Architecture Considerations

There are two different types of AKS Clusters that can be created. A Public AKS Cluster will expose the Control Plane API to the internet and a Private Cluster blocks all public access to the API using a private endpoint for control plane communication. A section exists for public clusters that allow control plane access to be restricted down to certain subnet ranges and for the cost conscious, that will be the best option. But it will require constant conformation and policies to be put in place to make sure that setting isn't accidently changed opening up the cluster to risk. NSGs or Firewalls can't be placed on the control plane level as a layered approach, since Microsoft manages the control plane infrastructure.

There is no cost difference between creating a private vs public cluster, but the consideration is that with a private cluster, public load balancer can't be used for inbound access and is not supported by Microsoft for that configuration. Most people use App Gateway or Azure front door for private clusters as a substitute. App Gateway adds an absolute minimum of $55 a month to the deployment cost, where a public load balancer would be much cheaper. The best solution depends on the the project goals and needs.