Q: Your enterprise web application must serve global users with sub-30ms edge latency, provide automated failover between AKS clusters in East US and North Europe, and protect origin clusters from direct public internet exposure. How do you architect Azure Front Door Premium with Private Link origins?

Expose the internal ingress controller via Azure Private Link Service:

• Internal Ingress: Provisioned internal Azure Load Balancer for Ingress-Nginx with annotation service.beta.kubernetes.io/azure-load-balancer-internal: 'true'.
• Create Private Link Service: Provisioned Azure Private Link Service referencing the internal load balancer frontend IP: az network private-link-service create -g rg-aks -n pls-aks-eastus --vnet-name aks-vnet --subnet $SUBNET_ID --lb-frontend-ip-configs $FE_CONFIG.

Establish private origin connections across Microsoft's global Anycast edge network:

• Front Door Profile: Created Front Door Premium profile: az afd profile create -g rg-edge -n afd-global --sku Premium_AzureFrontDoor.
• Private Origin Connection: Added East US and North Europe origins with enable-private-link=true pointing to the respective Private Link Service resource IDs.

Validate and accept the cryptographic connection requests from Front Door edge proxies:

• Approve Connection: Executed az network private-endpoint-connection approve --id $CONNECTION_ID --description 'Approved for Front Door Edge'.
• Verification: Confirmed connection status transitioned to Approved, opening private Layer 7 proxy routing.

Implement automated edge health monitoring and regional evacuation policies:

• Health Probe Settings: Configured HTTP probe path /healthz with 15-second interval and sample size of 4.
• Priority Routing: Assigned East US (Priority 1) and North Europe (Priority 2) for US users; during an East US cluster outage, Front Door drops traffic to North Europe within 4 seconds without DNS propagation lag.