Aks deployment & setup in a restricted enterprise environment

This deployment cannot be completed with only your current roles; the client and network teams must first prepare a user-assigned identity, private DNS, role assignments, and forced egress, after which you can create a one-node private AKS cluster with the script below.

Required administrator handoff

Ask the relevant teams to provide these resource IDs and complete these actions:

1. User-assigned managed identity (UAMI)
   • Create a UAMI for the AKS control plane.
   • Grant it:
     • Network Contributor on the existing AKS VNet. VNet scope is required because AKS creates the private DNS VNet link.
     • Private DNS Zone Contributor on the custom private DNS zone.
   • The private zone must be named:
     • privatelink.<region>.azmk8s.io, or
     • <subzone>.privatelink.<region>.azmk8s.io.
   Custom private DNS requires a UAMI with both permissions and cannot be changed or deleted safely after cluster creation.^1^
2. Deployment identity permissions
   • Your login or deployment service principal needs permission to create the AKS resource and assign/use the nominated UAMI.
   • Your existing roles do not permit creating RBAC assignments. Role assignment requires Microsoft.Authorization/roleAssignments/write, normally through Role Based Access Control Administrator or User Access Administrator.^2^
   • Have the identity administrator verify the exact permission for assigning the supplied UAMI to AKS.
3. Private DNS
   • Link the custom zone to the AKS VNet, or allow the AKS identity to create that link.
   • If the VNet uses corporate DNS, configure conditional forwarding for the AKS private zone to [IP Address], or use Azure DNS Private Resolver.
   • Permit DNS from every AKS node subnet to the custom DNS servers over UDP and TCP 53.^1^
4. Forced outbound path
   • Associate the precreated subnet with a route table that sends outbound traffic to the approved firewall/NVA.
   • Configure that appliance and proxy for AKS-required dependencies. Base HTTPS destinations include mcr.microsoft.com, *.data.mcr.microsoft.com, mcr-0001.mcr-msedge.net, management.azure.com, login.microsoftonline.com, packages.microsoft.com, acs-mirror.azureedge.net, and packages.aks.azure.com. Optional add-ons require additional rules.^3^
   • An HTTP proxy alone does not replace routing and firewall configuration.

Proxy configuration

Create aks-proxy-config.json:

{
  "httpProxy": "http://proxy.contoso.com:8080",
  "httpsProxy": "http://proxy.contoso.com:8080",
  "noProxy": [
    "localhost",
    "127.0.0.1",
    "[IP Address]/8",
    ".azmk8s.io"
  ]
}

Add trustedCa containing the base64-encoded PEM certificate if the proxy uses a private CA. Proxy username/password authentication, Windows node pools, and wildcard syntax such as *.contoso.com in noProxy aren't supported.^4^

Deployment script

Use non-overlapping values for SERVICE_CIDR and the existing VNet ranges:

az account set --subscription "<subscription-id>"
az version

RG="<existing-aks-rg>"
CLUSTER="aks-poc"
LOCATION="<region>"
SUBNET_ID="<existing-node-subnet-resource-id>"
IDENTITY_ID="<aks-control-plane-uami-resource-id>"
DNS_ZONE_ID="<custom-private-dns-zone-resource-id>"

az aks create \
  --resource-group "$RG" --name "$CLUSTER" --location "$LOCATION" \
  --node-count 1 --node-vm-size "<approved-vm-size>" \
  --network-plugin azure --vnet-subnet-id "$SUBNET_ID" \
  --service-cidr "<non-overlapping-service-cidr>" \
  --dns-service-ip "<address-inside-service-cidr>" \
  --enable-private-cluster --disable-public-fqdn \
  --private-dns-zone "$DNS_ZONE_ID" --assign-identity "$IDENTITY_ID" \
  --outbound-type userDefinedRouting \
  --http-proxy-config aks-proxy-config.json \
  --generate-ssh-keys

The supplied documentation does not establish the current CLI parameter for selecting the Free tier, so it should not be guessed. Check az aks create --help on the approved CLI version and add its documented Free-tier option if required by your subscription policy.

The network team should also verify that the base deployment creates no public IP or public load-balancer frontend. Workloads must not create public LoadBalancer services.

Validation and access

Management-plane validation requires only AKS read access:

az aks show -g "$RG" -n "$CLUSTER" \
  --query "{private:apiServerAccessProfile.enablePrivateCluster,fqdn:fqdn}"

az aks get-credentials and kubectl require a host connected through the VNet, VPN, ExpressRoute, peering, or Bastion, plus Azure Kubernetes Service Cluster User Role and the client-selected Kubernetes/Azure RBAC permissions. If those remain client-controlled, the client must run:

az aks get-credentials -g <resource-group> -n <cluster-name>
kubectl get nodes
kubectl describe pod -n kube-system <pod-name>

The final command should show one Ready node; pod details should contain the injected proxy environment variables.^4^

References

1. Create a private Azure Kubernetes Service (AKS) cluster (azure-cli)
2. Assign Azure roles using Azure CLI
3. Outbound network and FQDN rules for Azure Kubernetes Service (AKS) clusters
4. HTTP proxy support in Azure Kubernetes Service (AKS)