Skip to content

Commit 4b0bbcb

Browse files
mbender-msmbender-ms
committed
updates for clarity and complexity. Created concept article with AI for clarity and reduced complexity
1 parent e5b8119 commit 4b0bbcb

2 files changed

Lines changed: 146 additions & 2 deletions

File tree

‎articles/application-gateway/for-containers/application-gateway-for-containers-components-v2.md‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
---
2+
title: Application Gateway for Containers components - Concept
3+
description: This article provides information about how Application Gateway for Containers accepts incoming requests and routes them to a backend target.
4+
services: application-gateway
5+
author: mbender-ms
6+
ms.service: azure-appgw-for-containers
7+
ms.topic: concept-article
8+
ms.date: 12/05/2025
9+
ms.author: mbender
10+
# Customer intent: "As a cloud architect, I want to understand the components of Application Gateway for Containers, so that I can effectively configure and manage traffic routing to backend services in my cloud deployment."
11+
---
12+
13+
# Application Gateway for Containers components
14+
15+
This article describes the components of Application Gateway for Containers and explains how it processes incoming requests and routes them to backend targets. For a general overview, see [What is Application Gateway for Containers](overview.md).
16+
17+
## Architecture overview
18+
19+
Application Gateway for Containers uses a parent-child resource model:
20+
21+
- **Parent resource**: The main Application Gateway for Containers resource deploys and manages the control plane.
22+
- **Child resources**: Associations and frontends that belong exclusively to their parent resource.
23+
24+
The control plane orchestrates proxy configuration based on your requirements.
25+
26+
## Component descriptions
27+
28+
### Frontends
29+
30+
A frontend defines where client traffic enters your Application Gateway for Containers.
31+
32+
**Key features:**
33+
- Provides a unique Azure-managed FQDN that you can use directly or reference with a CNAME record
34+
- Belongs to exactly one Application Gateway for Containers instance
35+
- Supports multiple frontends per Application Gateway for Containers
36+
- Currently doesn't support private IP addresses
37+
38+
### Associations
39+
40+
An association connects Application Gateway for Containers to your virtual network.
41+
42+
**Key features:**
43+
- Creates a 1:1 mapping between an association resource and a delegated Azure subnet
44+
- Currently limited to 1 association per Application Gateway for Containers
45+
- Provisions the data plane during creation and connects it to the specified subnet
46+
- Must be in the same region as the parent Application Gateway for Containers
47+
48+
**Subnet requirements:**
49+
- Minimum of 256 available IP addresses at provisioning time
50+
- Use a /24 subnet mask for deployments in subnets without existing resources
51+
- For multiple Application Gateway for Containers sharing a subnet, calculate required addresses as: *n* × 256 (where *n* = number of instances)
52+
53+
### ALB Controller
54+
55+
The ALB Controller is a Kubernetes deployment that manages Application Gateway for Containers configuration.
56+
57+
**Components:**
58+
- **alb-controller**: Translates Kubernetes resources (Ingress, Gateway, ApplicationLoadBalancer) into Application Gateway for Containers configuration
59+
- **alb-controller-bootstrap**: Manages Custom Resource Definitions (CRDs)
60+
61+
**Deployment:**
62+
- Install using Helm
63+
- Uses ARM and Application Gateway for Containers APIs to apply configuration changes
64+
65+
### Security policies
66+
67+
Security policies define security configurations for your Application Gateway for Containers.
68+
69+
**Key features:**
70+
- Multiple security policies can reference a single Application Gateway for Containers
71+
- Currently supports `waf` type for Web Application Firewall capabilities
72+
- Each `waf` security policy maps 1:1 to a Web Application Firewall policy resource
73+
- A single WAF policy can be referenced by multiple security policies
74+
75+
## Azure concepts
76+
77+
### Subnet delegation
78+
79+
**Microsoft.ServiceNetworking/trafficControllers** is the namespace for Application Gateway for Containers subnet delegation.
80+
81+
**Behavior:**
82+
- Delegating a subnet doesn't automatically create Application Gateway for Containers resources
83+
- Multiple subnets can use the same or different delegation settings
84+
- After delegation, only the specified service can provision resources in that subnet
85+
86+
### User-assigned managed identity
87+
88+
Managed identities eliminate the need for credential management in your code.
89+
90+
**Requirements:**
91+
- Each ALB Controller requires a user-assigned managed identity
92+
- Assign the built-in **AppGw for Containers Configuration Manager** role to the identity
93+
94+
> [!NOTE]
95+
> The **AppGw for Containers Configuration Manager** role includes [data action permissions](../../role-based-access-control/role-definitions.md#control-and-data-actions) that Owner and Contributor roles don't have. Proper role assignment is critical for ALB Controller to function correctly.
96+
97+
## Request processing
98+
99+
### How requests are accepted
100+
101+
1. **DNS resolution**: Clients resolve either:
102+
- A CNAME record pointing to the frontend's Azure-managed FQDN, or
103+
- The frontend's FQDN directly
104+
105+
2. **Request routing**: The DNS name becomes the host header in requests to Application Gateway for Containers
106+
107+
3. **Backend selection**: Routing rules evaluate the hostname to determine the appropriate backend target
108+
109+
### Protocol support
110+
111+
**Client to frontend:**
112+
- Supports both HTTP/2 and HTTP/1.1
113+
- HTTP/2 is always enabled (clients can negotiate HTTP/1.1 if preferred)
114+
115+
**Frontend to backend:**
116+
- Uses HTTP/1.1 for standard traffic
117+
- Uses HTTP/2 for gRPC traffic
118+
119+
### Request headers
120+
121+
Application Gateway for Containers adds these headers to backend requests:
122+
123+
| Header | Description | Example |
124+
|--------|-------------|---------|
125+
| **x-forwarded-for** | Chain of client and proxy IP addresses | `1.2.3.4,5.6.7.8` (client IP: 1.2.3.4, proxy IP: 5.6.7.8) |
126+
| **x-forwarded-proto** | Protocol used by the client | `http` or `https` |
127+
| **x-request-id** | Unique identifier for request correlation | `aaaa0000-bb11-2222-33cc-444444dddddd` |
128+
129+
### Timeout configuration
130+
131+
| Timeout type | Duration | Purpose |
132+
|--------------|----------|---------|
133+
| Request Timeout | 60 seconds | Maximum time to wait for backend response |
134+
| HTTP Idle Timeout | 5 minutes | Time before closing idle HTTP connections |
135+
| Stream Idle Timeout | 5 minutes | Time before closing idle HTTP streams |
136+
| Upstream Connect Timeout | 5 seconds | Time allowed to establish backend connections |
137+
138+
> [!NOTE]
139+
> The Request Timeout enforces completion within the specified time, regardless of whether data is streaming or the connection is idle. For large file downloads that exceed 60 seconds due to size or transfer speed, increase the timeout value or set it to 0 (unlimited).
140+
141+
## Related content
142+
143+
- [What is Application Gateway for Containers](overview.md)
144+
- [Deploy Application Gateway for Containers](quickstart-deploy-application-gateway-for-containers-alb-controller.md)

‎articles/application-gateway/for-containers/application-gateway-for-containers-components.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ This article provides detailed descriptions and requirements for components of A
1919
- An Application Gateway for Containers resource is an Azure parent resource that deploys the control plane.
2020
- The control plane orchestrates proxy configuration based on customer intent.
2121
- Application Gateway for Containers has two child resources: associations and frontends.
22-
- Child resources are exclusive to their parent Application Gateway for Containers and can't be referenced by another Application Gateway for Containers resource.
22+
- Child resources belong exclusively to their parent Application Gateway for Containers and can't be shared with other Application Gateway for Containers resources.
2323

2424
### Application Gateway for Containers frontends
2525

@@ -39,7 +39,7 @@ This article provides detailed descriptions and requirements for components of A
3939
- During creation of an association, the underlying data plane is provisioned and connected to a subnet within the defined virtual network's subnet.
4040
- Each association should assume at least 256 addresses are available in the subnet at time of provisioning.
4141
- A minimum /24 subnet mask for each deployment (assuming no resources are previously provisioned in the subnet).
42-
- If you provision n number of Application Gateway for Containers, with the assumption each Application Gateway for Containers contains one association, and you intend to share the same subnet, the available required addresses should be n*256.
42+
- If you plan to deploy multiple Application Gateway for Containers resources that share the same subnet, calculate the required addresses as *n×256*, where *n* equals the number of Application Gateway for Containers resources. This assumes each contains one association.
4343
- All Application Gateway for Containers association resources should match the same region as the Application Gateway for Containers parent resource.
4444

4545
### Application Gateway for Containers ALB Controller

0 commit comments

Comments
 (0)