AGC Traffic Not Flowing¶

Symptom¶

Traffic reaches the expected Application Gateway for Containers frontend or Gateway address, but requests time out, return 404 or 503, or never reach the backend pods.

Possible Causes¶

The GatewayClass, Gateway, or HTTPRoute was never accepted.
The route attached to the wrong listener or never attached at all.
Hostname, path, or namespace attachment rules do not match the request.
Backend services or endpoints are unhealthy.
Health probes are failing even though pods appear running.

Diagnosis Steps¶

flowchart TD
    A[Traffic fails through AGC] --> B[Check GatewayClass and Gateway conditions]
    B --> C{Accepted and Programmed?}
    C -->|No| D[Fix controller or listener provisioning]
    C -->|Yes| E[Inspect HTTPRoute attachment]
    E --> F{Route attached to listener?}
    F -->|No| G[Fix parentRef host or namespace rules]
    F -->|Yes| H[Check Service endpoints and probe health]
    H --> I[Fix backend or probe mismatch]

Verify the ALB controller is running.

kubectl get pods \
    --namespace kube-system

Inspect the GatewayClass.

kubectl get gatewayclass azure-alb-external \
    --output yaml

Inspect the Gateway status.

kubectl get gateways.gateway.networking.k8s.io <gateway-name> \
    --namespace <namespace> \
    --output yaml

Look for conditions such as Accepted and Programmed.

Inspect the HTTPRoute.
```
kubectl get httproutes.gateway.networking.k8s.io <route-name> \
    --namespace <namespace> \
    --output yaml
```
Confirm:
- parentRefs point at the expected Gateway,
- hostnames match the incoming request,
- listener namespace policy allows the route.

Inspect the Kubernetes backend service and endpoints.

kubectl get service <service-name> \
    --namespace <namespace> \
    --output yaml

kubectl get endpoints <service-name> \
    --namespace <namespace> \
    --output yaml

If the route and service look correct, investigate probe behavior from the AGC side and compare the probe path and port with the app's real readiness behavior.

Resolution¶

Fix Gateway listener configuration if the object was never accepted or programmed.
Fix HTTPRoute parentRefs, hostname matching, or cross-namespace attachment rules.
Correct service selectors or backend port mapping if endpoints are empty or wrong.
Align health probes with the app's actual ready endpoint.
Remove stale route objects that still bind the same host or path unexpectedly.

Prevention¶

Standardize one Gateway API pattern for host, namespace, and listener ownership.
Require health-probe review during ingress changes.
Validate Gateway and HTTPRoute conditions in CI smoke tests after deployment.
Keep a simple curl-based canary that proves end-to-end path health through AGC.