Provide cluster-local certificate secrets when moving to Application Gateway for Containers

Source facts

Application Gateway for Containers requires certificates local to the AKS cluster and does not support mounting its certificates from external volumes through the Key Vault Secrets Store CSI driver. Certificates originating in Key Vault must first be synchronized into Kubernetes secrets.

The migration guide shows Gateway API certificateRefs pointing to a Secret and Ingress API TLS configuration using secretName. Direct certificate upload and direct Key Vault certificate reference are not available. Microsoft Learn.

Applicability

Inventory the current AGIC certificate source and the intended Gateway or Ingress configuration. Distinguish the original certificate repository from the actual secret consumed by the new frontend.

DSE recommendation

DSE recommends reviewing certificate delivery and renewal as part of the migration acceptance criteria. Assign ownership for synchronizing approved material into the required Kubernetes secret and for updating it before expiry. Keep private-key material out of tickets and test output. Do not accept the existence of a mounted certificate elsewhere in the cluster as proof that the frontend can use it.

Verification

In the approved test path, inspect the frontend’s secret reference and verify the certificate presented for the intended hostname. Rehearse an authorized secret renewal and confirm the expected certificate afterward. Retain sanitized reference and certificate-identity evidence, not secret contents, before directing production clients to the new frontend.

Official references

Microsoft Learn: Migration Overview – Move Application Gateway Ingress Controller (AGIC) services to Application Gateway for Containers. Source retrieved September 9, 2026.