You have an AKS cluster (AKS1) hosting microservice APIs that listen on non‑default HTTP ports. You will deploy a Standard tier API Management instance (APIM1) to expose the APIs externally. You must enable mTLS authentication between APIM1 and AKS1, while minimizing development effort and cost. What should you do?

Deploying an ingress controller to AKS1 is the correct solution. An ingress controller provides HTTP/S routing and load balancing for services within the cluster, allowing APIM1 to connect to the microservices on their non-default HTTP ports. This approach simplifies external access and supports mTLS by offloading certificate management to the ingress controller. Implementing an external load balancer on AKS1 would expose services directly, which is less secure and harder to manage for multiple APIs. Redeploying APIM1 to the same virtual network as AKS1 would allow internal communication but doesn't inherently solve the non-default port issue or simplify mTLS setup for external exposure. Implementing an ExternalName service is used for external services outside the cluster, not for exposing internal services within the cluster.