation to modify http headers, hide the user agent from logs, and apply changes to routing rules on the application gateway.

Learn to customize and test a health probe with a Node.js app, simulating readiness delays, and configure an ingress health check in AGIC using YAML annotations.

Explore how cookie based affinity pins a user session to a single backend using an affinity cookie in Azure Application Gateway, with ingress annotation and browser versus curl behavior.

Explore how connection draining in the Application Gateway gracefully handles in-progress requests during backend pool changes, using a grace period and annotations to minimize disruption and protect sessions.

Learn to set a request timeout annotation to fail long requests, with a default of 30 seconds and a 10-second example that yields a 504 gateway timeout.

Learn how to create a self-signed RSA SSL/TLS certificate for testing, generating a 365-day cert with a wildcard common name and no passphrase, and verify details with OpenSSL.

Learn how to set up and activate a bought single-domain SSL certificate, generate a CSR with OpenSSL, validate ownership, and install the certificate bundle for secure AGIC deployments.

Manually create a Let's Encrypt SSL certificate for a domain using Certbot with the DNS-01 challenge, generating a wildcard certificate and managing PEM files on an Azure VM.

Explore ssl termination at the application gateway, where https traffic is decrypted and forwarded unencrypted to backend servers, and learn how end-to-end ssl preserves encryption to the backend.

Expose web applications via https with a Kubernetes tls secret, reference it at the ingress to enable https, and use self-signed and Letsencrypt certificates with certbot.

Configure ssl redirection to forward http to https using an annotation, tls, and ingress controller routing rules that produce a http 301 moved permanently response.

Upload a certificate to the application gateway to expose https, avoiding Kubernetes secrets. Convert the key and chain to the gateway pdf format and apply via the ingress annotation.

Automate tls certificate provisioning and renewal for your app by using cert-manager with Let's Encrypt, configuring an ingress and application gateway to serve https.

Implement end-to-end ssl from the user to the application gateway and from the gateway to the backend by configuring frontend and backend certificates, secrets, and an https ingress.

Use a network security group to restrict inbound traffic to an application gateway by applying subnet-level rules with priorities, enabling gateway manager ports, while observing default inbound internet blocking.

Understand how the azure application gateway's web application firewall protects web apps from common vulnerabilities like sql injection and xss, with detection and prevention modes, policies, and custom rules.

Deploy and test a waf v2 on the application gateway with ingress exposure, enable prevention mode, verify cross-site scripting, and enable diagnostic logging to a log analytics workspace.

Create and apply a web application firewall policy on the application gateway. Block traffic from Romania using a custom geo-location rule in prevention mode to return 403.

Configure AGIC to watch only selected Kubernetes namespaces using Helm or the add-on, ensuring secure, namespace-specific resource management and predictable gateway behavior.

Learn how to share an application gateway with other Azure resources using Helm with shared set to true, and manage Azure ingress prohibited targets to protect backend pools and listeners.

Learn how to disable the AGIC managed add-on, prevent automatic application gateway deletion by removing the created by ingress app gw tag, and re-enable with the gateway ID.

Explore AGIC logging levels and verbosity options through helm and the add-on, noting default five on the add-on and configurable levels one, three, or five, Kubernetes nine levels, json output.

Learn how activity logs reveal administrative actions and resource changes for the application gateway and related resources, with Azure Monitor, alerts, and CSV export for auditing.

Explore metrics explorer and network insights in the Azure Application Gateway to monitor performance, health, and trends with charts, dashboards, and alerts.

Learn to configure diagnostic settings for Azure Application Gateway to collect access, performance, and firewall logs and route them to Log Analytics, Azure Storage, or Event Hubs for health insights.

Explore alerts in azure that monitor resource changes and problems using out-of-the-box and custom alert types. Learn how alert rules define resources, signals, and conditions, with action groups for notifications.

Create a metrics-based alert for failed requests in an application gateway, test with Nginx crash loop, and trigger email alerts using a static threshold.

Create a log based alert to detect cross-site scripting by querying logs for x attack detected, with five minute granularity and a threshold greater than zero.

Explore how availability zones and zone redundancy boost AGIC reliability for Azure Application Gateway, deploying across multiple zones and regions to reduce downtime during outages.

Specify availability zones during AKS and Application Gateway creation using the zones option in the portal and the create command; this supports templates like bicep or terraform for deployment.

Learn to use Azure Front Door to route traffic between multiple application gateways across regions, achieving high availability through latency-based routing, origin groups, and failover.

Configure a custom domain for AGIC by linking a CNAME to Azure Front Door. Validate with a DNS TXT record, then associate the endpoint and apply the Front Door certificate.