Create Private AKS Cluster using Bicep

Posted by

This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Tech Community.


This is a blog on how to use a modular approach for Infrastructure as Code (IaC) in provisioning a private AKS cluster and other related resources. The Bicep modules in the repository are designed keeping the AKS baseline architecture in mind. You can start using these modules as is or modify to suit your own needs.




The Bicep modules will provision the following Azure Resources under subscription scope:

  1. A Resource Group with Baseline variables
  2. Hub VNet with required subnets
  3. Azure Firewall Subnet
  4. Azure Bastion Subnet
  5. A jumpbox subnet
  6. Spoke VNET with AKS cluster subnet and additional subnet for other services like Azure Container Registry etc.
  7. Azure Firewall and required routes
  8. Azure Bastion resource and a jumpbox VM without public IP for securing traffic
  9. Azure Container Registry for storing images.
  10. A Private Endpoint for ACR
  11. Private DNS Zone
  12. AAD Enabled, Managed Private AKS Cluster with monitoring Addon and Azure Policy enabled
  13. Private AK Cluster need the UDR routes enabled via Firewall.

Resource Provisioning

Clone the repo

git clone
cd bicep
# You could use deploy.azcli as your working file. Don't run the script as is!

Login to Azure

az login

az account set -s <Subscription ID>

Initialize variables

# Change the variables as required (baseline and location) on deploy.azcli
# Deploy the bicep script
az deployment sub create -n $baseline'Dep' -l $location -f main.bicep

The deployment could take somewhere around 20 to 30 mins. Once provisioning is completed you can use the cluster for your needs.

Next Steps

  1. Enable GitOps using Flux operator for Application deployment
  2. Enable IaC using CI/CD pipelines on Github Actions

This articles are republished, there may be more discussion at the original link. But if you found this helpful, you're more than welcome to let us know!

This site uses Akismet to reduce spam. Learn how your comment data is processed.