Application
Gateway for Containers now supports private frontends that are reachable only
through approved Azure Private Link private endpoints. This enables
organizations to keep internal applications, shared services, and cross-cluster
traffic on private connectivity while retaining Kubernetes-native Layer 7
routing, TLS, health probing, and Web Application Firewall capabilities.
Private ingress supports connectivity across virtual
networks, subscriptions, Microsoft Entra tenants, and Azure regions without
requiring VNet peering. A single Application Gateway for Containers resource
can also host public and private frontends, allowing teams to use separate
exposure models and security policies for different workloads.
- Remove the public IP
address and direct internet path from the frontend
- Enforce access through
explicitly provisioned and approved private endpoints
- Connect workloads across VNets, subscriptions,
tenants, and regions, including environments with overlapping CIDR ranges
- Place an Azure Firewall,
network virtual appliance, or another upstream service in front of Kubernetes
workloads
Learn more: