Network question about Bicep extensibility Kubernetes provider (Preview)

[nnellanspdl]

How exactly is this working? Is it like terraform, where a local provider binary is sending API requests?

Or, are the K8s requests first being sent to the cloud/ARM and being processed there? In this case, can ARM in the cloud talk to my private-only AKS clusters?

[brwilkinson]

Some of this was covered in the community call: Kubernetes Key Scenarios by Shenglong

• specific answer you are looking for
• https://youtu.be/q23DDshzzvg?t=1544

Requests do get sent via ARM and processed via an extension host.

You can view more over on the extensibility repo.

• https://github.com/Azure/bicep-extensibility

[brwilkinson]

We are not sure as yet, if the AzureResourceManager service tag is allowed to connect to private AKS cluster endpoint, however I will test this out for you and provide an update.

[brwilkinson]

Putting this option here as well, since this came up on the call.

output testCredAdmin array = AKS.listClusterAdminCredential().kubeconfigs
output testCredUser array = AKS.listClusterUserCredential().kubeconfigs

More information on this in the docs below:

• https://learn.microsoft.com/en-us/azure/aks/control-kubeconfig-access#available-permissions-for-cluster-roles
  • Service Cluster Admin Role
  • Service Cluster User Role

[brwilkinson]

Update: Private Cluster is not currently supported for extensibility feature

Can track over here:

• Explore capability to support AKS Cluster in Private network configuration. bicep-extensibility#130