Diagram
A system architecture diagram showing an AKS private cluster where the API server is accessed via a private endpoint inside a virtual network, with management traffic from a peered network and external ingress routed through an Application Gateway.
Private Cluster Architecture and Control Plane Isolation
An Azure Kubernetes Service (AKS) private cluster ensures that your Kubernetes API server is completely isolated from the public internet. This architecture uses the Azure Container Networking Interface (CNI) to deploy both the control plane and the worker nodes inside a dedicated virtual network. Within this boundary, the API server is exposed only through a private endpoint instead of a public IP address. Consequently, clients must access the control plane using its automatically generated private IP because custom private FQDNs are not supported. This setup restricts administration capabilities strictly to users and systems located within the same virtual network or a peered network.
Domain 2 of 9
1 practice question
Practice this DomainLast updated