Private AKS on Azure: No Public API Server, No Public Node IPs, No Default Outbound
07 Sept 2026
A production AKS cluster with private_cluster_enabled, forced-tunneled node egress via a Route Table, and private-endpoint-only ACR/Key Vault — the workload cluster that sits behind a Hub & Spoke and an Azure Firewall.