What is Application Gateway for Containers?
Application Gateway for Containers is a managed application layer (layer 7) load balancing and ingress service for Kubernetes workloads. It routes HTTP, HTTPS, gRPC, and AI inference traffic to applications in Azure Kubernetes Service while Azure operates the underlying data plane outside the cluster.
You configure the service from Kubernetes using supported Ingress and Gateway API resources. This configuration model lets platform teams provide a shared Azure-managed ingress layer while application teams use Kubernetes-native resources to describe how their services receive traffic.
Per Microsoft, Application Gateway for Containers is a separate Application Gateway offering built for Kubernetes from the ground up, with a dedicated control plane and data plane shaped by learnings from the Application Gateway Ingress Controller (AGIC). ALB Controller runs in the cluster and translates Kubernetes resources such as Ingress, Gateway, HTTPRoute, and ApplicationLoadBalancer into Azure-side configuration.
Core Features
- Kubernetes-native configuration through Ingress and Gateway API resources
- Azure-operated ingress data plane outside the AKS cluster
- Layer 7 routing based on hostname, path, header, query string, method, and port
- Traffic splitting, automatic retries, health probes, autoscaling, and availability zone resiliency
- SSL termination, end-to-end SSL, mTLS, and TLS policies with ECDSA and RSA certificates
- Header rewrite, URL rewrite, URL redirect, HTTP/2, WebSocket, server-sent events, and gRPC
- Web Application Firewall (WAF) and AKS managed add-on
- AI gateway with Gateway API Inference Extension, model-aware and load-aware routing
Typical Use Cases
Ingress for AKS applications
Application teams describe how their services receive traffic using Ingress or Gateway API resources; Azure operates the data plane outside the cluster.
Shared ingress platform
Platform teams separate platform-owned ingress infrastructure from application-owned routing configuration.
Incremental adoption
Using Ingress or Gateway API resources, workloads can move to Application Gateway for Containers over time.
AI inference routing
Self-hosted model servers receive model-aware routing and request-time endpoint selection configured through the Gateway API Inference Extension; load-aware routing sends requests to the least-loaded replicas.
Benefits
- Ingress traffic stays outside the AKS cluster while Azure operates the data plane
- Kubernetes-native configuration without a proprietary configuration model
- Clear separation between platform-owned infrastructure and application-owned routing configuration
- Comprehensive application delivery controls including WAF, mTLS, and traffic splitting
- Availability zone resiliency and autoscaling in a managed service
- Support for AI inference workloads through the Gateway API Inference Extension
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports building your ingress architecture on AKS: choosing between BYO deployment and management by ALB Controller, migrating from AGIC or other ingress controllers, designing your TLS and mTLS approach, and defining WAF rule sets.
We also support your adoption of the Gateway API and inference workloads on AKS. Contact us for a no-obligation consultation.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Application Gateway for Containers?
Application Gateway for Containers is a managed application layer (layer 7) load balancing and ingress service for Kubernetes workloads. It routes HTTP, HTTPS, gRPC, and AI inference traffic to applications in Azure Kubernetes Service while Azure operates the underlying data plane outside the cluster.
How does it differ from the Application Gateway Ingress Controller (AGIC)?
Per Microsoft, Application Gateway for Containers is a separate Application Gateway offering built for Kubernetes from the ground up, with a dedicated control plane and data plane shaped by learnings from AGIC. ALB Controller runs in the cluster and translates Kubernetes configuration into Application Gateway for Containers configuration in Azure.
Which Kubernetes APIs are supported?
ALB Controller implements version v1.5 of the Gateway API with GatewayClass, Gateway, HTTPRoute, GRPCRoute, ReferenceGrant, InferencePool, and InferenceObjective. The Kubernetes Ingress API is also supported. For Gateway listeners, HTTP and HTTPS protocols and ports 80 and 443 are allowed.
What deployment strategies exist?
There are two. With 'bring your own (BYO)' you manage the Application Gateway for Containers resource, association, and frontend yourself through the Azure portal, Azure CLI, Azure PowerShell, or Terraform and reference them in the Kubernetes configuration. With 'managed by ALB Controller', the in-cluster ALB Controller owns the lifecycle of the resources, tied to the lifecycle of the ApplicationLoadBalancer custom resource.
In which regions is the service available?
Microsoft lists 24 regions, including West Europe, North Europe, Germany West Central, France Central, Switzerland North, Sweden Central, Norway East, UK South, and several regions in the Americas and Asia Pacific.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
