Definition
- Azure Load Balancer – regional layer-4 balancer distributing TCP/UDP traffic by five-tuple hash, with health probes, no HTTP awareness.
- Application Gateway – regional layer-7 balancer with path-based routing, host-based routing, TLS termination, and an integrated Web Application Firewall (WAF).
- Azure Front Door – global layer-7 service using Microsoft's edge network for anycast routing, global failover, edge caching, and a global-tier WAF.
- AKS LoadBalancer Service – creating a Kubernetes Service of type LoadBalancer auto-provisions an Azure Load Balancer wired to healthy Pod endpoints.
- Composition – these services layer: Front Door globally in front of regional Application Gateways in front of AKS with Azure Load Balancers.
Imagine the National Bank of India wants to route customers efficiently. Azure Load Balancer is the doorman inside one branch who sends each customer to whichever counter is free, counting heads but not reading forms: fast and simple. Application Gateway is a smarter concierge who reads the request and sends loan questions to the loans desk and deposit questions to deposits, and also checks each visitor for trouble (the firewall). Azure Front Door is the national call-routing center that connects callers to the nearest healthy branch and reroutes to another city if one branch is down. In AKS, asking for a LoadBalancer service is like telling building management 'give me a doorman,' and they automatically install and wire one up.
Understanding the Concepts
What is Azure Load Balancer?
Azure Load Balancer operates at layer 4 (TCP/UDP). It distributes traffic by five-tuple hash (source IP, dest IP, source port, dest port, protocol) with no HTTP awareness.
Azure Load Balancer (Layer 4):
Internet
│
▼
┌──────────────────────────────┐
│ Azure Load Balancer (L4) │
│ Public IP: 20.50.100.200 │
│ 5-tuple hash distribution │
│ Health probes: TCP/HTTP │
└───┬──────────┬───────────────┘
│ │
▼ ▼
┌────────┐ ┌────────┐
│ VM 1 │ │ VM 2 │
│:8080 │ │:8080 │
└────────┘ └────────┘
Strengths: Very high throughput, low latency, simple.
Limitations: No URL-path routing, no TLS termination, no HTTP-aware rules.
Use when: Fast protocol-agnostic balancing for VMs or as AKS data-plane balancer.
What is Application Gateway?
Application Gateway operates at layer 7 (HTTP/HTTPS). It supports path-based routing, TLS termination, and an integrated WAF.
Application Gateway (Layer 7):
Internet
│
▼
┌──────────────────────────────────────┐
│ Application Gateway │
│ TLS termination (HTTPS -> HTTP) │
│ WAF: blocks SQL injection, XSS │
│ │
│ /api/v1/transfers/** -> transfer-pool│
│ /api/v1/loans/** -> loan-pool │
│ /static/** -> CDN origin │
└───┬──────────┬────────────────────────┘
│ │
▼ ▼
┌──────────┐ ┌──────────┐
│transfer-1│ │transfer-2│
└──────────┘ └──────────┘
Strengths: Path-based/host-based routing, TLS offload, WAF, autoscaling.
Use when: HTTP-aware routing, TLS offload, and firewall for regional web apps.
Critical for banking: WAF inspects for SQL injection, XSS before reaching app.
What is Azure Front Door?
Front Door is the global layer-7 entry point. It uses Microsoft's worldwide edge network for anycast routing to the nearest healthy region.
Azure Front Door (Global Layer 7): User in Mumbai ──► Edge POP Mumbai ──► Backend: India Region User in London ──► Edge POP London ──► Backend: Europe Region Features: - Anycast: connect to nearest edge POP - Split-TCP: optimize connection between edge and backend - Global failover: India Region down -> route to Europe - Edge caching: static content served from POP - Global WAF: protect at the edge
Use when: Multi-region deployment, global user base, need low latency and
regional failover. Complements, not replaces, regional App Gateway.
How does load balancing work in AKS?
In AKS, creating a Service of type LoadBalancer auto-provisions an Azure Load Balancer.
# Kubernetes Service for payment-service in AKS
apiVersion: v1
kind: Service
metadata:
name: payment-service
spec:
type: LoadBalancer
selector:
app: payment-service
ports:
- port: 80
targetPort: 8080
Expected behavior:
Azure cloud controller provisions:
- Azure Load Balancer with public IP
- Backend pool -> healthy payment-service Pods
- Health probes -> readiness checks
External traffic -> Azure LB -> healthy Pods (automatic)
How do these services compare? (comparison table)
| Service | OSI Layer | Scope | HTTP Routing | WAF | TLS Termination | Auto-provision |
|---|---|---|---|---|---|---|
| Azure Load Balancer | L4 (TCP/UDP) | Regional | No | No | No | Via AKS Service |
| Application Gateway | L7 (HTTP) | Regional | Yes (path, host) | Yes | Yes | Via AGIC |
| Azure Front Door | L7 (HTTP) | Global | Yes | Yes (global) | Yes (edge) | Manual |
| AKS LB Service | L4 | Regional | No | No | No | Automatic |
How do they compose into a tiered architecture?
These services compose into tiers rather than competing. Each tier solves a different problem.
┌─────────────────────────────────────────┐
│ AZURE FRONT DOOR (Global L7) │
│ Global routing, failover, edge cache │
│ Global WAF │
└────────┬────────────────────┬────────────┘
│ │
┌──────┴──────┐ ┌──────┴──────┐
│ India Region│ │Europe Region│
└──────┬──────┘ └──────┬──────┘
│ │
┌────────┴──────────┐ ┌──────┴──────────┐
│APP GATEWAY (L7) │ │APP GATEWAY (L7) │
│Path routing, WAF │ │Path routing, WAF│
│TLS termination │ │TLS termination │
└────────┬──────────┘ └─────────────────┘
│
┌────────┴──────────┐
│AZURE LB (L4) │
│Fast TCP balancing │
└────────┬──────────┘
│
┌────────┴──────────┐
│AKS Pods │
│payment-1, pay-2 │
└───────────────────┘
When do you use AGIC vs in-cluster ingress?
The Application Gateway Ingress Controller (AGIC) programs an Application Gateway from Kubernetes Ingress resources. An in-cluster ingress like Nginx runs inside AKS fronted by an Azure Load Balancer.
AGIC approach:
Client -> Front Door -> Application Gateway (managed by AGIC) -> Pods
Pros: WAF, TLS, Azure-managed, no in-cluster overhead
Cons: Slower config propagation, more Azure resources
In-cluster Nginx approach:
Client -> Front Door -> Azure LB -> Nginx Ingress Pod -> App Pods
Pros: Faster config, familiar Kubernetes-native
Cons: No built-in WAF, manage Nginx yourself
What should a senior engineer know?
Choose the combination based on whether you need global reach, HTTP awareness, a firewall, and Kubernetes integration. For National Bank of India, run Front Door in front of two regions, each with Application Gateway for WAF and path routing, Azure LB for the L4 data plane, and AKS for the Pods.
Visual Overview
Azure Load Balancing Tiers: GLOBAL REGIONAL L7 REGIONAL L4 KUBERNETES ┌───────────┐ ┌──────────────┐ ┌──────────────┐ ┌───────────┐ │Front Door │───►│ App Gateway │───►│ Azure LB │───►│ AKS Pods │ │ │ │ │ │ │ │ │ │Anycast │ │Path routing │ │TCP/UDP hash │ │ReadinessP │ │Failover │ │TLS offload │ │Health probes │ │kube-proxy │ │Edge cache │ │WAF │ │High thruput │ │Service │ │Global WAF │ │Autoscale │ │ │ │ │ └───────────┘ └──────────────┘ └──────────────┘ └───────────┘
Key Takeaway
Azure provides a layered set of load-balancing services, and I keep them straight by scope and OSI layer. Azure Load Balancer is a regional layer-4 service that distributes TCP/UDP traffic using a five-tuple hash with health probes. Application Gateway is a regional layer-7 service with path-based routing, TLS termination, and an integrated WAF. Azure Front Door is the global layer-7 entry point using Microsoft's edge network for anycast routing, global failover, and edge caching.
In AKS, creating a Kubernetes Service of type LoadBalancer auto-provisions an Azure Load Balancer wired to healthy Pod endpoints. For layer-7 routing inside AKS, add the Application Gateway Ingress Controller, which programs an Application Gateway from Kubernetes Ingress resources.
These services compose into a tiered architecture rather than competing. At National Bank of India, Pankaj runs Front Door in front of two regions, each with an Application Gateway for WAF and path routing, an Azure Load Balancer for fast L4 data-plane balancing, and AKS for the Pods, with health probes at every tier.
Remember one sentence: Front Door routes globally, Application Gateway does HTTP routing and WAF per region, Azure Load Balancer handles fast L4 traffic, and in AKS a LoadBalancer Service auto-provisions and wires it all to your Pods.
---