AGC Gateway fails when one of multiple Listeners has problems - Seeking multi-app configuration

Bastian Kluge 5 Reputation points
2025-04-07T15:58:15.77+00:00

Hi there,

I'm trying some first tenous steps in using Application Gateway for Container (AGC) in order to make multiple different applications running in my AKS accessible from the internet.

I use the ALB Controller which manages the Application Gateway Resources. I've defined a Gateway using multiple Listeners using individual certificates (supplied by a cert-manager)

Spec:
  Addresses:
    Type:              Hostname
    Value:             bga9d2fqf6a6bqef.fz52.alb.azure.com
  Gateway Class Name:  azure-alb-external
  Listeners:
    Allowed Routes:
      Namespaces:
        From:  All
    Name:      http-listener
    Port:      80
    Protocol:  HTTP
    Allowed Routes:
      Namespaces:
        From:  All
    Hostname:  host1.whatever.com
    Name:      my-listener1
    Port:      443
    Protocol:  HTTPS
    Tls:
      Certificate Refs:
        Group:
        Kind:   Secret
        Name:   cert-a
      Mode:     Terminate
    Allowed Routes:
      Namespaces:
        From:  All
    Hostname:  host2.whatever.com
    Name:      my-listener2
    Port:      443
    Protocol:  HTTPS
    Tls:
      Certificate Refs:
        Group:
        Kind:   Secret
        Name:   cert-b
      Mode:     Terminate

Then I can deploy some HttpRoutes in order to route the traffic to my deployed pods.

Now I've stumbled about a behaviour which irritates me massively. Whenever there is something wrong with one listener the whole gateway fails.

If I (for the sake of demonstration) delete the secret/cert-b, I'd expect the domain host2.whatever.com to be unreachable while the othe domain/listener for host1.whatever.com continues to work. But what reallyhappens is that the Gateway stops working completely, when it has issues with one listener.

From my point of view this is a strange behaviour and unless solved prevents me from using AGC as described in this scenario.

Is there another way to configure one gateway to connect multiple apps / pods to the outside without having this kind of single point of failure?

Any thoughts / ideas are appreciated!!!

Regards,
Bastian

Azure Kubernetes Service
Azure Kubernetes Service
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
2,456 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.