Application Gateway for Containers now supports private frontends that are reachable only through approved Azure Private Link private endpoints. This enables organizations to keep internal applications, shared services, and cross-cluster traffic on private connectivity while retaining Kubernetes-native Layer 7 routing, TLS, health probing, and Web Application Firewall capabilities.
Azure update ID: 576393
Published: Nov 2, 2026
Status: In preview
Timeline: November 2026 Preview
Product: Application Gateway
Tag: Features
Category: Networking, Security
Private ingress supports connectivity across virtual networks, subscriptions, Microsoft Entra tenants, and Azure regions without requiring VNet peering. A single Application Gateway for Containers resource can also host public and private frontends, allowing teams to use separate exposure models and security policies for different workloads.
- Remove the public IP address and direct internet path from the frontend
- Enforce access through explicitly provisioned and approved private endpoints
- Connect workloads across VNets, subscriptions, tenants, and regions, including environments with overlapping CIDR ranges
- Place an Azure Firewall, network virtual appliance, or another upstream service in front of Kubernetes workloads
Learn more:
- Private ingress with Application Gateway for Containers
- Configure private ingress with Application Gateway for Containers – Gateway API