Your company's security mandate requires all new AKS deployments to be private clusters, e… — Microsoft Azure Administrator (AZ-104)

Your company's security mandate requires all new AKS deployments to be private clusters, ensuring that the Kubernetes API server is accessible only within the internal network. You are preparing to deploy a private AKS cluster in a spoke virtual network named `VNet-Spoke` ( $10.240.0.0/16$ ). The Azure environment has a hub-and-spoke topology. The hub virtual network, `VNet-Hub` ( $10.100.0.0/16$ ), contains a custom DNS server running on a virtual machine at $10.100.1.4$ . `VNet-Spoke` is peered with `VNet-Hub` and is configured to use $10.100.1.4$ as its primary DNS server. You need to deploy the private AKS cluster and ensure that management clients in both `VNet-Spoke` and `VNet-Hub` can resolve the private FQDN of the AKS API server. What configuration should you implement?

Link the Azure Private DNS zone created for the AKS cluster to `VNet-Hub`, and configure a conditional forwarder on the custom DNS server to forward queries for `azmk8s.io` to $168.63.129.16$ .Cevap
B
Link the Azure Private DNS zone created for the AKS cluster to `VNet-Spoke` only, and configure a conditional forwarder on the custom DNS server to forward queries for `azmk8s.io` to the default gateway IP address of `VNet-Spoke` ( $10.240.0.1$ ).
C
Link the Azure Private DNS zone to `VNet-Spoke`, and configure a DNS forwarding rule on `VNet-Spoke` that points to the Kubernetes internal service IP address $10.0.0.10$ .
D
Configure a custom DNS zone named `privatelink.eastus.azmk8s.io` directly on the custom DNS server in `VNet-Hub` and initiate a zone transfer from the Azure DNS IP address $168.63.129.16$ .

Cevap

Link the Azure Private DNS zone created for the AKS cluster to `VNet-Hub`, and configure a conditional forwarder on the custom DNS server to forward queries for `azmk8s.io` to

168.63.129.16

For private AKS clusters, the API server is exposed via a private endpoint. The FQDN resolves to a private IP via an Azure Private DNS zone (e.g., `privatelink.<region>.azmk8s.io`). When virtual networks use custom DNS servers, these servers must forward queries for the cluster's DNS zone to the Azure recursive resolver at

168.63.129.16

. For this lookup to succeed, the Azure Private DNS zone must be linked to the virtual network hosting the custom DNS server (in this case, `VNet-Hub`).

Adım Adım Çözüm

Identify the DNS path for client machines in both virtual networks.

Since `VNet-Spoke` uses

10.100.1.4

in `VNet-Hub` as its DNS server, all client queries are processed by the custom DNS server.

Correct DNS routing requires configuration at the resolver level (the custom DNS server).

Determine where the Azure Private DNS zone must be linked.

The Private DNS zone must be linked to `VNet-Hub` because the custom DNS server query originates from `VNet-Hub` when forwarding to the Azure recursive resolver.

Azure DNS only resolves private zone records for virtual networks that are explicitly linked to that zone.

Configure the forwarding target on the custom DNS server.

Add a conditional forwarder for the domain `azmk8s.io` pointing to

168.63.129.16

This routes the private API server name resolution queries to Azure's internal resolver, which returns the private IP mapped in the linked Private DNS zone.

Anahtar Kavram

Azure Private Link DNS integration with custom DNS in a hub-and-spoke network.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru