Azure Kubernetes Service is easy to start and full of decisions you can't walk back. These are the field notes, long-form articles and short, tactical posts, organized by the questions you'll actually face in production.
8 articles · 13 posts
The managed boundary, tenancy, and how AKS actually fits together.
BrowseCNI choices, ingress, egress, and private clusters.
BrowseIdentity, RBAC, and shrinking the attack surface.
BrowseNode pools, autoscaling, spot, and the bill nobody forecast.
BrowseUpgrades, disruption budgets, and the dashboards that matter.
BrowsePull-based delivery with Flux, Argo, and Kustomize.
BrowseThe managed boundary, tenancy, and how AKS actually fits together.
The managed-Kubernetes comparison tables miss the point. The Kubernetes is the same everywhere. What differs is the cloud it's wired into, and that's the actual decision.
Consolidate into one cluster and you fight noisy neighbors and blast radius. Split into many and you drown in upgrade toil. The right answer isn't a number. It's an isolation boundary you can defend.
AKS hides the control plane so well that teams forget it exists, until an upgrade, an outage, or a bill reminds them. Here's the mental model that makes the managed boundary obvious.
Managed Kubernetes doesn't mean Azure runs your cluster. It means Azure runs the part you'd most like to ignore, and quietly hands you the rest.
CNI choices, ingress, egress, and private clusters.
The AKS ingress debate isn't about which is better. It's about where you want your routing logic to live: in Azure, or in your cluster.
Most AKS networking choices are tunable later. The CNI is not. Pick wrong and you're rebuilding the cluster, so make this one with the next three years in view, not the next sprint.
A pod that can't curl the outside world is an AKS rite of passage. It's almost always one of three things, and none of them are the pod's fault.
Identity, RBAC, and shrinking the attack surface.
A private cluster takes your API server off the public internet, a real security win that quietly breaks half your tooling. Go in knowing both halves.
Every static credential in your cluster is a small bet that it never leaks. Workload Identity lets your AKS pods talk to Azure with no secret to leak at all, and the migration is more about discipline than difficulty.
`az aks get-credentials --admin` is the handiest command in AKS and the one most likely to end up in an incident report. There's a better default, and switching costs nothing.
Node pools, autoscaling, spot, and the bill nobody forecast.
Most AKS clusters run every workload on one undifferentiated pool of VMs and call it simple. It isn't simple. It's expensive, fragile, and one bad neighbor away from an outage. Node pools are where workload intent becomes infrastructure.
Teams add the cluster autoscaler hoping it fixes capacity pain. It can't, because the autoscaler trusts your resource requests, and most resource requests are fiction.
Spot nodes can cut a chunk of your AKS bill for the right workloads. The catch is in the word 'right': put the wrong thing there and you've architected a flaky outage.
AKS makes it trivial to spend money and hard to see where it went. Cost on Kubernetes isn't a billing problem you fix later. It's an architecture property you design in, or pay for forever.
Upgrades, disruption budgets, and the dashboards that matter.
You can drown a new AKS cluster in metrics on day one. Resist. Three dashboards answer the questions you'll actually have at 2 a.m. Start there, add the rest when you miss them.
Most AKS upgrade outages aren't upgrade bugs. They're a missing PodDisruptionBudget: five lines of YAML standing between a rolling node drain and all your replicas dying at once.
Kubernetes versions age out on a schedule, and AKS only supports a rolling window. Fall off the back of it and you're running unsupported infrastructure under production, usually discovered at the worst moment.
A cluster that can't be upgraded calmly isn't finished. It's a liability with a countdown. Treat upgradability as a design goal and the scariest part of running AKS becomes routine.
Pull-based delivery with Flux, Argo, and Kustomize.
Helm became the default for everything, including jobs it's bad at. For your own cluster configuration, Kustomize is often the calmer choice, and knowing when is the whole skill.
GitOps sounds like a platform project. Getting your first Flux reconciliation running on AKS is closer to a coffee break, and it changes how you think about deploys immediately.
CI pipelines that push kubectl into your cluster feel fast and quietly rot your reliability. GitOps inverts the arrow: the cluster pulls its own desired state, and 'what's deployed' stops being a mystery.