[Feature] Fleet: Hub cluster has more flexible networking configuration options
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 4d 15h
- Merged PRs (30d)
- 14
Description
There are currently limited advanced networking configuration options for Fleet Manager hub clusters (private or public) which can result in challenges in some environments.
**Note:** At present, a hub cluster doesn't run customer workloads, but we appreciate there may be cases where having additional control over networking configuration would be beneficial.
To this end, and in keeping with this original ask (see #5071), we are considering providing additional controls.
**Important:** Any properties proposed here are a subset of the options available when you configure a self-managed AKS cluster.
The following list captures current AKS configuration options being considered but is not a commitment to make any or all of them available.
- [Private custom DNS configuration](https://learn.microsoft.com/en-us/azure/aks/private-clusters?pivots=azure-cli#hub-and-spoke-with-custom-dns-for-private-aks-clusters) - allow use of custom DNS resolvers (AKS Azure CLI equivalent `--private-dns-zone`)
- Set FQDN subdomain (AKS equivalent `--fqdn-subdomain`)
- Disable public FQDN - remove default public FQDN on fully private hub clusters (AKS equivalent `--disable-public-fqdn`)
- IP families to support IPv4 and IPv6 (AKS equivalent `--ip-families`)
- [Public IP Tags for nodes](https://learn.microsoft.com/en-us/azure/aks/use-node-public-ips#use-public-ip-tags-on-node-public-ips) - control routing preferences in regions with support (AKS equivalent `--node-public-ip-tags`)
- Service CIDR setting - control subnet used for services (AKS equivalent `--service-cidr` or `--service-cidrs`)
- Skip subnet role assignment - perform assignment later/out-of-band (AKS equivalent `--skip-subnet-role-assignment`)
- [API server authorized IP](https://learn.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges?pivots=azure-cli) - control where clients can connect from (AKS equivalent `--api-server-authorized-ip-ranges`)
Please leave any comments below. Your feedback will help us prioritize.
Contributor guide
Assessment
This issue has not been assessed yet.