Cloud Experts Documentation

Prerequisites Checklist to Deploy ARO Cluster

This content is authored by Red Hat experts, but has not yet been tested on every supported configuration.

Before deploying an ARO cluster, ensure you meet the following prerequisites:

Setup Tools

Verify Resources


  • RBAC Settings:
  • Microsoft Entra (Former Azure AD):
    • Have a member user of the tenant or a guest with Application administrator role for the tooling to create an application and service principal on your behalf for the cluster.
  • Terraform: If you plan to use Terraform for the deployment of the cluster, see hereexternal link (opens in new tab) the required permissions.

Azure Integration

Domain Configuration

This step is optional since you can use the built-in domain.

Network Configuration

  • Virtual Network:
  • Outbound Traffic:
    • Default deployment is with outboundType: LoadBalancer, meaning that a Public IP is associated with the Load Balancer for the cluster egress connectivity.
    • To restrict Internet Egress, set --outbound-type to UserDefinedRouting.
    • Consider use a Firewall solution from your choice or Azure native solutions like Azure Firewall or NAT Gateway for enhanced security. Reference linkexternal link (opens in new tab) .

Cluster Creation

  • Private vs Public Clusters:
    • Private Cluster:
      • This is typically the most suitable option for production use. A Private Cluster makes the cluster API and *.apps endpoints private. Utilize Azure Frontdoor for Internet access to applications on a private cluster. This approach significantly enhances security by keeping the cluster and Azure resources private, managing traffic at the edge, and offering benefits such as Web Application Firewall (WAF), DDoS protection, SSL management, and offloading. For detailed implementation guidance, refer to Azure Frontdoor documentation .
    • Public Cluster:
      • Opt for a Public Cluster only in situations like a “sandbox cluster” or where establishing a private method for console and API access is not feasible or desired, since the cluster API and *.apps endpoints will be exposed to the Internet.
  • Egress Lockdown:
  • Create the Cluster:

For a detailed step-by-step guide on creating your ARO cluster, refer to the official ARO documentationexternal link (opens in new tab) .

Interested in contributing to these docs?

Collaboration drives progress. Help improve our documentation The Red Hat Way.

Red Hat logo LinkedIn YouTube Facebook Twitter



Try, buy & sell


About Red Hat

We’re the world’s leading provider of enterprise open source solutions—including Linux, cloud, container, and Kubernetes. We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Subscribe to our newsletter, Red Hat Shares

Sign up now
© 2023 Red Hat, Inc.