DevSecOps
AKS Behind Front Door and Private Link
Front Door reaches private AKS ingress over Private Link: no public IP on the cluster, TLS throughout.
Users reach Front Door, where the WAF policy runs. Front Door connects through a private endpoint to a Private Link service in front of the cluster's internal load balancer and NGINX ingress, so the cluster exposes no public address. Admins come in through Bastion.
Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.
When to use it
- Public web apps on AKS that must not expose the cluster to the internet
- Global users and several regional clusters behind one entry point
- Teams that need WAF, TLS and certificates managed in one place
How NGT delivers it
Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.
DevSecOps
