Your company runs an on-premises Kubernetes cluster and wants to enforce APIM policies close to backends to reduce latency. The network only allows outbound traffic to Azure over HTTPS. You must keep a single API surface in Azure while processing calls locally. What should you do?

The self-hosted gateway in Azure API Management is designed for hybrid and multi-cloud scenarios, allowing you to deploy a gateway component directly into your on-premises Kubernetes cluster. This brings API policy enforcement closer to your backend services, minimizing latency. The gateway synchronizes its configuration with the Azure API Management instance over HTTPS (port 443), satisfying the outbound traffic requirement. Exposing it internally ensures local processing. Incorrect options: Deploying an APIM instance in IaaS mode is not a standard or supported deployment model for Azure API Management and doesn't align with the requirement to use an existing on-premises Kubernetes cluster. Exposing on-prem services to the internet and using IP restrictions would increase security risks and doesn't address the latency requirement for local policy enforcement. Azure Arc-enabled API Management is not a distinct product; Azure Arc enables management of resources, but the self-hosted gateway is the specific component for running APIM policies in hybrid environments. It still requires outbound connectivity for configuration sync.