Blog Post

Core Infrastructure and Security Blog
10 MIN READ

Public and Private AKS Clusters Demystified

HoussemDellai's avatar
HoussemDellai
Icon for Microsoft rankMicrosoft
Jan 16, 2023
  Introduction  Azure Kubernetes Service (AKS) is the managed kubernetes service in Azure. It has two main components: worker nodes and control plane.  The worker nodes are the VMs where custome...
Updated Jan 17, 2023
Version 3.0
HoussemDellai
Tobmeister's avatar
Tobmeister
Copper Contributor
Feb 03, 2023

HoussemDellai, thanks so much for this article which really helped clean up the picture in my mind.

 

We tested the setup using the new API server VNet integration feature and had the following findings:

  • Everything worked as you described it.
  • We could provide access to the API server using a P2S Azure VPN gateway and peering the gateway VNet with the cluster VNet.
  • When using the "Authorized IP ranges" feature on a public VNet-integrated cluster, access via the VPN stopped working. We tried allowing the VPN Gateway VNet CIDR, VPN client IP range and more, however it seemed like API server private access was blocked by this setting. Did you come across this issue and do you have any insight on how the combination of both features (VNet integration and Authorized IP ranges) is supposed to work?

Thanks again!