Azure ARC Kubernetes: Disable Cluster Connect but not Azure RBAC and Custom Locations

Question

Hi,

we need the azure arc features "Azure RBAC" and "Custom Locations" but don't want to allow "Cluster Connect" from anywhere as we use private clusters.

We thought about just blocking the "Cluster Connect" service endpoints from the documentation on our firewall but the other features need those endpoints as well.

Can ARC be configured to only disable cluster connect but still allow the other features?

Answer 1

Hello CKAU,

It looks like you're trying to use Azure Arc features like Azure RBAC and Custom Locations while disabling the Cluster Connect feature for privacy concerns with your clusters. Unfortunately, based on current Azure Arc functionality, both Custom Locations and Cluster Connect features are interdependent, meaning Custom Locations require Cluster Connect to be enabled.

To answer your query, No. Azure Arc does not currently support disabling Cluster Connect while keeping Custom Locations enabled. These two features are interdependent Custom Locations relies on Cluster Connect for namespace management and service deployment. If you turn off Cluster Connect, Custom Locations will stop working.

Create and manage custom locations on Azure Arc-enabled Kubernetes - Azure Arc | Microsoft Learn

While Azure RBAC works independently for user access, be aware that you cannot use the Custom Locations feature or view Kubernetes resources directly in the Azure Portal without Cluster Connect, as these features have a dependency on the Cluster Connect infrastructure.

However, since if your primary goal is to disable Cluster Connect access and rely on Azure RBAC for private cluster access, this configuration may perfectly meet your security requirement.

Reference document:

Overview of custom locations with Azure Arc - Azure Arc | Microsoft Learn

Hope this helps, if you need further assistance, please reach out to us, Thanks

Answer 2

Currently, Azure Arc does not provide a configuration option to disable only the Cluster Connect feature while keeping Azure RBAC and Custom Locations enabled. The Cluster Connect feature is integral for certain functionalities, and blocking its service endpoints may impact the ability to use Azure RBAC and Custom Locations as they share some of the same endpoints.

If you need to maintain the security of your private clusters while using Azure RBAC and Custom Locations, you may need to consider alternative approaches, such as implementing strict network security rules or using other methods of access control that do not involve disabling Cluster Connect entirely.

For the most accurate and tailored advice, it may be beneficial to consult Azure support or documentation directly regarding your specific use case and requirements.

---

References:

• Azure Arc-enabled Kubernetes identity and access overview
• Use private connectivity for Arc-enabled Kubernetes clusters with private link (preview)