[WIP] New Lab - Application Gateway for Containers by mestredelpino · Pull Request #87 · Azure-Samples/aks-labs

mestredelpino · 2025-09-09T22:46:04Z

Purpose

Adding a new lab - Application Gateway for Containers

Does this introduce a breaking change?

[ ] Yes
[X] No

Pull Request Type

What kind of change does this Pull Request introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[X] Documentation content changes
[ ] Other... Please describe:

How to Test

Get the code

git clone https://github.com/mestredelpino/aks-labs
cd aks-labs
git checkout new-lab/application-gateway-for-containers
npm install

Test the code

npm start

What to Check

Verify that the following are valid:

View lab under Networking > Application Gateway for Containers
Run through lab

Other Information

Copilot

Pull Request Overview

This PR adds a new comprehensive lab documentation for Application Gateway for Containers (AGC) with Azure Kubernetes Service (AKS). The lab guides users through deploying and configuring AGC to expose applications over HTTP/HTTPS with advanced features like Web Application Firewall policies and traffic splitting for canary deployments.

Complete step-by-step guide for setting up Application Gateway for Containers with AKS
Integration with cert-manager for HTTPS certificate management using Let's Encrypt
Advanced features including WAF policy application and canary deployment implementation

docs/networking/agc-lab.md

…x highlighting

Copilot

Pull Request Overview

Copilot reviewed 1 out of 4 changed files in this pull request and generated 9 comments.

docs/networking/agc-lab.md

Copilot · 2025-09-11T09:36:05Z

docs/networking/agc-lab.md

+kind: Gateway
+metadata:
+  name: gateway-01
+  namespace: test-infra


The namespace 'test-infra' is used here, but the ApplicationLoadBalancer was created in namespace 'alb-test-infra' (line 204). This inconsistency will cause the Gateway to fail to find the referenced ALB resource.

Suggested change

namespace: test-infra

namespace: alb-test-infra

There is no namespace called "test-infra" should this be alb-test-infra instead?

Copilot · 2025-09-11T09:36:05Z

docs/networking/agc-lab.md

+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory # production endpoint
+    email: your-email@example.com


The email address should be updated to use a placeholder format that clearly indicates users need to replace it with their actual email, such as 'your-email@example.com' or 'user@domain.com'.

Suggested change

email: your-email@example.com

email: <your-email@example.com>

Should note that the user should replace you-email@example.com placeholder with a real email address otherwise this ClusterIssuer will not work

docs/networking/agc-lab.md

Copilot · 2025-09-11T09:36:06Z

docs/networking/agc-lab.md

+While the current permissions are sufficient for creating the WAF Policy, the ALB controller is unable to join the policy to the HTTP route. Add a Network Contributor role with a scope matching the WAF Policy you just created:
+
+```bash
+az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --scope $WAF_POLICY_ID --role "4d97b98b-1d4f-4787-a291-c67834d212e7" # Network Contributor


The WAF_POLICY_ID variable will contain quotes from the previous command (line 598), which will cause this role assignment to fail. This is another consequence of the missing '-o tsv' parameter in the previous command.

@copilot open a new pull request to apply changes based on this feedback

docs/networking/agc-lab.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…github.com/mestredelpino/aks-labs into new-lab/application-gateway-for-containers

pauldotyu

Have not had a chance to complete this end-to-end yet but can you review my suggestions for setup as well as some of the Copilot suggestions?

docs/networking/agc-lab.md

pauldotyu · 2025-11-03T23:31:03Z

docs/networking/agc-lab.md

+CONTROLLER_NAMESPACE='azure-alb-system'
+az aks get-credentials --resource-group $RG_NAME --name $AKS_NAME
+CLIENT_ID=$(az identity show -g $RG_NAME -n $IDENTITY_RESOURCE_NAME --query clientId -o tsv)
+helm install alb-controller oci://mcr.microsoft.com/application-lb/charts/alb-controller --namespace $HELM_NAMESPACE --version 1.7.9 --set albController.namespace=$CONTROLLER_NAMESPACE --set albController.podIdentity.clientID=$CLIENT_ID --create-namespace


There seems to be an issue with installing this version.

I replaced for latest version in the docs (1.8.12). Link to docs: https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/quickstart-deploy-application-gateway-for-containers-alb-controller?tabs=install-helm-windows

Can you please check again with the new version?

Co-authored-by: Paul Yu <paul.d.yu@gmail.com>

pauldotyu

@mestredelpino I tried to go e2e with your lab instructions but was unable to get the cert-manager to work. Can you take a look at the comments here and resolve and let me know if you are able to run through the lab e2e?

pauldotyu · 2026-01-21T01:35:43Z

docs/networking/agc-lab.md

+# Install Azure CLI extensions.
+az extension add --name alb
+```
+


Adding shared markdown to create resource group and AKS cluster.

Suggested change

<ProvisionResourceGroup />

<ProvisionAKSCluster />

pauldotyu · 2026-01-21T01:54:44Z

docs/networking/agc-lab.md

+Run the following command to create a new subnet containing at least 250 available IP addresses and enable subnet delegation for the Application Gateway for Containers association resource:
+
+```bash
+SUBNET_ADDRESS_PREFIX='10.239.1.0/24'


This subnet address prefix might not always work. The 10.239.1.0/24 network range overlaps with the aks-virtualkubelet subnet. So you might want to use 10.238.1.0/24 or revise how the user deploys AGC. IMO, I think the user should be deploying AKS into their own virtual network and subnet to avoid modifying anything in the managed resource group.

pauldotyu · 2026-01-21T02:01:41Z

docs/networking/agc-lab.md

+
+
+```bash
+kubectl get applicationloadbalancer alb-test -n alb-test-infra -o yaml -w


Should put a note after this to let folks know how long it can take to update.

pauldotyu · 2026-01-21T02:03:58Z

docs/networking/agc-lab.md

+kind: Gateway
+metadata:
+  name: gateway-01
+  namespace: test-infra


There is no namespace called "test-infra" should this be alb-test-infra instead?

pauldotyu · 2026-01-21T02:05:00Z

docs/networking/agc-lab.md

+kind: Deployment
+metadata:
+  name: ngcolor-blue
+  namespace: test-infra


There is no namespace called "test-infra" at this point. Should it be "alb-test-infra" instead?

pauldotyu · 2026-01-21T02:39:09Z

docs/networking/agc-lab.md

+kind: HTTPRoute
+metadata:
+  name: ngcolor-app
+  namespace: test-infra


There is no namespace called "test-infra" at this point. Should it be "alb-test-infra" instead?

pauldotyu · 2026-01-21T02:48:08Z

docs/networking/agc-lab.md

+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory # production endpoint
+    email: your-email@example.com


Should note that the user should replace you-email@example.com placeholder with a real email address otherwise this ClusterIssuer will not work

pauldotyu · 2026-01-21T03:01:24Z

docs/networking/agc-lab.md

+    protocol: HTTPS
+    tls:
+      certificateRefs:
+      - name: letsencrypt-secret


If you follow the instructions up until this point, the secret is never deployed

pauldotyu · 2026-01-21T03:03:04Z

docs/networking/agc-lab.md

+az network application-gateway waf-policy create \
+  --name $WAF_POLICY_NAME \
+  --resource-group $MC_RG_NAME \
+  --location $LOCATION \


$LOCATION is not set nor is needed.

Suggested change

--location $LOCATION \

pauldotyu · 2026-01-21T03:05:13Z

docs/networking/agc-lab.md

+```
+
+---
+


Should add a summary here to recap the lab and include resources to learn more.

Initial Commit: New Lab - Application Gateway for Containers

c2a935f

Copilot AI review requested due to automatic review settings September 9, 2025 22:46

mestredelpino requested a review from chzbrgr71 as a code owner September 9, 2025 22:46

mestredelpino marked this pull request as draft September 9, 2025 22:46

Copilot AI reviewed Sep 9, 2025

View reviewed changes

mestredelpino added 7 commits September 10, 2025 00:57

Extract Gateway Address (frontend) and store in env variable

3d3892e

rename http route

14e70ba

replace hard coded identity name + add 'bash' to codeblocks for synta…

eb12489

…x highlighting

define user nodepool name as an environment variable

88e8cc3

remove hardcoded hostname

9fba5ec

simplify inputs, remove hardcoding, fix waf

ee47f09

finish waf, polish lab

b9c98c3

mestredelpino marked this pull request as ready for review September 10, 2025 20:03

mestredelpino requested a review from Copilot September 11, 2025 09:31

Copilot AI reviewed Sep 11, 2025

View reviewed changes

mestredelpino and others added 6 commits September 11, 2025 17:01

Update docs/networking/agc-lab.md

4c36e27

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update docs/networking/agc-lab.md

04c6fe2

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update docs/networking/agc-lab.md

70f98be

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

add small explanation for custom hostname on httproute

af54a05

Merge branch 'new-lab/application-gateway-for-containers' of https://…

518ca5f

…github.com/mestredelpino/aks-labs into new-lab/application-gateway-for-containers

add small explanation for custom hostname on httproute

7b60177

pauldotyu requested changes Nov 3, 2025

View reviewed changes

mestredelpino and others added 6 commits November 26, 2025 12:52

Update docs/networking/agc-lab.md

a0be8bb

Co-authored-by: Paul Yu <paul.d.yu@gmail.com>

Update docs/networking/agc-lab.md

34bd2c8

Co-authored-by: Paul Yu <paul.d.yu@gmail.com>

Update docs/networking/agc-lab.md

881881c

Co-authored-by: Paul Yu <paul.d.yu@gmail.com>

Expand on identity configuration

43d9c29

Expand on identity configuration

1974a56

update alb controller version

11d9089

pauldotyu requested changes Jan 21, 2026

View reviewed changes

	email: your-email@example.com
	email: <your-email@example.com>



		```bash
		kubectl get applicationloadbalancer alb-test -n alb-test-infra -o yaml -w

		```

		---

Conversation

mestredelpino commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Does this introduce a breaking change?

Pull Request Type

How to Test

What to Check

Other Information

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pauldotyu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pauldotyu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mestredelpino commented Sep 9, 2025 •

edited

Loading