{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/", "slug": "dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for", "url": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/" }, "title": "Provide cluster-local certificate secrets when moving to Application Gateway for Containers", "summary": "An externally mounted Key Vault certificate is not the frontend certificate reference required by Application Gateway for Containers.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:10+00:00", "modified_at": "2026-09-10T01:40:04+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 236, "potentially_affected": "AKS services migrating frontend TLS from AGIC to Application Gateway for Containers.", "dse_recommendation": "Verify a supported cluster-local secret and its renewal path before approving frontend TLS migration.", "primary_source": { "name": "Migration Overview - Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/migrate-from-agic-to-agc", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Application Gateway for Containers requires certificates local to the AKS cluster and does not support mounting its certificates from external volumes through the Key Vault Secrets Store CSI driver. Certificates originating in Key Vault must first be synchronized into Kubernetes secrets.

\n

The migration guide shows Gateway API certificateRefs pointing to a Secret and Ingress API TLS configuration using secretName. Direct certificate upload and direct Key Vault certificate reference are not available. Microsoft Learn.

\n

Applicability

\n

Inventory the current AGIC certificate source and the intended Gateway or Ingress configuration. Distinguish the original certificate repository from the actual secret consumed by the new frontend.

\n

DSE recommendation

\n

DSE recommends reviewing certificate delivery and renewal as part of the migration acceptance criteria. Assign ownership for synchronizing approved material into the required Kubernetes secret and for updating it before expiry. Keep private-key material out of tickets and test output. Do not accept the existence of a mounted certificate elsewhere in the cluster as proof that the frontend can use it.

\n

Verification

\n

In the approved test path, inspect the frontend’s secret reference and verify the certificate presented for the intended hostname. Rehearse an authorized secret renewal and confirm the expected certificate afterward. Retain sanitized reference and certificate-identity evidence, not secret contents, before directing production clients to the new frontend.

\n

Official references

\n

Microsoft Learn: Migration Overview – Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers. Source retrieved September 9, 2026.

", "content_text": "Source facts\nApplication Gateway for Containers requires certificates local to the AKS cluster and does not support mounting its certificates from external volumes through the Key Vault Secrets Store CSI driver. Certificates originating in Key Vault must first be synchronized into Kubernetes secrets.\nThe migration guide shows Gateway API certificateRefs pointing to a Secret and Ingress API TLS configuration using secretName. Direct certificate upload and direct Key Vault certificate reference are not available. Microsoft Learn.\nApplicability\nInventory the current AGIC certificate source and the intended Gateway or Ingress configuration. Distinguish the original certificate repository from the actual secret consumed by the new frontend.\nDSE recommendation\nDSE recommends reviewing certificate delivery and renewal as part of the migration acceptance criteria. Assign ownership for synchronizing approved material into the required Kubernetes secret and for updating it before expiry. Keep private-key material out of tickets and test output. Do not accept the existence of a mounted certificate elsewhere in the cluster as proof that the frontend can use it.\nVerification\nIn the approved test path, inspect the frontend’s secret reference and verify the certificate presented for the intended hostname. Rehearse an authorized secret renewal and confirm the expected certificate afterward. Retain sanitized reference and certificate-identity evidence, not secret contents, before directing production clients to the new frontend.\nOfficial references\nMicrosoft Learn: Migration Overview – Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nApplication Gateway for Containers requires certificates local to the AKS cluster and does not support mounting its certificates from external volumes through the Key Vault Secrets Store CSI driver. Certificates originating in Key Vault must first be synchronized into Kubernetes secrets.\n\nThe migration guide shows Gateway API certificateRefs pointing to a Secret and Ingress API TLS configuration using secretName. Direct certificate upload and direct Key Vault certificate reference are not available. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/migrate-from-agic-to-agc).\n\n## Applicability\n\nInventory the current AGIC certificate source and the intended Gateway or Ingress configuration. Distinguish the original certificate repository from the actual secret consumed by the new frontend.\n\n## DSE recommendation\n\nDSE recommends reviewing certificate delivery and renewal as part of the migration acceptance criteria. Assign ownership for synchronizing approved material into the required Kubernetes secret and for updating it before expiry. Keep private-key material out of tickets and test output. Do not accept the existence of a mounted certificate elsewhere in the cluster as proof that the frontend can use it.\n\n## Verification\n\nIn the approved test path, inspect the frontend’s secret reference and verify the certificate presented for the intended hostname. Rehearse an authorized secret renewal and confirm the expected certificate afterward. Retain sanitized reference and certificate-identity evidence, not secret contents, before directing production clients to the new frontend.\n\n## Official references\n\n[Microsoft Learn: Migration Overview – Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers](https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/migrate-from-agic-to-agc). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/", "url": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Provide cluster-local certificate secrets when moving to Application Gateway for Containers", "item": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/", "url": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/", "headline": "Provide cluster-local certificate secrets when moving to Application Gateway for Containers", "description": "An externally mounted Key Vault certificate is not the frontend certificate reference required by Application Gateway for Containers.", "abstract": "An externally mounted Key Vault certificate is not the frontend certificate reference required by Application Gateway for Containers.", "articleBody": "Source facts\nApplication Gateway for Containers requires certificates local to the AKS cluster and does not support mounting its certificates from external volumes through the Key Vault Secrets Store CSI driver. Certificates originating in Key Vault must first be synchronized into Kubernetes secrets.\nThe migration guide shows Gateway API certificateRefs pointing to a Secret and Ingress API TLS configuration using secretName. Direct certificate upload and direct Key Vault certificate reference are not available. Microsoft Learn.\nApplicability\nInventory the current AGIC certificate source and the intended Gateway or Ingress configuration. Distinguish the original certificate repository from the actual secret consumed by the new frontend.\nDSE recommendation\nDSE recommends reviewing certificate delivery and renewal as part of the migration acceptance criteria. Assign ownership for synchronizing approved material into the required Kubernetes secret and for updating it before expiry. Keep private-key material out of tickets and test output. Do not accept the existence of a mounted certificate elsewhere in the cluster as proof that the frontend can use it.\nVerification\nIn the approved test path, inspect the frontend’s secret reference and verify the certificate presented for the intended hostname. Rehearse an authorized secret renewal and confirm the expected certificate afterward. Retain sanitized reference and certificate-identity evidence, not secret contents, before directing production clients to the new frontend.\nOfficial references\nMicrosoft Learn: Migration Overview – Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:10+00:00", "dateModified": "2026-09-10T01:40:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Provide cluster-local certificate secrets when moving to Application Gateway for Containers" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 236, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Migration Overview - Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/migrate-from-agic-to-agc" } } ] } }