{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/", "slug": "dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ", "url": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/" }, "title": "Split AGIC ingress resources when backend path prefixes must differ", "summary": "The backend-path-prefix annotation affects the entire ingress resource, not just the first rule in an example.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:05+00:00", "modified_at": "2026-09-10T02:14:32+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 226, "potentially_affected": "Kubernetes ingress resources managed by Application Gateway Ingress Controller with backend path overrides.", "dse_recommendation": "Group paths by their required backend prefix before applying the ingress-level annotation.", "primary_source": { "name": "Application Gateway Ingress Controller annotations | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The AGIC backend-path-prefix annotation configures an HTTP setting with a backend path override. Microsoft warns that its single-rule example does not limit annotation scope: the annotation applies across the ingress resource and affects every specified path.

\n

Rules that need different backend path prefixes must be defined in separate ingress resources, even when they use the same service. Microsoft Learn.

\n

Applicability

\n

Review the actual AGIC ingress, all of its path rules and the backend path expected by each application. Do not transfer this annotation behavior to another ingress controller without checking its own documentation.

\n

DSE recommendation

\n

DSE recommends comparing the complete ingress rule set before adding a prefix override to fix one application path. Separate paths that require different prefixes into the documented resource arrangement, with the application owner reviewing the resulting route map. Avoid accepting a one-path test as evidence that neighboring routes retain their intended backend paths.

\n

Verification

\n

Use an approved environment to request each affected path and inspect the path actually received at the backend. Include neighboring rules sharing the original ingress and confirm the intended separation after an authorized split. Check the rendered Application Gateway configuration as well as the application response. Preserve the ingress manifests and path-by-path outcomes so later consolidation does not silently reintroduce a shared override.

\n

Official references

\n

Microsoft Learn: Application Gateway Ingress Controller annotations. Source retrieved September 9, 2026.

", "content_text": "Source facts\nThe AGIC backend-path-prefix annotation configures an HTTP setting with a backend path override. Microsoft warns that its single-rule example does not limit annotation scope: the annotation applies across the ingress resource and affects every specified path.\nRules that need different backend path prefixes must be defined in separate ingress resources, even when they use the same service. Microsoft Learn.\nApplicability\nReview the actual AGIC ingress, all of its path rules and the backend path expected by each application. Do not transfer this annotation behavior to another ingress controller without checking its own documentation.\nDSE recommendation\nDSE recommends comparing the complete ingress rule set before adding a prefix override to fix one application path. Separate paths that require different prefixes into the documented resource arrangement, with the application owner reviewing the resulting route map. Avoid accepting a one-path test as evidence that neighboring routes retain their intended backend paths.\nVerification\nUse an approved environment to request each affected path and inspect the path actually received at the backend. Include neighboring rules sharing the original ingress and confirm the intended separation after an authorized split. Check the rendered Application Gateway configuration as well as the application response. Preserve the ingress manifests and path-by-path outcomes so later consolidation does not silently reintroduce a shared override.\nOfficial references\nMicrosoft Learn: Application Gateway Ingress Controller annotations. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nThe AGIC backend-path-prefix annotation configures an HTTP setting with a backend path override. Microsoft warns that its single-rule example does not limit annotation scope: the annotation applies across the ingress resource and affects every specified path.\n\nRules that need different backend path prefixes must be defined in separate ingress resources, even when they use the same service. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations).\n\n## Applicability\n\nReview the actual AGIC ingress, all of its path rules and the backend path expected by each application. Do not transfer this annotation behavior to another ingress controller without checking its own documentation.\n\n## DSE recommendation\n\nDSE recommends comparing the complete ingress rule set before adding a prefix override to fix one application path. Separate paths that require different prefixes into the documented resource arrangement, with the application owner reviewing the resulting route map. Avoid accepting a one-path test as evidence that neighboring routes retain their intended backend paths.\n\n## Verification\n\nUse an approved environment to request each affected path and inspect the path actually received at the backend. Include neighboring rules sharing the original ingress and confirm the intended separation after an authorized split. Check the rendered Application Gateway configuration as well as the application response. Preserve the ingress manifests and path-by-path outcomes so later consolidation does not silently reintroduce a shared override.\n\n## Official references\n\n[Microsoft Learn: Application Gateway Ingress Controller annotations](https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/", "url": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Split AGIC ingress resources when backend path prefixes must differ", "item": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/", "url": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/", "headline": "Split AGIC ingress resources when backend path prefixes must differ", "description": "The backend-path-prefix annotation affects the entire ingress resource, not just the first rule in an example.", "abstract": "The backend-path-prefix annotation affects the entire ingress resource, not just the first rule in an example.", "articleBody": "Source facts\nThe AGIC backend-path-prefix annotation configures an HTTP setting with a backend path override. Microsoft warns that its single-rule example does not limit annotation scope: the annotation applies across the ingress resource and affects every specified path.\nRules that need different backend path prefixes must be defined in separate ingress resources, even when they use the same service. Microsoft Learn.\nApplicability\nReview the actual AGIC ingress, all of its path rules and the backend path expected by each application. Do not transfer this annotation behavior to another ingress controller without checking its own documentation.\nDSE recommendation\nDSE recommends comparing the complete ingress rule set before adding a prefix override to fix one application path. Separate paths that require different prefixes into the documented resource arrangement, with the application owner reviewing the resulting route map. Avoid accepting a one-path test as evidence that neighboring routes retain their intended backend paths.\nVerification\nUse an approved environment to request each affected path and inspect the path actually received at the backend. Include neighboring rules sharing the original ingress and confirm the intended separation after an authorized split. Check the rendered Application Gateway configuration as well as the application response. Preserve the ingress manifests and path-by-path outcomes so later consolidation does not silently reintroduce a shared override.\nOfficial references\nMicrosoft Learn: Application Gateway Ingress Controller annotations. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:22:05+00:00", "dateModified": "2026-09-10T02:14:32+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Split AGIC ingress resources when backend path prefixes must differ" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 226, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Application Gateway Ingress Controller annotations | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations" } } ] } }