A transit AKS cluster must retrieve secrets without exposing Key Vault to the public internet. What should the city implement?

A transit AKS cluster that must retrieve secrets without exposing Key Vault to the public internet should restrict Key Vault with a private endpoint and/or network rules so only the approved AKS path can reach the vault. That pattern keeps court-adjacent transit credentials, API keys, and connection strings off the public edge while still allowing CSI driver or workload-identity based secret injection into pods. Network isolation plus identity-based access is the municipal default for production secret retrieval.

Publishing the vault on a public IP and relying only on SAS URLs expands the attack surface and confuses blob-style SAS patterns with Key Vault access control. Storing all production secrets in a Git repository with world-readable clone rights embeds long-lived secrets in source control—an anti-pattern for any civic production system. Emailing secrets to node operators whenever pods restart is manual, unauditable at scale, and almost guarantees leakage and configuration drift.

Exam caveat: Private endpoints and service endpoints/firewall rules address network exposure; they do not replace RBAC, managed identity, or purge/soft-delete protections. AKS nodes and pods still need a correct identity path (for example workload identity or secrets store CSI) to authenticate. DNS for the private endpoint must resolve correctly inside the cluster VNet or peered networks, or apps will fail closed.

Operational check: From a transit workload pod, confirm Key Vault resolves to the private IP, verify public network access is disabled or tightly restricted, test that an unauthorized public client cannot reach the vault, and validate that secret mounts or SDK gets succeed only for the intended managed identity. Review Key Vault diagnostic logs for unexpected source IPs after cutover and document the private path in the transit runbook.