What 'Managed' Actually Means in AKS

"Managed" is the most over-trusted word in AKS. Teams hear it and picture Azure quietly running their cluster while they sleep. What Azure actually runs is the control plane: the API server, etcd, the scheduler, the controller manager. That part you genuinely never touch: no patching, no etcd backups, no 3 a.m. page when a control-plane pod restarts.

Everything else is still yours:

• The nodes. They're VMs in your subscription. You choose the size, you pay for them idle or busy, and you decide when their OS gets patched.
• The workloads. Health, resilience, resource requests, rollout safety: all you.
• Networking, scaling, identity. The CNI, the autoscaler's behavior, who can reach the cluster and what your pods can do in Azure: your configuration, your consequences.

Here's the practical test. When something breaks, ask: control plane or data plane? If the API server is unreachable through no fault of your config, that's Azure's pager. If your app took an outage during an upgrade because it had one replica and no PodDisruptionBudget, that was always your side of the line, and "but it's managed" won't bring the service back.

Managed Kubernetes is a fantastic deal. It removes the toil that's the same for everyone and leaves you the decisions that are specific to you. Just don't mistake "Azure runs the control plane" for "Azure runs my cluster." Those are very different sentences, and the gap between them is where the incidents live.