Skip to content

Network access patterns

How operators reach the Kubernetes API determines how you run kubectl and helm. Pick the pattern that matches your AKS design.

Pattern A — Private AKS API

The API server has no public endpoint. Operators connect through:

  • Corporate VPN or ExpressRoute into the VNet, or
  • A jump / bastion VM inside the VNet, or
  • Another approved private path (Azure Bastion + private IP SSH, etc.)

Implications

  • Install Helm charts from a machine that can resolve and reach the private API.
  • CI runners must sit on a network path that can reach the API, or you deploy from a jump host.
  • Application Gateway may still be public for users while the API stays private.

See Private AKS Helm guide.

Pattern B — Public AKS API

The API server is reachable over the internet (often still restricted by authorized IP ranges).

Implications

  • Laptop or CI can run az aks get-credentials and Helm directly (subject to firewall allow lists).
  • Tighten authorized networks; do not leave the API open to the world.

See Public endpoint or jump VM.

Pattern C — Public or private API with a jump VM

Even with a public API, some teams standardize on a VM inside the VNet for all cluster operations (image pulls, private DNS, Key Vault firewalls).

Implications

  • Copy kubeconfig or use managed identity on the VM.
  • Run Helm on the VM; keep secrets off developer laptops when policy requires it.

User traffic vs operator traffic

Traffic Typical path
End users → AMS UI DNS → Application Gateway → Ingress → pods
Operators → cluster API VPN / jump / public API → kubectl / helm
Pods → Azure PaaS Private endpoints or service endpoints per your design

Do not confuse “private AKS” with “private website”. You can expose AMS on a public hostname while keeping the control plane private.

Checklist before first Helm install

  • [ ] You can run kubectl get nodes successfully from the operator host
  • [ ] The operator host can pull chart packages / clone chart repos as your process requires
  • [ ] DNS for the AMS host points at the Application Gateway (or will before go-live)
  • [ ] TLS secret strategy is agreed
  • [ ] Image pull from ACR works for a test pod