Why Our Gateway Pods Failed 60 Days After a Deploy, and How We Fixed It

We have discussed ngix/gateway deployment on aks in the below posts.

• Deploy Nginx-Gateway-Fabric
• Setup Nginx-Gateway Routes and Create Gateway Policies to Map with Ingress Nginx Annotations 

Then we fixed an issue with cert renewal at deployment as explained in the below post.

• Handle Nginx Gateway Certificate Refresh While In Place Upgrade in AKS

The nginx gateway setup explained in above posts has two parts that talk to each other over a secure connection:

• The control part (Fabric) sends configuration.
• The traffic part (nginx pods) receives it and routes user traffic.

To trust each other, both use certificates. We use cert-manager to create and renew them. There are three certificates:

1. A CA certificate. This is the "boss" certificate. It signs the other two.
2. A server certificate for the control part.
3. A client certificate for the nginx pods.