Azure Kubernetes Service (AKS)

Azure Basics · PaaS Compute – App Service, Container Instances and AKS · Lesson 5 of 5

AKS is managed Kubernetes — Azure runs the control plane and you manage node pools (VMs); scale with the cluster autoscaler (nodes) and HPA (pods), integrated with Entra ID and RBAC.

Term	Meaning
Node pool	Nodes with the same configuration (VM size, OS)
Node	An Azure VM running containers
Pod	One instance of the app, holding one or more containers
Deployment	Manages one or more identical pods
Manifest	A YAML file describing Kubernetes resources

flowchart TB
  CP["Control plane (managed by Azure)"] --> NP["Node pool nodepool1"]
  NP --> N1["Node VM 1: pod web, pod api"]
  NP --> N2["Node VM 2: pod web"]
  LB["Service type LoadBalancer"] --> N1
  LB --> N2
  NP -. "virtual node" .-> ACI["ACI (burst)"]

The control plane is managed by Azure (the Free tier does not charge for it; the Standard tier adds an SLA and is billed). You pay for the nodes (VMs, disks, networking).
Services: ClusterIP (internal, default), NodePort (opens a port on nodes), LoadBalancer (an Azure LB with an external IP).
Storage: volumes (Azure Disks, Azure Files) through PVCs; data on node-local storage can be lost.
Scaling: the cluster autoscaler adds/removes nodes when pods lack room; HPA adds/removes pods by metric; virtual nodes (Virtual Kubelet) burst pods into ACI.
Security: Entra ID + Kubernetes RBAC, authorized IP ranges, private clusters, NSGs, Kubernetes secrets (prefer the Key Vault CSI driver); upgrades cordon and drain nodes; Pod Security Admission replaces PodSecurityPolicy (removed in Kubernetes 1.25).

Command	Meaning
`az aks create -g rg-devops-lab -n aks-lab --node-count 2 --generate-ssh-keys`	Create a cluster
`az aks get-credentials -g rg-devops-lab -n aks-lab`	Write the kubeconfig
`kubectl get nodes`	Check the nodes

Node pools and networking

Every cluster has a system node pool for core components such as CoreDNS, and you add user node pools for applications, for example a GPU pool or a Spot pool for batch jobs. Pools can span availability zones.

For pod networking, Azure CNI Overlay is the recommended default: pods get addresses from a private overlay range, so the VNet does not run out of IPs. Classic Azure CNI gives pods real VNet addresses, which helps when other systems must reach pods directly. Kubenet is being retired.

Getting traffic in

Option	Layer	Notes
Service type `LoadBalancer`	L4	One Azure Load Balancer IP per service
Application routing add-on	L7	Managed NGINX ingress controller
Application Gateway for Containers	L7	Azure-managed, uses the Gateway API

Images and identity

Store images in Azure Container Registry and connect it with az aks update -g rg-devops-lab -n aks-lab --attach-acr acrdevopslab, which grants the cluster pull rights without passwords. Workload identity lets a pod use an Entra identity to reach Key Vault or storage, replacing secrets in manifests.

Keeping the cluster current

Kubernetes minor versions are supported for a limited time, so upgrades are routine. az aks get-upgrades -g rg-devops-lab -n aks-lab -o table lists available versions, and az aks upgrade upgrades the control plane and nodes. Node OS auto-upgrade channels patch node images automatically, and planned maintenance windows limit when that happens.

Monitoring and cost

Container insights and Azure Monitor managed service for Prometheus, viewed in Azure Managed Grafana, give cluster, node, and pod metrics and logs. For labs, az aks stop deallocates the nodes and az aks start brings them back, saving most of the cost. AKS Automatic is a more opinionated mode that configures node pools, scaling, and security defaults for you.