Application Gateway WAFv2 in front of an ARO cluster

Question

Application Gateway WAFv2 in front of an ARO cluster

Gabriele Trombetta 0

Hello!

is the use of an Application Gateway in front of the ARO cluster and load-balancing traffic to the exposed ARO Routes for services supported?

because on the official documentation both on

does only mention AFD (premium)

The reason why we are asking is that we have seen unofficial documentation made from a Microsoft employee regarding this scenario.

Best Regards,

Gabriele

ChaitanyaNaykodi-MSFT 27,366 Reputation points Microsoft Employee

2023-08-12T01:00:30.4233333+00:00

@Gabriele Trombetta

Welcome to the Microsoft Q&A forum. Apologies for the delayed response here.

I am reaching out to the team internally regarding this issue and will make an update here as soon as I get a response. Thank you!
ChaitanyaNaykodi-MSFT 27,366 Reputation points Microsoft Employee

2023-08-30T01:34:26.79+00:00

@Gabriele Trombetta

Thank you for your patience here and apologies for the delay.
Currently there is no official documentation for using Application Gateway with ARO cluster as backend pool. We will file a documentation request with the ARO team to validate the support and create a tutorial for this request.

Although after going through some internal requests we have seen some customers use ARO cluster as a backend pool with Application Gateway WAFv2. If you plan to move ahead with this set-up, please let us know if you face any issues. Thank you!
Gabriele Trombetta 0 Reputation points

2023-08-30T07:11:59.62+00:00

Thank you @ChaitanyaNaykodi-MSFT hope ARO team will answer cause since it's a production environment we don't want to go out of support
AirGordon 7,145 Reputation points

2023-08-30T07:29:20.2266667+00:00

It's of course possible (and supported) to use Azure Application Gateway in front of your services/ingress in ARO - however what features of Azure App Gateway are you using? Most ARO customers would use ingress for most of the features that AppGw provides.
Gabriele Trombetta 0 Reputation points

2024-10-16T07:27:09.04+00:00

Hello @ChaitanyaNaykodi-MSFT is there any update on this question ?

We just would like to understand if it is officially supported to have an ARO as a Backend for Application Gateway.
LISBOA-4826 240 Reputation points

2025-04-15T17:58:07.2133333+00:00

Hi Gabriele Trombetta •

As mentioned by AirGordon before, is possible and supported, while Azure AppGateway has te features to act as WAF. You maybe could check this option ARO+AzureFrontdoor.

https://learn.microsoft.com/en-us/azure/openshift/howto-secure-openshift-with-front-door

And to share more insights for APPGW below you can find some interesting links to you reading.

From BlackBelt team - ARO expose APPGW

https://www.redhat.com/en/blog/a-guide-to-controller-ingress-for-azure-red-hat-openshift
Gabriele Trombetta 0 Reputation points

2025-04-16T07:15:59.44+00:00

Hi, first of all LISBOA-4826 and AirGordon , thank you for your kind reply.

My concern stems from the fact that, before writing here, we opened a support ticket with Microsoft back in 2021. At that time, we were told that only Azure Front Door (AFD) was officially supported, and that Application Gateway (AGW) would probably work.

That’s why I’m still wondering why AGW isn’t “officially supported.” I’ve personally implemented dozens of them, and I can’t understand why it’s neither documented nor supported.

AFD also comes with a significant requirement: a custom domain for the ARO cluster. However, there’s no documentation on how to handle this in a brownfield deployment, where the cluster was originally set up without a custom domain.

1 answer

Your answer

ChaitanyaNaykodi-MSFT 27,366 Reputation points Microsoft Employee

2023-08-12T01:00:30.4233333+00:00

@Gabriele Trombetta

Welcome to the Microsoft Q&A forum. Apologies for the delayed response here.

I am reaching out to the team internally regarding this issue and will make an update here as soon as I get a response. Thank you!
ChaitanyaNaykodi-MSFT 27,366 Reputation points Microsoft Employee

2023-08-30T01:34:26.79+00:00

@Gabriele Trombetta

Thank you for your patience here and apologies for the delay.
Currently there is no official documentation for using Application Gateway with ARO cluster as backend pool. We will file a documentation request with the ARO team to validate the support and create a tutorial for this request.

Although after going through some internal requests we have seen some customers use ARO cluster as a backend pool with Application Gateway WAFv2. If you plan to move ahead with this set-up, please let us know if you face any issues. Thank you!
Gabriele Trombetta 0 Reputation points

2023-08-30T07:11:59.62+00:00

Thank you @ChaitanyaNaykodi-MSFT hope ARO team will answer cause since it's a production environment we don't want to go out of support
AirGordon 7,145 Reputation points

2023-08-30T07:29:20.2266667+00:00

It's of course possible (and supported) to use Azure Application Gateway in front of your services/ingress in ARO - however what features of Azure App Gateway are you using? Most ARO customers would use ingress for most of the features that AppGw provides.
Gabriele Trombetta 0 Reputation points

2024-10-16T07:27:09.04+00:00

Hello @ChaitanyaNaykodi-MSFT is there any update on this question ?

We just would like to understand if it is officially supported to have an ARO as a Backend for Application Gateway.
LISBOA-4826 240 Reputation points

2025-04-15T17:58:07.2133333+00:00

Hi Gabriele Trombetta •

As mentioned by AirGordon before, is possible and supported, while Azure AppGateway has te features to act as WAF. You maybe could check this option ARO+AzureFrontdoor.

https://learn.microsoft.com/en-us/azure/openshift/howto-secure-openshift-with-front-door

And to share more insights for APPGW below you can find some interesting links to you reading.

From BlackBelt team - ARO expose APPGW

https://www.redhat.com/en/blog/a-guide-to-controller-ingress-for-azure-red-hat-openshift
Gabriele Trombetta 0 Reputation points

2025-04-16T07:15:59.44+00:00

Hi, first of all LISBOA-4826 and AirGordon , thank you for your kind reply.

My concern stems from the fact that, before writing here, we opened a support ticket with Microsoft back in 2021. At that time, we were told that only Azure Front Door (AFD) was officially supported, and that Application Gateway (AGW) would probably work.

That’s why I’m still wondering why AGW isn’t “officially supported.” I’ve personally implemented dozens of them, and I can’t understand why it’s neither documented nor supported.

AFD also comes with a significant requirement: a custom domain for the ARO cluster. However, there’s no documentation on how to handle this in a brownfield deployment, where the cluster was originally set up without a custom domain.

Answer 1

Hi Gabriele Trombetta •

As mentioned by AirGordon before, is possible and supported, while Azure AppGateway has te features to act as WAF. You maybe could check this option ARO+AzureFrontdoor.

https://learn.microsoft.com/en-us/azure/openshift/howto-secure-openshift-with-front-door

And to share more insights for APPGW below you can find some interesting links to you reading.

From BlackBelt team - ARO expose APPGW

https://www.redhat.com/en/blog/a-guide-to-controller-ingress-for-azure-red-hat-openshift

Share via

Application Gateway WAFv2 in front of an ARO cluster

1 answer

Your answer