Application Gateway for Containers responds randomly with old certificate

Question

Our Application Gateway for Containers deployed in our AKS cluster, during some specific error conditions (that we cannot quite identify) responds to customer requests with a cached version of an old certificate (expired) that do NOT exist in our cluster secrets.

How can we somehow reset/disable that cached response when something goes wrong in the cluster?

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

Run the following command to force an update to the Application Gateway configuration:

az network application-gateway frontend-cert update --gateway-name <app-gw-name> --resource-group <resource-group> --name <cert-name> --cert-file <path-to-new-cert> --cert-password <password>

Even if the certificate exists, this forces a refresh.

If you suspect a caching issue, restart the related pods in the azure-application-gateway namespace:

kubectl rollout restart deployment <app-gateway-deployment-name> -n azure-application-gateway

If using an ingress controller, redeploy it:

kubectl delete pod -l app=<ingress-controller-label> -n <namespace>

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful