Public Preview: Private ingress for Application Gateway for Containers

Application Gateway for Containers now supports private frontends that are reachable only through approved Azure Private Link private endpoints. This enables organizations to keep internal applications, shared services, and cross-cluster traffic on private connectivity while retaining Kubernetes-native Layer 7 routing, TLS, health probing, and Web Application Firewall capabilities. 

Private ingress supports connectivity across virtual networks, subscriptions, Microsoft Entra tenants, and Azure regions without requiring VNet peering. A single Application Gateway for Containers resource can also host public and private frontends, allowing teams to use separate exposure models and security policies for different workloads. 

• Remove the public IP address and direct internet path from the frontend 
• Enforce access through explicitly provisioned and approved private endpoints 
•  Connect workloads across VNets, subscriptions, tenants, and regions, including environments with overlapping CIDR ranges  
• Place an Azure Firewall, network virtual appliance, or another upstream service in front of Kubernetes workloads 

Learn more:   

• Private ingress with Application Gateway for Containers  
• Configure private ingress with Application Gateway for Containers - Gateway API