The tugboat-scheduler AKS API server is on a public IP and appears on Internet scanners. How should the security engineer isolate the control plane?
Select an answer to reveal the explanation.
Short Explanation
If scanners can see the tugboat API server, it’s still on the public pier. Flip the cluster to private so the control plane lives on a private link inside the VNet—no public API IP.
Full Explanation
An AKS private cluster removes the public endpoint from the Kubernetes API server so control-plane access occurs over private connectivity from the virtual network (private link to the API server). Node NSGs alone do not hide a public API server. Authoring a custom Private Link service is not the first control for this official isolation option, and Bastion does not replace making the API server private.