Azure / Azure/bicep-extensibility
Explore capability to support AKS Cluster in Private network configuration.
- Dominant language
- C#
- Stars
- 19
- Forks
- 15
- Avg merge
- 3h 11m
- Merged PRs (30d)
- 20
Description
---
#### Question came up in community call and we have an open discussion:
- https://github.com/Azure/bicep/discussions/10055
AKS has a private mode for Network, where the API server is only available on the VNET
- It creates a Private Link Endpoint and uses an internal Private DNS zone.
#### Sample of private cluster config, relative settings.
```bicep
resource AKS 'Microsoft.ContainerService/managedClusters@2023-01-02-preview' = {
name: 'AEU1-PE-CTL-D1-aks01'
location: resourceGroup().location
properties: {
kubernetesVersion: '1.25.5'
dnsPrefix: 'aeu1-pe-ctl-d1-aks01'
fqdn: 'aeu1-pe-ctl-d1-aks01-ym7fhhfn.hcp.eastus.azmk8s.io'
azurePortalFQDN: 'fa6823048cd362cb4e384d28900ba456-priv.portal.hcp.eastus.azmk8s.io'
privateFQDN: 'aeu1-pe-ctl-d1-aks01-rmdur52z.privatelink.eastus.azmk8s.io'
publicNetworkAccess: 'Disabled'
/* --- Below is generated when setting: enablePrivateCluster: true ---
privateLinkResources: [
{
id: '${AKS.id}/privateLinkResources/management'
name: 'management'
type: 'Microsoft.ContainerService/managedClusters/privateLinkResources'
groupId: 'management'
requiredMembers: [
'management'
]
}
]
*/
apiServerAccessProfile: {
enablePrivateCluster: true
privateDNSZone: '/subscriptions/4185fa9b-f470-466a-b3ae-8e6c3314a543/resourceGroups/AEU1-PE-CTL-RG-P0/providers/Microsoft.Network/privateDnsZones/privatelink.eastus.azmk8s.io'
enablePrivateClusterPublicFQDN: true
}
}
}
```
#### Cluster API Server IP on internal network, registered in Private Zone.

1) Consider if there is any way to support extensibility to deploy to a private cluster
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the linked GitHub discussion and the private AKS configuration sample in this issue. Investigate how extensibility deployments currently reach an AKS API server and whether private DNS, private link, and disabled public access change that path. Done should be a decided, implementable approach for supporting private AKS clusters, with the required scope identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, infrastructure, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100