How do you eliminate public network access to a vault while still allowing an AKS workload to reach it?
- A Firewall rules listing node IPs
- B A private endpoint with the privatelink DNS zone linked to the cluster VNet (correct answer)
- C Service endpoints only
- D Disabling RBAC
Shortcut: A private endpoint gives the vault a private IP. net for clients to use it rather than the public endpoint.
A private endpoint gives the vault a private IP. The VNet must also resolve privatelink.vaultcore.azure.net for clients to use it rather than the public endpoint.