Cannot apply AGC ApplicationLoadBalancer CR for

Error message

Cannot apply AGC ApplicationLoadBalancer CR for '{lb.Name}': kubeconfig was not set by aks-get-credentials-{Name}.

What it means

Thrown by ApplyAlbCrdAsync when the Kubernetes environment's KubeConfigPath is null at the time the ApplicationLoadBalancer CR must be applied. The aks-get-credentials-{Name} pipeline step is responsible for fetching cluster credentials and setting the kubeconfig; if it did not run or did not set it, the ALB apply cannot proceed.

Solutions

Check pipeline logs for the aks-get-credentials-{Name} step failure and fix its root cause (az auth, cluster state, permissions)
Ensure the get-credentials step runs before ApplyAlbCrdAsync and is not removed/reordered by custom pipeline edits
Re-run the deploy after restoring cluster access so the kubeconfig step completes
Run 'az login' and 'az aks get-credentials' manually to verify cluster access, then redeploy

Example fix

// before: customizing the pipeline and dropping the credentials step
// after: keep ordering
// getDestroyCredentialsStep / aks-get-credentials-{Name} must complete before apply-alb-crd

Defensive patterns

Strategy: validation

Validate before calling

if (string.IsNullOrEmpty(kubernetesEnvironment.KubeConfigPath))
    throw new InvalidOperationException("Run the aks-get-credentials step before applying ALB CRs.");

Prevention

Never remove or reorder the aks-get-credentials step
Verify az auth and cluster access before deploying
Check earlier step logs for silent credential-fetch failures

When it happens

Trigger: Deploy reaches the AGC ALB step but KubernetesEnvironment.KubeConfigPath is still null because the aks-get-credentials-{Name} step failed, was skipped, or ran out of order.

Common situations: The az aks get-credentials step failed silently earlier; step ordering was customized and the credentials step was removed; the cluster was deleted between provisioning and credential fetch; permission denied to the cluster prevented kubeconfig generation.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/7033facf4228be07. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs:548

                    // delegation displaced the user's. Warn at deploy time so the user can
                    // either remove the original delegation or use a separate subnet.
                    context.Logger.LogWarning(
                        "AddLoadBalancer overrode an existing service delegation '{DisplacedServiceName}' " +
                        "on the subnet for AGC load balancer '{LoadBalancerName}' with " +
                        "'Microsoft.ServiceNetworking/trafficControllers'. AGC requires this delegation; " +
                        "if you need '{DisplacedServiceName}' to remain, use a separate subnet for the load balancer.",
                        displaced, lb.Name, displaced);
                }

                var subnetId = await ((IValueProvider)lb.SubnetIdReference).GetValueAsync(context.CancellationToken).ConfigureAwait(false);
                if (string.IsNullOrEmpty(subnetId))
                {
                    throw new InvalidOperationException(
                        $"Could not resolve subnet ID for AGC load balancer '{lb.Name}'.");
                }

                var kubeConfigPath = KubernetesEnvironment.KubeConfigPath
                    ?? throw new InvalidOperationException(
                        $"Cannot apply AGC ApplicationLoadBalancer CR for '{lb.Name}': " +
                        $"kubeconfig was not set by aks-get-credentials-{Name}.");

                // Wait for the azure-alb-external GatewayClass to appear. The AGC ALB
                // controller add-on installs it asynchronously, so polling is required
                // even after the AKS cluster reports Succeeded. 10-minute budget matches
                // the E2E test budget in KubernetesGatewayTlsDeploymentTests.cs.
                await WaitForAzureAlbGatewayClassAsync(
                    kubeConfigPath, context.Logger, TimeSpan.FromMinutes(10),
                    context.CancellationToken).ConfigureAwait(false);

                // Apply the ApplicationLoadBalancer CR via kubectl apply -f - using stdin
                // so we don't need a temp file. JSON is a valid YAML subset for kubectl.
                var manifest =
                    $$"""
                    {
                      "apiVersion": "alb.networking.azure.io/v1",
                      "kind": "ApplicationLoadBalancer",

View on GitHub (pinned to 25830f84bd)