Azure Container Apps on Arc (microsoft.app.environment extension) — Hybrid Logic App SyncTriggers fails with internal mTLS/routing defect on containerapp-controller-api

Kiran Bandaru 0 Reputation points
2026-11-09T10:47:29.73+00:00

why the Container Apps extension's internal Envoy/XDS configuration generates an unreachable/mTLS-mismatched upstream (containerapp-controller-api:8447) for the SyncTriggers control-plane call, and provide a fix or supported workaround to restore trigger synchronization without weakening the existing mTLS boundary.

Azure Logic Apps
Azure Logic Apps

An Azure service that automates the access and use of data across clouds without writing code.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gulnaz Mushtaq 490 Reputation points MVP
    2026-11-09T17:26:49.4466667+00:00

    Upgrade the Microsoft.App extension to the latest supported stable release. Microsoft introduced relevant Envoy and controller connectivity improvements in v1.47.62 and later versions.

    Confirm that containerapp-controller-api correctly exposes port 8447 and has healthy endpoints.

    Review Envoy’s generated XDS cluster configuration, focusing on the upstream address and port, SNI, trusted CA, and client certificate settings.

    If the issue persists, contact Microsoft Support to validate the extension-generated XDS configuration and recommend a supported fix or hotfix.

    Do not disable TLS verification or client-certificate authentication, and do not expose the internal controller API externally. Correct the internal upstream routing and certificate configuration while preserving the existing mTLS security boundary.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.