Harbor laptops must keep using kubectl against a public AKS API FQD…

Question

Harbor laptops must keep using kubectl against a public AKS API FQDN, but only from known office prefixes. What should the security engineer configure?

Accepted Answer

Set API server authorized IP ranges to the office prefixes (including required cluster egress IPs) while keeping the public API endpoint. — Still need a public API FQDN for the harbor laptops? Clamp it with authorized IP ranges—office prefixes in, Internet scanners out. Remember to list the cluster’s own egress IPs too.

Answer

Convert the cluster to private and block all public kubectl, then require operators to RDP to a node to run kubectl locally.

Answer

Apply a Kubernetes NetworkPolicy that selects the API server pod and allow only office CIDRs as pod peers.

Answer

Disable the public FQDN and rely solely on Azure RBAC Reader on the resource group without network restrictions.

Harbor laptops must keep using kubectl against a public AKS API FQDN, but only from known office prefixes. What should the security engineer configure?

Short Explanation

Full Explanation