Ingress on AKS: App Gateway, NGINX, or Both?

Every AKS team relitigates ingress, and the debate usually misses the real question. It's not "which controller is best." It's "where do you want your routing and edge logic to live?"

Azure Application Gateway puts it in Azure. It's a managed L7 load balancer with a built-in WAF, TLS termination, and tight integration with the rest of your Azure networking. The Application Gateway Ingress Controller lets it serve your cluster directly. You're trading some flexibility for not operating the edge. Azure scales and patches it. Great when you want a WAF without running one, and when your org already lives in Azure networking.

NGINX ingress puts it in the cluster. It's portable, battle-tested, endlessly configurable, and behaves identically on any Kubernetes, which matters if you value not being welded to one cloud's edge. The cost is that you operate it: upgrades, scaling, and tuning are yours. Great when you want cluster-native control and config-as-code over every routing nuance.

Both is a legitimate answer, not a cop-out. A common shape: Application Gateway at the true edge doing WAF and TLS, forwarding to an in-cluster NGINX that handles fine-grained, fast-changing routing. You get Azure's managed edge and cluster-native flexibility, at the price of two things to understand instead of one.

The decision heuristic:

• Need an Azure-managed WAF and minimal edge ops? App Gateway.
• Need portability and total routing control? NGINX.
• Need managed edge security and cluster-native routing? Both, deliberately.

There's no universally correct pick, only the one that matches where your team wants to own complexity. Decide that first, and the controller chooses itself.