App routing: Dynatrace incompatibility with ingress-nginx 1.13.9

## Summary

There's a known incompatibility between Dynatrace and the App Routing add-on's ingress-nginx 1.13.9, which is actively rolling out as of June 2026.

## Background

The application routing add-on ships a derivative of the upstream [kubernetes/ingress-nginx](https://github.com/kubernetes/ingress-nginx) project. Per [Dynatrace's official guidance](https://docs.dynatrace.com/docs/ingest-from/setup-on-k8s/guides/deployment-and-configuration/monitoring-and-instrumentation/instrument-nginx), only the upstream Google/Kubernetes ingress controller (and certain forks) are supported by Dynatrace — derivatives of the upstream project are explicitly not supported. As a result, customers running Dynatrace alongside App Routing may see issues once their clusters pick up ingress-nginx 1.13.9.

Because Dynatrace is a self-managed third-party tool — not an AKS-managed add-on — it's outside the AKS support scope as well.

## Workarounds

While the fix is being rolled out, customers running into issues can do one of the following:

1. **Disable Dynatrace instrumentation** for the `app-routing-system` namespace

or

2. **Contact Azure support to request a subscription-level exception** from the upgrade. - ⚠️ Exceptions from upgrades will leave clusters vulnerable to CVEs addressed in the newer ingress-nginx versions, so this should be considered a temporary measure only.

1 is the recommended solution

## Mitigation in flight

We're rolling out a fix that disables automatic dynatrace injection into our managed nginx ingress controller pods. This issue will be updated as the rollout progresses.

## Affected versions

- App Routing add-on running ingress-nginx 1.13.9 (which has rolled out to some regions, but has since been stopped).