Azure Front Door and Kubernetes Ingress: A Production Edge Architecture

Many enterprise Kubernetes platforms on Azure pair Azure Front Door with in-cluster ingress controllers such as Cilium or NGINX. Front Door handles global routing, TLS termination, custom domains, and Web Application Firewall rules; the cluster ingress routes to Services inside the VNet.

This split keeps certificate management centralized—wildcard domains for SaaS products, per-customer hostnames for multi-tenant apps—and avoids exposing kube-apiserver-managed secrets at the edge. Private Link or restricted origins ensure traffic never traverses the public internet between Front Door and AKS.

cloudstrata designs Front Door profiles with Pulumi, wires custom domains and DNS validation, and connects them to Cilium Ingress rules so new applications register hosts declaratively. The result is a repeatable edge pattern for products like Velavela, corporate sites, and client workloads alike.