Hotspot Question You need to deploy Azure Kubernetes Service (AKS) to host an application. The solution must meet the following requirements: - Containers must only be published internally. - AKS clus

Question

Exhibit

Answer Area

• Containers must only be published internally:
  Azure Container InstancesAzure Container RegistryDockerfile
• AKS clusters must be able to create and manage containers in Azure:
  An Azure Active Directory (Azure AD) groupAn Azure Automation accountAn Azure service principal

Explanation

This question tests knowledge of AKS networking and identity/permissions configurations needed to meet specific deployment requirements for containerized applications in Azure.

Approach. For the requirement that containers must only be published internally, you should use an Internal Load Balancer - this ensures the AKS service is only accessible within the virtual network and not exposed to the public internet. For the requirement that AKS clusters must be able to create and manage containers in Azure (e.g., pulling images, creating Azure resources like load balancers, managed disks, or interacting with Azure Container Registry), you should use a Service Principal (or System-assigned Managed Identity) - this grants the AKS cluster the necessary Azure RBAC permissions to interact with Azure APIs and manage Azure resources on behalf of the cluster.

Concept tested. AKS deployment configuration: Internal Load Balancer for private/internal-only container publishing, and Service Principal or Managed Identity for enabling AKS to create and manage Azure resources such as networking components and container registries.

Reference. https://docs.microsoft.com/en-us/azure/aks/internal-lb and https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal

No community discussion yet for this question.