Re-platform the app onto a private AKS cluster reachable only through an internal Application Gateway, so nothing — not the API server, not the workloads — answers on a public IP, while the team still deploys via Helm.
#containers#networking#security
LabGrumblr, a "complaints as a service" startup whose AKS demo cluster got its Kubernetes API and a Grafana pod indexed by Shodan within a week of launch.all labs
02 - Actions
score -- - -- votes
-- completed
Sign in with a real account to save ratings, completions, and share snapshots.
Stateloading
03 - Scenario
Grumblr, a "complaints as a service" startup whose AKS demo cluster got its Kubernetes API and a Grafana pod indexed by Shodan within a week of launch.
Re-platform the app onto a private AKS cluster reachable only through an internal Application Gateway, so nothing — not the API server, not the workloads — answers on a public IP, while the team still deploys via Helm.
Constraints
API server must be private — no public FQDN that resolves on the internet
Ingress terminates on an internal IP inside the VNet, not a public LB
Workload identity over secrets — no service principal passwords in tfvars
All infra in Terraform; app delivery via a Helm release in the same apply
ScenarioAZURE - intermediate
05 - Steps
STEP_01
Lay down the network
Create a resource group, a VNet, and dedicated subnets for the cluster nodes and the ingress. This is the private island everything else lives on.
Create the AKS cluster with private cluster enabled and the node subnet attached. Confirm the API server FQDN is a private DNS name, not a public one, by checking the cluster's private FQDN output.
Hint: A private cluster means your apply host has to reach the private API endpoint — run from a jumpbox/self-hosted runner inside the VNet, or peer in.
Create a user-assigned managed identity and grant it the roles the app needs, then federate it to the cluster's workload identity so a pod can assume it. No secrets land in your state or tfvars.
Deploy an Application Gateway (or AGIC) bound to the ingress subnet with a private frontend IP, so the app's ingress resolves to an in-VNet address. Nothing should land on a public load balancer.
Use a Helm release to install the application chart into the cluster, pointing the ingress annotations at the internal gateway. Verify from a VNet-connected host that the service answers and from the open internet that it does not.