Your company has a Hub-and-Spoke network topology in Azure. The Hub VNet (10.100.0.0/16) h… — Microsoft Azure Administrator (AZ-104)

Your company has a Hub-and-Spoke network topology in Azure. The Hub VNet ( $10.100.0.0/16$ ) hosts custom DNS servers ( $10.100.1.4$ and $10.100.1.5$ ) that resolve corporate DNS names and forward all other requests to the Azure recursive resolver ( $168.63.129.16$ ). The Spoke VNet ( $10.200.0.0/16$ ) is peered with the Hub VNet. Virtual network peering is configured to allow forward traffic, but gateway transit is disabled. You deploy a private Azure Kubernetes Service (AKS) cluster named `aks-prod` in a subnet ( $10.200.1.0/24$ ) within the Spoke VNet. You use the default option to let Azure manage the private DNS zone, which creates a zone named `privatelink.eastus.azmk8s.io` in the node resource group. Developers working on virtual machines located in the Hub VNet report that they cannot connect to the AKS cluster because the API server fully qualified domain name (FQDN) does not resolve to a private IP address. Which of the following actions should you perform to resolve the DNS resolution issue?

Link the auto-created private DNS zone privatelink.eastus.azmk8s.io to the Hub VNet.Cevap
B
Create a virtual network link from the Spoke VNet to the auto-created private DNS zone privatelink.eastus.azmk8s.io.
C
Redeploy the AKS cluster using Kubenet networking instead of Azure CNI to expose the API server via basic routing.
D
Configure a conditional forwarding rule on the Hub VNet's custom DNS servers to route queries for azmk8s.io directly to the IP address of the AKS control plane load balancer.

Cevap

Link the auto-created private DNS zone privatelink.eastus.azmk8s.io to the Hub VNet.

For a private AKS cluster, the API server is exposed via a private endpoint. The FQDN resolves to a private IP within the AKS subnet using an Azure Private DNS Zone (`privatelink.eastus.azmk8s.io`). Since the custom DNS servers reside in the Hub VNet and forward unresolved queries to the Azure recursive resolver (

168.63.129.16

), the Hub VNet must be linked to the Private DNS Zone. This allows the Azure recursive resolver to look up records in that zone when queried by the custom DNS servers in the Hub VNet.

Adım Adım Çözüm

Identify the DNS resolution path of the client virtual machines.

VMs in the Hub VNet query the custom DNS servers (

10.100.1.4

and

10.100.1.5

Since the custom DNS servers are configured to handle DNS requests, they must be able to resolve the FQDN of the AKS private endpoint.

Determine how the custom DNS servers resolve external and Azure-specific names.

Unresolved queries are forwarded to the Azure recursive resolver at

168.63.129.16

The Azure recursive resolver can resolve private DNS zones linked to the VNet from which the query originates.

Link the Hub VNet to the private DNS zone.

The auto-created private DNS zone `privatelink.eastus.azmk8s.io` is linked to the Hub VNet.

By linking the private DNS zone to the Hub VNet, the Azure recursive resolver can resolve the private DNS records for any queries originating from the Hub VNet (including those sent by the custom DNS servers).

Anahtar Kavram

Private AKS DNS Resolution in Hub-and-Spoke Topologies

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru