Examkin

Question

Difficulty: MediumConfigure Azure Kubernetes Service (AKS)

A healthtech company is deploying a secure Azure Kubernetes Service (AKS) cluster named `aks-clinical` in a virtual network named `VNet1` (10.200.0.0/1610.200.0.0/16) to host a patient data portal. The cluster is configured as a private cluster, which creates a private endpoint for the API server in `VNet1` and associates it with a Private DNS zone.

A peered virtual network named `VNet2` (10.201.0.0/1610.201.0.0/16) contains management virtual machines that administrators use to manage Azure resources. Virtual network peering is successfully established between `VNet1` and `VNet2`.

Administrators report that the management VMs in `VNet2` cannot connect to `aks-clinical` because they are unable to resolve the fully qualified domain name (FQDN) of the AKS API server.

Which configuration step should you perform to resolve the DNS resolution issue?

  1. A
    Configure gateway transit and allow gateway transit on the virtual network peering between VNet1 and VNet2.
  2. B
    Re-deploy the AKS cluster to use the Kubenet network plugin instead of the Azure CNI network plugin.
  3. Create a virtual network link to VNet2 in the Private DNS zone associated with the AKS cluster.Answer
  4. D
    Configure the DNS server settings of VNet2 to point to the private IP address of the AKS API server.

Answer

Create a virtual network link to VNet2 in the Private DNS zone associated with the AKS cluster.
For resources in a peered virtual network to resolve the FQDN of a private AKS cluster's API server, the Private DNS zone created for the cluster must be linked to the peered virtual network (VNet2). Linking the zone allows the Azure DNS resolver (168.63.129.16168.63.129.16) in VNet2 to query the Private DNS zone and return the private IP address of the API server's private endpoint.

Step-by-Step Solution

1
Identify the resource responsible for resolving the FQDN of a private AKS cluster.
The private AKS cluster utilizes an Azure Private DNS zone (such as `privatelink.<region>.azmk8s.io`) to map the API server's FQDN to its private endpoint IP address.
By default, this zone is only linked to the virtual network where the cluster is created (VNet1).
2
Configure DNS resolution for the peered virtual network (VNet2).
A virtual network link must be added within the Private DNS zone configuration, targeting VNet2.
This link allows VMs in VNet2 using the Azure default DNS service (168.63.129.16168.63.129.16) to query the Private DNS zone and successfully resolve the FQDN to the private IP.

Key Concept

Private AKS DNS resolution and Virtual Network Link requirements.
Estimated Time:1m 30s
Rate this question

Topics

Configure Azure Kubernetes Service (AKS)

More questions from this topic