AZ-500 Question 122
Select 2You manage an AKS cluster that hosts multiple workloads for different departments. The cluster’s API server must not be reachable from the public internet, and each workload must be prevented from communicating with services in other namespaces. Which two steps should you implement to achieve these requirements?
- A
Create the AKS cluster in private mode so that the API server is accessible only via an internal IP address.
- B
Deploy an internet-facing public load balancer to route external traffic to the cluster API server.
- C
Enable Azure or Calico Network Policies on the AKS cluster and create rules to block inter-namespace traffic.
- D
Open the AKS control plane to all inbound ports, then apply custom firewall configurations on the AKS nodes.
Show answer and explanation
Correct answers: A, C
Explanation
To isolate an AKS cluster from the public internet, you should deploy it as a private cluster, which uses an internal IP address for the API server and restricts access to the virtual network. In addition, using Azure or Calico Network Policies enables you to define fine-grained rules that allow traffic only where it is explicitly needed, preventing cross-namespace communication by default. For more details, refer to the Microsoft documentation on 'Create a private Azure Kubernetes Service cluster' and 'Use network policies in Azure Kubernetes Service (AKS)'.
- A. Correct.
Correct. Configuring the AKS cluster in private mode ensures that the API server is only accessible through a private IP within the virtual network. This prevents public internet access while still allowing internal resources to connect.
- B. Incorrect.
Incorrect. A public load balancer would expose the API server to the internet, contradicting the requirement to keep the cluster inaccessible from public endpoints.
- C. Correct.
Correct. Enabling a network policy solution (Azure or Calico) and creating rules to isolate namespaces ensures workloads cannot communicate with other namespaces unless explicitly allowed.
- D. Incorrect.
Incorrect. Opening the AKS control plane to all inbound ports provides no effective security and does not prevent public access. This contradicts the requirement for private access only.