Azure / Azure/bicep-extensibility

Explore capability to support AKS Cluster in Private network configuration.

Open
#130 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
C#
Stars
19
Forks
15
Avg merge
3h 11m
Merged PRs (30d)
20

Description

---

#### Question came up in community call and we have an open discussion:
- https://github.com/Azure/bicep/discussions/10055

AKS has a private mode for Network, where the API server is only available on the VNET
- It creates a Private Link Endpoint and uses an internal Private DNS zone.

#### Sample of private cluster config, relative settings.
```bicep
resource AKS 'Microsoft.ContainerService/managedClusters@2023-01-02-preview' = {
name: 'AEU1-PE-CTL-D1-aks01'
location: resourceGroup().location
properties: {
kubernetesVersion: '1.25.5'
dnsPrefix: 'aeu1-pe-ctl-d1-aks01'
fqdn: 'aeu1-pe-ctl-d1-aks01-ym7fhhfn.hcp.eastus.azmk8s.io'
azurePortalFQDN: 'fa6823048cd362cb4e384d28900ba456-priv.portal.hcp.eastus.azmk8s.io'
privateFQDN: 'aeu1-pe-ctl-d1-aks01-rmdur52z.privatelink.eastus.azmk8s.io'
publicNetworkAccess: 'Disabled'
/* --- Below is generated when setting: enablePrivateCluster: true ---
privateLinkResources: [
{
id: '${AKS.id}/privateLinkResources/management'
name: 'management'
type: 'Microsoft.ContainerService/managedClusters/privateLinkResources'
groupId: 'management'
requiredMembers: [
'management'
]
}
]
*/
apiServerAccessProfile: {
enablePrivateCluster: true
privateDNSZone: '/subscriptions/4185fa9b-f470-466a-b3ae-8e6c3314a543/resourceGroups/AEU1-PE-CTL-RG-P0/providers/Microsoft.Network/privateDnsZones/privatelink.eastus.azmk8s.io'
enablePrivateClusterPublicFQDN: true
}
}
}
```

#### Cluster API Server IP on internal network, registered in Private Zone.

![image](https://user-images.githubusercontent.com/3605266/229678881-33de5053-8280-439d-b5b0-9affc396261e.png)

1) Consider if there is any way to support extensibility to deploy to a private cluster

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the linked GitHub discussion and the private AKS configuration sample in this issue. Investigate how extensibility deployments currently reach an AKS API server and whether private DNS, private link, and disabled public access change that path. Done should be a decided, implementable approach for supporting private AKS clusters, with the required scope identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, infrastructure, networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.