You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1. You have an Azure container registry that stores container images that were deployed by using Azure…

Authorized IP address ranges directly control which external IPv4 CIDR ranges are allowed to access the AKS API server, securing the cluster's control plane to specific administrative networks. This is a straightforward configuration on an existing public AKS cluster and minimizes administrative overhead compared to other options.

An Application Gateway Ingress Controller (AGIC) manages inbound HTTP/S traffic to services *within* the AKS cluster, not administrative access to the AKS control plane itself.

While private endpoints can secure access, for the AKS API server, directly configuring authorized IP ranges on the public endpoint is simpler for restricting access based on source IPs than converting to a private cluster setup.

A private cluster removes the public endpoint for the API server, requiring private network connectivity and thus involving more complex setup and administrative effort than simply whitelisting IP ranges.