# Provide cluster-local certificate secrets when moving to Application Gateway for Containers

> An externally mounted Key Vault certificate is not the frontend certificate reference required by Application Gateway for Containers.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:10+00:00
- Modified: 2026-09-10T01:40:04+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

An externally mounted Key Vault certificate is not the frontend certificate reference required by Application Gateway for Containers.

## Potentially affected

AKS services migrating frontend TLS from AGIC to Application Gateway for Containers.

## DSE recommendation

Verify a supported cluster-local secret and its renewal path before approving frontend TLS migration.

## Article

## Source facts

Application Gateway for Containers requires certificates local to the AKS cluster and does not support mounting its certificates from external volumes through the Key Vault Secrets Store CSI driver. Certificates originating in Key Vault must first be synchronized into Kubernetes secrets.

The migration guide shows Gateway API certificateRefs pointing to a Secret and Ingress API TLS configuration using secretName. Direct certificate upload and direct Key Vault certificate reference are not available. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/migrate-from-agic-to-agc).

## Applicability

Inventory the current AGIC certificate source and the intended Gateway or Ingress configuration. Distinguish the original certificate repository from the actual secret consumed by the new frontend.

## DSE recommendation

DSE recommends reviewing certificate delivery and renewal as part of the migration acceptance criteria. Assign ownership for synchronizing approved material into the required Kubernetes secret and for updating it before expiry. Keep private-key material out of tickets and test output. Do not accept the existence of a mounted certificate elsewhere in the cluster as proof that the frontend can use it.

## Verification

In the approved test path, inspect the frontend’s secret reference and verify the certificate presented for the intended hostname. Rehearse an authorized secret renewal and confirm the expected certificate afterward. Retain sanitized reference and certificate-identity evidence, not secret contents, before directing production clients to the new frontend.

## Official references

[Microsoft Learn: Migration Overview – Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers](https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/migrate-from-agic-to-agc). Source retrieved September 9, 2026.

## Primary reference

- Name: Migration Overview - Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/migrate-from-agic-to-agc
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Provide cluster-local certificate secrets when moving to Application Gateway for Containers,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-346-provide-cluster-local-certificate-secrets-when-moving-to-application-gateway-for/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.