Answers: <p>So this was simply a lack of understanding on my part. I was able to do a 'quick fix' by adding a hosts entry in the VM for <code>my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io</code> to the existing IP address that is found in the recordset of the existing private DNS zone a <code>10.x.x.x</code> type.</p>
  <p>This worked but felt a bit nasty.</p>
  <p>The solution was to create the private DNS in the Hub VNet (i.e. jumpbox VM's vnet) and then assign that to be the private dns zone id for the cluster when creating it (this requires you to use a service principal or user defined identity when creating the cluster for some reason, so that also needed added)</p>
  <p>But then as the VM is now attached to a subnet with a private DNS zone, when I recreated the cluster using that, it worked and was able to auto-resolve the cluster's DNS name from the config file.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-10-11T12:48:18.980Z
Answers: 2024-10-11T12:48:18.980Z
Answers: Mark McGookin
Body: <p># Current Setup (all created with terraform):</p>
  <ul>
  <li>Azure Subscription A: Jumpbox VM, SubA VNet, Jumpbox Subnet</li>
  <li>Azure Subscription B: Azure AKS Private Cluster, SubB VNet, AKS Subnet</li>
  </ul>
  <p>This setup is due to us hosting many products, and having different subscriptions for each one (a dev-test one and a prod one), and a cluster in each sub. The plan being to create a hub style setup with this SubA jumpbox in the middle and a number of vnets peered to it to allow it to access many other clusters for different setups.</p>
  <p>I have peered the Jumpbox subnet with the AKS Subnet successfully across subs using the provider alias feature in terraform.</p>
  <p>As the cluster is private, I have no access to the k8s api server. Thus the jumpbox, I have SSH access to the jumpbox, which is on a peered subnet. The cluster lists API Server Address as</p>
  <p><code>my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io</code></p>
  <p>And the <code>admin_config</code> output has a valid looking file using that address under the <code>server</code> portion of the config file.</p>
  <p>When I do something simple on the jumpbox like <code>kubectl get pods</code> I get an error saying <code>&quot;Unhandled Error&quot; err=&quot;couldn't get current server API group list: Get \&quot;https://my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io:443/api?timeout=32s\&quot;: dial tcp: lookup my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io on 127.0.0.53:53: no such host&quot; Unable to connect to the server: dial tcp: lookup my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io on 127.0.0.53:53: no such host</code></p>
  <p>I had assumed due to the appearance of 'privatelink.uksouth' in the url that there had automatically been a private link created. But I am unsure how to connect to it.</p>
  <p>A lot of tutorials have <code>azurerm_private_endpoint</code> in the examples, but I haven't found one for accessing the ApiServer from a peered vnet, so am unsure how to proceed.</p>
  <p>I don't know if I ned to create the private endpoint, or if I can use the one mentioned above... if I need to create a private dns_zone (and a private dns zone network link) as well... and if I do, do I create some/all of those in the SubB network where AKS is, or the subA network where the jumpbox is.</p>
  <p>Any help would be greatly appreciated.</p>
  <p>EDIT:
  After looking into the cluster's own resource group (The MC_ one that the node pools, network interface etc live in) I can see there is ALREADY a Private DNS zone, private endpoint etc.. which is where the domainname above is coming from presumably. I am further at a loss as to why the connection from the jumpbox isn't working.</p>
  
Tags: <terraform><azure><networking><azure-kubernetes-service>
Title: How to connect a VM in a peered subnet to a private Azure Kubernetes (AKS) cluster with Terraform
UserDisplayName: Mark McGookin
ThreadText: # How to connect a VM in a peered subnet to a private Azure Kubernetes (AKS) cluster with Terraform
  
  (Asked by: username_0 on 2024-10-10)
  
  # Current Setup (all created with terraform):
  
  * Azure Subscription A: Jumpbox VM, SubA VNet, Jumpbox Subnet
  * Azure Subscription B: Azure AKS Private Cluster, SubB VNet, AKS Subnet
  
  This setup is due to us hosting many products, and having different subscriptions for each one (a dev-test one and a prod one), and a cluster in each sub. The plan being to create a hub style setup with this SubA jumpbox in the middle and a number of vnets peered to it to allow it to access many other clusters for different setups.
  
  I have peered the Jumpbox subnet with the AKS Subnet successfully across subs using the provider alias feature in terraform.
  
  As the cluster is private, I have no access to the k8s api server. Thus the jumpbox, I have SSH access to the jumpbox, which is on a peered subnet. The cluster lists API Server Address as
  
  `my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io`
  
  And the `admin_config` output has a valid looking file using that address under the `server` portion of the config file.
  
  When I do something simple on the jumpbox like `kubectl get pods` I get an error saying `"Unhandled Error" err="couldn't get current server API group list: Get \"https://my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io:443/api?timeout=32s\": dial tcp: lookup my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io on 127.0.0.53:53: no such host" Unable to connect to the server: dial tcp: lookup my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io on 127.0.0.53:53: no such host`
  
  I had assumed due to the appearance of 'privatelink.uksouth' in the url that there had automatically been a private link created. But I am unsure how to connect to it.
  
  A lot of tutorials have `azurerm_private_endpoint` in the examples, but I haven't found one for accessing the ApiServer from a peered vnet, so am unsure how to proceed.
  
  I don't know if I ned to create the private endpoint, or if I can use the one mentioned above... if I need to create a private dns\_zone (and a private dns zone network link) as well... and if I do, do I create some/all of those in the SubB network where AKS is, or the subA network where the jumpbox is.
  
  Any help would be greatly appreciated.
  
  EDIT:
  After looking into the cluster's own resource group (The MC\_ one that the node pools, network interface etc live in) I can see there is ALREADY a Private DNS zone, private endpoint etc.. which is where the domainname above is coming from presumably. I am further at a loss as to why the connection from the jumpbox isn't working.
  
  **Tags:** terraform, azure, networking, azure-kubernetes-service
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-10-11. Score: 0 | Accepted answer
  
  So this was simply a lack of understanding on my part. I was able to do a 'quick fix' by adding a hosts entry in the VM for `my-cluster-name-dns-u9rdk0rs.5a50ba2c-28f7-46a2-a89c-7ff9b9c881d2.privatelink.uksouth.azmk8s.io` to the existing IP address that is found in the recordset of the existing private DNS zone a `10.x.x.x` type.
  
  This worked but felt a bit nasty.
  
  The solution was to create the private DNS in the Hub VNet (i.e. jumpbox VM's vnet) and then assign that to be the private dns zone id for the cluster when creating it (this requires you to use a service principal or user defined identity when creating the cluster for some reason, so that also needed added)
  
  But then as the VM is now attached to a subnet with a private DNS zone, when I recreated the cluster using that, it worked and was able to auto-resolve the cluster's DNS name from the config file.
  
  
  ---
  
  