How to fix Application Gateway Ingress Controller error in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 87 views

AGIC (Application Gateway Ingress Controller) errors occur when the controller fails to synchronize Kubernetes ingress resources with Azure Application Gateway. This results in ingress resources not being applied to the gateway, causing 502 Bad Gateway errors. Common causes include permission issues, incorrect ingress annotations, or AGIC pod failures.

Quick fix

Fixes Application Gateway Ingress Controller error

kubectl get pods -n kube-system | grep agic
kubectl logs -n kube-system <agic-pod-name>
  1. Check AGIC pod status and logs
  2. Verify ingress annotations
  3. Check Application Gateway status
  4. Validate identity permissions
kubernetes — error
kubectl get pods -n kube-system | grep agic
kubectl logs -n kube-system <agic-pod-name>
Application Gateway Ingress Controller error

What this error means

This error indicates that AGIC, the controller responsible for bridging Kubernetes ingress resources and Azure Application Gateway, encountered a problem. AGIC watches your cluster for ingress resource changes and automatically configures the Application Gateway to route traffic accordingly. When AGIC fails, ingress definitions are not applied to the gateway, meaning traffic routes are not created and your applications become unreachable.

Typical symptoms

  • HTTP requests to ingress endpoints return 502 Bad Gateway or timeout
  • AGIC controller pod is stuck in CrashLoopBackOff or in non-ready state
  • Ingress resources are created but not reflected in Application Gateway configuration
  • New pod IPs are not syncing to Application Gateway backend pools
  • Routing rules are not created for defined ingress resources
  • Pod health checks are failing due to missing IP assignment from the gateway

Common causes

  1. AGIC pod not running due to startup failures or resource constraints
  2. Missing or incorrect service principal credentials configured in AGIC deployment
  3. Managed identity lacking Contributor access to the Application Gateway resource
  4. Managed identity lacking Reader access to the Application Gateway resource group
  5. Missing required ingress annotation: kubernetes.io/ingress.class: azure/application-gateway
  6. AGIC not configured to watch the namespace where ingress resources exist
  7. Using NGINX-specific annotations instead of AGIC-compatible ones
  8. Application Gateway operational state not Running (requires restart)
  9. Network connectivity issues between AKS cluster and Application Gateway
  10. Version incompatibility between AGIC and AAD Pod Identity components

How to fix "Application Gateway Ingress Controller error"

1Check AGIC pod status and logs

First, verify the AGIC controller pod is running:

bash
kubectl get pods -n kube-system | grep agic
kubectl logs -n kube-system <agic-pod-name>
2Verify ingress annotations

Ensure your ingress resources have the correct AGIC annotation:

yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
3Check Application Gateway status

Verify the Application Gateway is in Running state:

bash
az network application-gateway show --name <GATEWAY_NAME> --resource-group <RG_NAME> --query "operationalState"
4Validate identity permissions

If using managed identity, verify it has required roles:

bash
IDENTITY_ID=$(az aks show --resource-group <RG> --name <CLUSTER> --query "identity.principalId" -o tsv)
az role assignment list --assignee $IDENTITY_ID
5Enable AGIC namespace watching

Verify AGIC is configured to watch your namespaces:

bash
helm get values ingress-azure -n kube-system
6Verify AGIC configuration details

Enable verbose logging to see what AGIC is doing:

bash
kubectl set env deployment/ingress-azure -n kube-system APPGW_LOG_LEVEL=Debug
7Test connectivity to Application Gateway

Test that your ingress endpoints work:

bash
AG_IP=$(az network public-ip show --name <AG_PUBLIC_IP_NAME> --resource-group <RG_NAME> --query ipAddress -o tsv)
curl -I -H "Host: myapp.example.com" http://$AG_IP

Advanced notes

AGIC can be deployed as an AKS cluster add-on or via Helm. Switching between methods requires removing all existing resources to prevent conflicts. Managed identity replication in Entra ID can take up to 1 minute; wait before assigning roles. AAD Pod Identity (deprecated) can cause version conflicts with AGIC versions before 1.2.0-rc2.

Frequently asked questions

What does "Application Gateway Ingress Controller error" mean?
This error indicates that AGIC, the controller responsible for bridging Kubernetes ingress resources and Azure Application Gateway, encountered a problem. AGIC watches your cluster for ingress resource changes and automatically configures the Application Gateway to route traffic accordingly. When AGIC fails, ingress definitions are not applied to the gateway, meaning traffic routes are not created and your applications become unreachable.
How do I fix "Application Gateway Ingress Controller error"?
AGIC (Application Gateway Ingress Controller) errors occur when the controller fails to synchronize Kubernetes ingress resources with Azure Application Gateway. This results in ingress resources not being applied to the gateway, causing 502 Bad Gateway errors. Common causes include permission issues, incorrect ingress annotations, or AGIC pod failures.
What causes "Application Gateway Ingress Controller error"?
AGIC pod not running due to startup failures or resource constraints Missing or incorrect service principal credentials configured in AGIC deployment Managed identity lacking Contributor access to the Application Gateway resource
Is the "Application Gateway Ingress Controller error" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading