For years, the answer to “how do we get traffic into the cluster?” was the same in almost every team I worked with: install ingress-nginx, add a few annotations, done. It was the default in tutorials, the default in Helm charts, and on AKS it was even the engine behind the application routing add-on. ...
Part 1 introduced AppNet, while Part 2 demonstrated its use in zero-trust and multi-cluster patterns. This concluding section explores a shared AI gateway, the operational signals derived from the mesh, and the architectural tradeoffs that influence whether AppNet should be integrated into your platform. Series navigation Part 1: What AppNet is and how to get started Part 2: Zero-trust and multi-cluster patterns Part 3: AI gateway, observability and production fit Example three: a shared AI gateway that rate-limits by application AI Gateway with Per-Application Token Rate Limiting] ...
In Part 1, we discussed the AppNet architecture, setup process, and waypoint model. This second part shifts focus from mechanics to platform patterns: it covers enforcing service-to-service authorization for a payments platform, and then using AppNet across AKS clusters for active-active regional architectures. Series navigation Part 1: What AppNet is and how to get started Part 2: Zero-trust and multi-cluster patterns Part 3: AI gateway, observability and production fit Example one: Zero-trust authorization for a payments platform Zero-Trust Authorization — Payments Namespace ...
Azure Kubernetes Application Network, Part 1: What AppNet Is and How to Get Started The space between ‘we have ingress’ and ‘we run a full service mesh with sidecars on every pod’ has always been a challenging middle ground. Platform teams want encrypted east-west traffic, identity-based authorization, and good observability, but aim to avoid the CPU, memory, startup delay, and on-call burden associated with a sidecar on each workload. Security architects look for a zero-trust framework they can verify during audits, not just visual diagrams. Application developers need routing, retries, and traffic shifting without needing to understand Envoy’s internals. Meanwhile, platform engineers prefer these features as first-class Azure resources rather than managing complex Helm charts that require constant oversight. ...
Exploring the concept behind Azure’s next-generation ingress platform When Ingress Becomes Strategic There’s a moment in every Kubernetes journey when ingress stops being just a configuration detail and becomes an architectural constraint. You start with a small cluster, maybe one or two microservices, and the standard NGINX ingress controller does exactly what you expect: simple routes, basic certificates, nothing fancy. Then the platform expands. You integrate workloads across multiple regions, extend environments with Azure Container Apps, and add a service mesh, and suddenly that “temporary ingress setup” becomes a bottleneck. ...