//Module included in the following assemblies:
// hosted_control_planes/hcp-deploy/hcp-deploy-azure.adoc

:_mod-docs-content-type: PROCEDURE
[id="hcp-azure-private-access_{context}"]
= Accessing a private {azure-short} hosted cluster

[role="_abstract"]
After you create a private hosted cluster, you need to take additional steps to access it.

.Prerequisites

* You completed the steps in "Creating a private {azure-short} hosted cluster".

.Procedure

* To access a private hosted cluster by generating a `kubeconfig` file, enter the following command:
+
[source,terminal]
----
$ hcp create kubeconfig \
  --name ${CLUSTER_NAME} \
  --port-forward > ${CLUSTER_NAME}-kubeconfig
----

* If you have access to the management cluster, you can port forward to the API server to access the private hosted cluster.
+
.. Port forward to the `kube-apiserver` service by entering the following command:
+
[source,terminal]
----
$ kubectl port-forward svc/kube-apiserver \
  -n clusters-${CLUSTER_NAME} 6443:6443 &
----
+
.. Access the hosted cluster by using the `kubeconfig` file:
+
[source,bash]
----
$ KUBECONFIG=${CLUSTER_NAME}-kubeconfig oc get nodes
----

* If you have a virtual machine (VM) in an {azure-short} Virtual Network (VNet) that is peered with the hosted cluster's VNet, you can access the API server, but you must first link the private DNS zones to the peered VNet.
+
[NOTE]
====
The Control Plane Operator links private DNS zones only to the hosted cluster's VNet. If you want to resolve the API server hostname from a peered VNet, you must manually link the private DNS zones to that VNet as shown in the following steps. Otherwise, DNS resolution fails from the peered VNet.
====
+
.. Link the private DNS zone to your peered VNet as shown in the following example:
+
[source,bash]
----
$ PEERED_VNET_ID="/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/virtualNetworks/<vnet>"
----
+
.. Enter the following command:
+
[source,terminal]
----
$ az network private-dns link vnet create \
  --resource-group "${MANAGED_RG_NAME}" \
  --zone-name "${CLUSTER_NAME}.hypershift.local" \
  --name "peered-vnet-link" \
  --virtual-network "${PEERED_VNET_ID}" \
  --registration-enabled false
----
+
.. If you also need base-domain resolution, enter the following command:
+
[source,terminal]
----
$ az network private-dns link vnet create \
  --resource-group "${MANAGED_RG_NAME}" \
  --zone-name "${PARENT_DNS_ZONE}" \
  --name "peered-vnet-basedomain-link" \
  --virtual-network "${PEERED_VNET_ID}" \
  --registration-enabled false
----
+
.. Access the cluster as shown in the following example:
+
[source,bash]
----
$ KUBECONFIG=${CLUSTER_NAME}-kubeconfig oc get nodes
----