Readiness check

Private AKS with Application Gateway WAF ingress

A Kubernetes cluster on Azure with no public API server. Traffic enters through Application Gateway WAF v2, reaches the cluster over private networking, and pulls secrets and certificates from Key Vault.

Book an assessment Read the payments case study
Fee
Set after an architecture assessment
API server
Private, no public endpoint
Ingress
Application Gateway WAF v2
Node pools
Three availability zones

How traffic reaches the cluster

Client requests terminate at Application Gateway WAF v2. Traffic is inspected, decrypted with your TLS certificates, and forwarded privately to the ingress controller inside the virtual network.

graph LR subgraph Internet["Public internet"] User["Clients and users"] end subgraph Edge["Edge"] WAF["Application Gateway WAF v2
OWASP 3.2 rules, bot protection, TLS offload"] end subgraph VNet["Private virtual network"] subgraph IngressSubnet["Ingress subnet"] Ingress["Internal ingress controller
NGINX, Contour, or AGIC"] end subgraph NodeSubnet["Node subnet"] Nodes["Private AKS system and user node pools
Availability zones 1, 2, 3"] Pods["Application workloads"] end subgraph ControlPlane["Control plane"] APIServer["Private Kubernetes API server
Private DNS zone"] end end subgraph Platform["Azure platform services"] KV["Azure Key Vault
CSI secret store provider"] ACR["Azure Container Registry
private endpoint"] LogA["Log Analytics and Defender"] end User -->|"HTTPS 443"| WAF WAF -->|"Private network"| Ingress Ingress --> Pods Nodes -.->|"Private Link"| APIServer Pods -.->|"Managed identity"| KV Nodes -.->|"Private endpoint"| ACR Nodes -.->|"Diagnostics"| LogA
Solid lines carry client traffic; dashed lines are private platform connections.

A private control plane by design

Node pools reach platform services through private endpoints. The API server has no public IP address, so internet scanners and direct denial-of-service traffic cannot reach it.

Mapped to the Well-Architected pillars

Each design decision is mapped to one of the five pillars of the Microsoft Azure Well-Architected Framework.

  • Security

    • Private Kubernetes API server with Azure private DNS
    • Application Gateway WAF v2 with OWASP 3.2 rules
    • Key Vault CSI driver for secret rotation
    • Microsoft Defender for Containers enabled

  • Reliability

    • Node pools spread across availability zones 1, 2, and 3
    • Pod disruption budgets and anti-affinity rules
    • Surge upgrade settings that keep workloads available during node upgrades
    • AKS Standard tier with the Azure uptime SLA

  • Performance efficiency

    • Azure CNI Overlay networking with Cilium
    • Ephemeral OS disks for faster node provisioning
    • Horizontal Pod Autoscaler
    • HTTP/2 and TLS 1.3 on Application Gateway

  • Operational excellence

    • Container Insights with Prometheus and Grafana
    • Repeatable, reviewable deployments
    • Operator runbooks and rollback procedures
    • Vulnerability scanning on container images

  • Cost optimization

    • Cluster Autoscaler scales down unused node pools
    • Spot node pools for batch and worker workloads
    • Application Gateway capacity units sized to traffic
    • Standard storage tier for data that is not latency-critical

What is delivered

Code, configuration, and documentation in your repository, and yours to keep.

  • The code

    The AKS cluster, virtual network, private DNS zones, Application Gateway WAF v2, Key Vault, and identity assignments, all defined in your repository.

  • Ingress and certificate pipeline

    Production configuration for your choice of ingress controller (NGINX, AGIC, or Envoy), with certificates from your certificate authority synchronized through the Key Vault CSI driver.

  • Threat model and control mapping

    Network boundaries, identity boundaries, RBAC roles, and WAF inspection rules mapped against NIST SP 800-53 and PCI-DSS 4.0 controls.

  • Day-2 runbooks

    Operating guides for the team that runs the cluster.

    • Cluster version upgrades and node pool rotation
    • Certificate expiry handling
    • Disaster recovery failover and performance tuning

Related reading

The engagement this architecture comes from, and why the API server should stay private.

Take your cluster's control plane off the internet.

Start with a free 30-minute architecture assessment. We review your cluster requirements and set the fee from there.

Book an assessment Take the readiness check