{"record":{"id":"7033facf4228be07","repo":"microsoft/aspire","slug":"cannot-apply-agc-applicationloadbalancer-cr-for-lb-name","errorCode":null,"errorMessage":"Cannot apply AGC ApplicationLoadBalancer CR for '{lb.Name}': kubeconfig was not set by aks-get-credentials-{Name}.","messagePattern":"Cannot apply AGC ApplicationLoadBalancer CR for '(.+?)': kubeconfig was not set by aks-get-credentials-(.+?)\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs","lineNumber":548,"sourceCode":"                    // delegation displaced the user's. Warn at deploy time so the user can\n                    // either remove the original delegation or use a separate subnet.\n                    context.Logger.LogWarning(\n                        \"AddLoadBalancer overrode an existing service delegation '{DisplacedServiceName}' \" +\n                        \"on the subnet for AGC load balancer '{LoadBalancerName}' with \" +\n                        \"'Microsoft.ServiceNetworking/trafficControllers'. AGC requires this delegation; \" +\n                        \"if you need '{DisplacedServiceName}' to remain, use a separate subnet for the load balancer.\",\n                        displaced, lb.Name, displaced);\n                }\n\n                var subnetId = await ((IValueProvider)lb.SubnetIdReference).GetValueAsync(context.CancellationToken).ConfigureAwait(false);\n                if (string.IsNullOrEmpty(subnetId))\n                {\n                    throw new InvalidOperationException(\n                        $\"Could not resolve subnet ID for AGC load balancer '{lb.Name}'.\");\n                }\n\n                var kubeConfigPath = KubernetesEnvironment.KubeConfigPath\n                    ?? throw new InvalidOperationException(\n                        $\"Cannot apply AGC ApplicationLoadBalancer CR for '{lb.Name}': \" +\n                        $\"kubeconfig was not set by aks-get-credentials-{Name}.\");\n\n                // Wait for the azure-alb-external GatewayClass to appear. The AGC ALB\n                // controller add-on installs it asynchronously, so polling is required\n                // even after the AKS cluster reports Succeeded. 10-minute budget matches\n                // the E2E test budget in KubernetesGatewayTlsDeploymentTests.cs.\n                await WaitForAzureAlbGatewayClassAsync(\n                    kubeConfigPath, context.Logger, TimeSpan.FromMinutes(10),\n                    context.CancellationToken).ConfigureAwait(false);\n\n                // Apply the ApplicationLoadBalancer CR via kubectl apply -f - using stdin\n                // so we don't need a temp file. JSON is a valid YAML subset for kubectl.\n                var manifest =\n                    $$\"\"\"\n                    {\n                      \"apiVersion\": \"alb.networking.azure.io/v1\",\n                      \"kind\": \"ApplicationLoadBalancer\",","sourceCodeStart":530,"sourceCodeEnd":566,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs#L530-L566","documentation":"Thrown by ApplyAlbCrdAsync when the Kubernetes environment's KubeConfigPath is null at the time the ApplicationLoadBalancer CR must be applied. The aks-get-credentials-{Name} pipeline step is responsible for fetching cluster credentials and setting the kubeconfig; if it did not run or did not set it, the ALB apply cannot proceed.","triggerScenarios":"Deploy reaches the AGC ALB step but KubernetesEnvironment.KubeConfigPath is still null because the aks-get-credentials-{Name} step failed, was skipped, or ran out of order.","commonSituations":"The az aks get-credentials step failed silently earlier; step ordering was customized and the credentials step was removed; the cluster was deleted between provisioning and credential fetch; permission denied to the cluster prevented kubeconfig generation.","solutions":["Check pipeline logs for the aks-get-credentials-{Name} step failure and fix its root cause (az auth, cluster state, permissions)","Ensure the get-credentials step runs before ApplyAlbCrdAsync and is not removed/reordered by custom pipeline edits","Re-run the deploy after restoring cluster access so the kubeconfig step completes","Run 'az login' and 'az aks get-credentials' manually to verify cluster access, then redeploy"],"exampleFix":"// before: customizing the pipeline and dropping the credentials step\n// after: keep ordering\n// getDestroyCredentialsStep / aks-get-credentials-{Name} must complete before apply-alb-crd","handlingStrategy":"validation","validationCode":"if (string.IsNullOrEmpty(kubernetesEnvironment.KubeConfigPath))\n    throw new InvalidOperationException(\"Run the aks-get-credentials step before applying ALB CRs.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never remove or reorder the aks-get-credentials step","Verify az auth and cluster access before deploying","Check earlier step logs for silent credential-fetch failures"],"tags":["azure","aks","kubeconfig","pipeline","agc"],"backgroundTag":"missing-credentials","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}