5.1.1.3. Design for Azure Kubernetes Service (AKS)
5.1.1.3. Design for Azure Kubernetes Service (AKS)
💡 First Principle: A managed container orchestration service simplifies the deployment and scaling of containerized applications by offloading the operational complexity of the control plane, enabling teams to leverage the power of Kubernetes with reduced management overhead.
Scenario: You are designing the compute platform for a new large-scale microservices application. Your development team is familiar with Kubernetes and requires a platform that automates container orchestration, scales dynamically, and integrates with Azure's identity and monitoring services.
AKS is a fully managed Kubernetes orchestration service in Azure.
Key Design Considerations:
- Container Orchestration: AKS automates the deployment, scaling, and management of containerized applications, abstracting away the Kubernetes control plane.
- Scalability: Supports both horizontal pod autoscaling (HPA) and cluster autoscaling (CA) to dynamically adjust worker nodes.
- Integration with Azure Services: Seamlessly integrates with Azure Container Registry (ACR), Azure Monitor for containers, Microsoft Entra ID, and Azure Networking.
- Security: Provides robust security features, including Microsoft Entra ID integration for cluster access and network policies.
- Cost Optimization: You only pay for the virtual machines consumed by your AKS cluster. Leverage spot instances or reserved instances for worker nodes.
- Management: Microsoft manages the Kubernetes control plane. You manage the worker nodes and application deployments.
- Use Cases: Ideal for microservices architectures, complex containerized applications, and machine learning workloads that require high scalability and portability.
Design decisions in practice:
| Decision | Options | How to choose |
|---|---|---|
| Network plugin | kubenet, Azure CNI (and Overlay) | Azure CNI gives pods real VNet IPs — needed when pods must be addressed directly or reached from on-premises. It consumes VNet address space fast, which is why address planning must precede cluster creation |
| API server access | Public, authorized IP ranges, private cluster | A private cluster puts the control plane behind a private endpoint. Any compliance boundary (PCI, HIPAA) generally requires it |
| Node pools | System pool, plus user pools | Separate pools per workload class. Taints and tolerations keep regulated workloads off shared nodes — sharing one pool pulls the whole cluster into assessment scope |
| Scaling | Cluster autoscaler + horizontal pod autoscaler | The pod autoscaler adds pods, the cluster autoscaler adds nodes to put them on. You need both |
| Pod security | Azure Policy for Kubernetes | Enforces baselines such as "no privileged containers" as admission policy rather than review |
The decision before all of these is whether to run AKS at all. Kubernetes is an operating model, not just a runtime: upgrades, node image patching, capacity, networking and RBAC all become the team's responsibility. When a scenario mentions a small team, no Kubernetes experience, or an explicit decision not to take on cluster operations, that sentence is doing the work — Azure Container Apps runs the same containers serverlessly, with built-in service discovery, revisions for rolling updates and scale to zero.
⚠️ Exam Trap: AKS is frequently the technically capable option in a question whose constraint is organizational. Capability is not the criterion when the scenario has told you the team cannot operate it.
⚠️ Common Pitfall: Underestimating the complexity of Kubernetes itself. While AKS manages the control plane, developers and operators still need a solid understanding of Kubernetes concepts (pods, services, ingress, etc.) to effectively deploy and manage applications.
Key Trade-Offs:
- Power/Portability (Kubernetes) vs. Simplicity (PaaS): AKS provides the full power and portability of the Kubernetes ecosystem but has a steeper learning curve than a simpler PaaS offering like Azure App Service.
Reflection Question: How does designing for Azure Kubernetes Service (AKS), by providing a managed Kubernetes platform that handles the control plane and integrates with Azure services, fundamentally simplify the deployment, management, and scaling of containerized applications at scale, allowing your team to focus on application development and deployment?
