connect application gateway for containers to frontdoor

Continuing from above..

Step 7: Create the Application Gateway for Containers (AGC) Resource

Now that the ALB controller is running in your AKS cluster, the next step is to provision the Application Gateway for Containers (AGC) resource via the Azure Portal.

Create AGC Resource

1. In the Azure Portal, search for “Application Gateway for Containers” and click “+ Create”.
2. Fill in the basic details:

• Name: agc-demo
  • Region: Select the same region used for your AKS cluster (e.g., East US)

Refer to the screenshot below for a visual reference:

Configure Frontend

1. Navigate to the Frontends tab.
2. Click “+ Add”, then:

• Name: frontend
  • You can either assign a custom domain or use the auto-generated FQDN provided by Azure.

Refer to the screenshot below for a visual reference:

Set Up Association

1. Go to the Associations tab and click “+ Add”.
2. Fill in the following:

• Name: association-01
  • ⁠Virtual Network: Choose the existing VNet that contains your AKS and AGC subnet
    • Subnet: Select the previously created subnet-alb (delegated for AGC)
      1. Click Create to deploy the AGC resource.

Refer to the screenshot below for a visual reference:

Post-Deployment: Copy FQDN

Once deployment is complete:

• Navigate to your AGC resource in the portal.
• Go to the Frontends tab.
• Copy the FQDN (Fully Qualified Domain Name) — you’ll use this to access your application externally.

Refer to the screenshot below for a visual reference:

Tip: This FQDN serves as the public entry point to your services exposed via AGC.

Step 8: Create Gateway and Routing with YAML

1. In the Azure Portal, navigate to your AKS Cluster → Click “Connect” from the top menu.
2. In the "Connect to AKS" panel, choose the Cloud Shell tab.
3. Click “Open Cloud Shell” – this will automatically open a terminal at the bottom of the portal.

Now that the AGC is set up and the backend services are defined, let’s configure how traffic flows using three YAML files:

Detailed YAML files and kubectl commands provided below.  

1. gateway.yaml – Connects AGC to the Kubernetes Gateway API  

To define the gateway configuration, use the following command to open and edit the gateway.yaml file:

vim gateway.yaml 

This command opens the file in the terminal-based text editor vim, allowing you to insert the following configuration:    

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
 name: gateway-01
 namespace: default
 annotations:
  alb.networking.azure.io/alb-id: <AGC_RESOURCE_ID>
spec:
 gatewayClassName: azure-alb-external
 listeners:
   - name: http-listener
     port: 80
     protocol: HTTP
     allowedRoutes:
       namespaces:
         from: Same
 addresses:
   - type: alb.networking.azure.io/alb-frontend
     value: frontend

Replace <AGC_RESOURCE_ID> with the actual Application Gateway for Containers resource ID from the Azure portal.

 

Deploying Gateway API Resource

I created a gateway.yaml file to define the Gateway resource that binds the listener, port, and routes. After applying it with kubectl apply -f gateway.yaml, I verified the deployment using kubectl get gateway gateway-01 -o yaml, confirming that the Gateway was successfully created with HTTP protocol on port 80 and was linked to the azure-alb-frontend listener.**Step 8: Create Gateway and Routing with YAML

Refer to the screenshot below for a visual reference:

---

1. httproute.yaml – Specifies the routing logic to backend services

Defining the Route:

I started by creating an httproute.yaml file, which defines how traffic is routed within the Kubernetes cluster using the Gateway API. This route specifies the rules to forward HTTP requests to the correct backend services.

To define the HTTPRoute configuration, use the following command to open and edit the Httproute.yaml file:

vim Httproute.yaml 

This command opens the file in the terminal-based text editor vim, allowing you to insert the following configuration:  

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
 name: my-http-route
 namespace: default
spec:
 parentRefs:
   - name: gateway-01
 rules:
   - backendRefs:
       - name: backend-v1
         port: 8080
       - name: backend-v2
         port: 8080

 

Applying the HTTPRoute Configuration:

 

Using the command kubectl apply -f httproute.yaml, I created a custom route (my-http-route) in the cluster. This route is managed by the Gateway controller deployed through AGC

Refer to the screenshot below for a visual reference:

3. backend.yaml – Deploys sample NGINX services as your application backend

 

Deploying Backend Services:

I created a backend.yaml file with two versions of a sample backend service: backend-v1 and backend-v2. Each version has its own deployment and service object.

To define the backend web server configuration, use the following command to open and edit the backend.yaml file:

vim backend.yaml 

This command opens the file in the terminal-based text editor vim, allowing you to insert the following configuration:

apiVersion: apps/v1
kind: Deployment
metadata:
 name: backend-v1
spec:
 replicas: 2
 selector:
   matchLabels:
     app: backend-v1
 template:
   metadata:
     labels:
       app: backend-v1
   spec:
     containers:
       - name: backend-v1
         image: nginx
         ports:
           - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
 name: backend-v1
spec:
 selector:
   app: backend-v1
 ports:
   - port: 8080
     targetPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
 name: backend-v2
spec:
 replicas: 2
 selector:
   matchLabels:
     app: backend-v2
 template:
   metadata:
     labels:
       app: backend-v2
   spec:
     containers:
       - name: backend-v2
         image: nginx
         ports:
           - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
 name: backend-v2
spec:
 selector:
   app: backend-v2
 ports:
   - port: 8080
     targetPort: 80

 

Applying the Backend Deployments:

 

Running kubectl apply -f backend.yaml deployed both backend-v1 and backend-v2 along with their associated Kubernetes services. These are the actual application endpoints that the AGC will route traffic to, based on the HTTPRoute configuration. 

Refer to the screenshot below for a visual reference: Step 9: Test

1. Go to AGC > Frontends > Copy the FQDN
2. Open browser:

Refer to the screenshot below for a visual reference:

  

Output: I can now successfully access the backend service over the internet.  

Refresh multiple times – you should see responses alternating from backend-v1 and backend-v2.  

Step 10: Create Azure Front Door

 

• In the Azure Portal, search for “Front Door” and click “+ Create”.
• Choose the Front Door Standard or Premium SKU.
• Fill in the following on the Basics tab:  ○ Resource Group: Select an existing one or create a new one  ○ Region: Choose a supported region (e.g., East US)  ○ Name: Provide a name for your Front Door instance
• Click Next to continue with further configuration   

 

Refer to the screenshot below for a visual reference:

 

 

Step 11: Add an Endpoint

 

1. Navigate to the Endpoint tab and click “Add an endpoint”.
2. Fill in the following:  ○ Endpoint name: Provide a unique name (e.g., myappendpoints)  ○ Enable this endpoint: Ensure this checkbox is selected
3. Click Add to create the endpoint.

 

Refer to the screenshot below for a visual reference:

  Step 12: Configure Route

 

1. Under the Routing rules tab, click “+ Add a route”.
2. Fill in the following details:  ○ Name: route-to-agc  ○  Endpoint: Select your previously created Front Door endpoint  ○ Accepted protocols: Check both HTTP and HTTPS  ○  Patterns to match: /*
3. Origin Group: Add a new origin group (As shown in the below screenshot)

 

Under the Forwarding section: Match Incoming request Click  Add to save the routing rule.

 

Refer to the screenshot below for a visual reference:

 

Step 13: Add AGC as Backend Origin

 

1. Navigate to the Origin group tab and click “+ Add origin”.
2. Configure the following settings:  ○ Origin name: agc-backend  ○  Origin type: Custom   ○  Hostname: Paste the AGC FQDN (e.g., abcd1234.alb.azure.com)  ○ HTTP Port: 80 or select HTTPS (443) depending on your app configuration ○ Priority / Weight: Leave the default values
3. Click Add to register the AGC as the backend origin.  

 

Refer to the screenshot below for a visual reference:

Step 14: Test Access via Front Door

1. Navigate to your Front Door resource and go to the Overview tab.
2. Copy the Front Door endpoint (e.g., myfrontdoor.azurefd.net).
3. Open a browser and access the application using the URL: http://<your-frontdoor-name>.azurefd.net  

 

Refer to the screenshot below for a visual reference:

 

You should see your backend AKS application loading successfully through AGC.