Azure Kubernetes ServiceAuthorCloudBrum editorial teamLast reviewed28 Oct 2026Reading time~12 minLevelBeginner to advanced

• A hosted control planeMicrosoft runs the API server, etcd, scheduler and controllers for you, spread over availability zones when you ask for them. The Free tier charges nothing for it, which is unusual among the big clouds.
• Automatic or StandardAKS Automatic comes with node provisioning, scaling, monitoring, Azure RBAC and deployment safeguards switched on. Standard gives you full control over node pools, networking and add-ons, and leaves the work to you.
• Node poolsWorkers live in node pools backed by virtual machine scale sets. Keep system components in their own pool, put applications in user pools, and add Spot, GPU or Windows pools where needed.
• Entra ID and Workload IDPeople sign in with Microsoft Entra ID and get Kubernetes rights through Azure RBAC. Pods reach Azure resources such as Blob Storage and Key Vault with Workload ID: a federated credential trusts one Kubernetes service account, so no secret is stored.
• Overlay pod networkingAzure CNI Overlay gives pods addresses from a private range that doesn’t use up your VNet subnets, which removes the most common scaling limit of older AKS setups. Cilium can run the dataplane and enforce network policies.
• Auto-upgrade channelsPick a channel for the Kubernetes version (patch, stable or rapid) and another for the node operating system. Maintenance windows say when AKS may do the work, and surge settings say how many nodes can be replaced at once.
• Guard rails and scanningDeployment safeguards use Azure Policy to refuse risky manifests. Microsoft Defender for Containers scans images and watches runtime behaviour. The Key Vault provider mounts secrets as volumes.
• Long-Term SupportThe Premium tier keeps a Kubernetes version patched for longer than the community does, for teams that can’t upgrade as often as the release cadence demands.

Cluster

The hosted control plane plus its node pools. An AKS cluster sits in a resource group, and its nodes land in a second, automatically created node resource group.

Pricing tier

Free, Standard or Premium. The tier sets the uptime SLA (financially backed on paid tiers) and whether Long-Term Support is available.

AKS Automatic

A cluster mode that turns on node auto-provisioning, autoscaling, managed monitoring, Azure RBAC, Workload ID and deployment safeguards. It always runs on the Standard tier.

Node pool

A group of identical virtual machines that run your pods. A cluster has at least one system pool, and any number of user pools.

System pool

The pool that runs core components such as CoreDNS and metrics-server. It needs a minimum size and a tolerable VM size, and it shouldn’t run your applications.

Node auto-provisioning (NAP)

Azure’s managed Karpenter. It watches for pods that don’t fit, picks a VM size and creates the node, then removes nodes that sit mostly empty.

Azure CNI Overlay

Pod networking in which pods get addresses from a private pod CIDR and traffic leaving the cluster is translated to the node’s VNet address.

Microsoft Entra Workload ID

Lets a Kubernetes service account exchange its projected token for a Microsoft Entra token, through a federated credential on a managed identity.

OIDC issuer

The URL that publishes the keys for tokens issued to your cluster’s service accounts. Workload ID needs it switched on.

Azure RBAC for Kubernetes

Lets you grant Kubernetes rights with Azure role assignments, such as Azure Kubernetes Service RBAC Reader, at cluster or namespace scope.

App Routing add-on

A managed NGINX-based ingress controller with Azure DNS and Key Vault integration for certificates.

Auto-upgrade channel

A cluster setting that picks how eagerly AKS moves the Kubernetes version or the node image forward.

Deployment safeguards

Azure Policy rules, in warning or enforcement mode, that check for missing resource requests, probes, unsafe settings and similar mistakes.

Node resource group

The extra resource group AKS creates for scale sets, disks and load balancers. Treat it as read-only, since edits there can break the cluster.

Create an AKS cluster with the Azure CLI

1. Choose the region, the tier and the modePick a region near your users (Central India or South India). Use the Standard tier for anything that carries real traffic, and choose Automatic if you’d rather not tune node pools and policies yourself.
2. Plan the networkCreate a VNet with a subnet for the nodes, and pick a pod CIDR for Azure CNI Overlay that doesn’t clash with your VNet, peered networks or on-premises ranges. Changing it later means rebuilding the cluster.
3. Create a registryMake an Azure Container Registry for your images and attach it to the cluster, so nodes can pull without stored credentials.
4. Create the clusterRun az aks create with zones, the autoscaler, Azure CNI Overlay with Cilium, Entra ID with Azure RBAC, local accounts off, and the OIDC issuer and Workload ID on. Add --enable-private-cluster if nobody should reach the API from the internet.
5. Set the upgrade channelsChoose patch for the cluster and NodeImage for the node operating system, and add a maintenance window outside your busy hours.
6. Create the pod identityMake a managed identity for the application, give it the narrowest role on the storage account, and add a federated credential that trusts one namespace and service account of this cluster.
7. Give people accessAssign an Azure Kubernetes Service RBAC role to the right Entra groups at the right scope, then run az aks get-credentials and kubelogin to sign in.
8. DeployApply your namespace, service account, deployment, service, ingress, autoscaler, disruption budget and network policy. The deployment must carry the label azure.workload.identity/use: "true" to get a token.
9. Plan the first upgradeCheck the support calendar for your version, see what az aks get-upgrades offers, and upgrade a staging cluster first.

• Set resource requests from real usage. The scheduler and the autoscalers work from requests, so wrong numbers waste money or cause evictions.
• Keep application pods off the system pool, and give it enough capacity that CoreDNS and metrics-server aren’t squeezed.
• Use the Horizontal Pod Autoscaler (or KEDA for queue-based scaling) for replicas, with the cluster autoscaler or node auto-provisioning for nodes.
• Choose Azure CNI Overlay for new clusters, and the Cilium dataplane for faster policy enforcement and better observability.
• Spread replicas across zones with topology spread constraints, and keep chatty services in the same zone when latency matters.
• Pick ephemeral OS disks where the VM size has the cache for it. Node start-up is faster and the disk is free.
• Scale CoreDNS and consider node-local DNS caching for services that make many lookups.
• Choose VM sizes from the workload: memory-heavy services want a different family than CPU-bound ones, and ARM-based sizes often cost less if your images support them.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Azure Kubernetes Service.

• Use the Free tier for development and learning, and pay for the Standard tier on production clusters where the SLA matters.
• Enable the cluster autoscaler or node auto-provisioning so idle capacity disappears overnight.
• Run stateless and batch workloads on Spot node pools, with a regular pool behind them.
• Buy Reservations or a Savings Plan for the steady base of VMs, and keep spikes on pay-as-you-go.
• Stop non-production clusters outside working hours with az aks stop. Disks and IP addresses still bill while it’s stopped.
• Right-size requests and VM sizes from metrics. Over-requested pods force larger nodes.
• Share one ingress or gateway instead of a load balancer and public IP per service.
• Trim Log Analytics ingestion. Container Insights can cost more than small clusters if it collects every log line.
• Use a NAT gateway or firewall deliberately, since both charge per hour and per GB of traffic.
• Tag the cluster and node resource group, and set a budget alert in Cost Management.

• Make the cluster private, or limit the API server with authorised IP ranges, and reach it through a VPN or ExpressRoute.
• Sign in with Microsoft Entra ID, use Azure RBAC for Kubernetes, and disable local accounts.
• Use Workload ID for every application that calls Azure, and avoid service principal secrets in pods.
• Turn on deployment safeguards and Azure Policy to refuse privileged containers, host paths and missing limits.
• Apply Pod Security Standards per namespace, and run containers as non-root with a read-only file system where you can.
• Add network policies from the start, with default deny, using the Cilium engine on overlay clusters.
• Keep secrets in Key Vault and mount them with the CSI driver, and encrypt the cluster’s data disks with your own key if your rules ask for it.
• Enable Microsoft Defender for Containers for image scanning, runtime alerts and recommendations.
• Use the NodeImage upgrade channel or a patching schedule, so nodes get security fixes without manual work.
• Send diagnostic logs (kube-audit, kube-apiserver) to a Log Analytics workspace, and alert on role changes and exec into pods.

Azure Activity Log shows who created, changed or deleted clusters, Azure Policy applies and reports on the rules above, Defender for Cloud gives posture and runtime findings, and Microsoft Purview and the Service Trust Portal hold compliance material. The shared duties follow the managed Kubernetes pattern: Microsoft operates the control plane, while you answer for node pools you configure, workload permissions, network policy, images and upgrading on time.

• Right-size VM sizes and requests, because idle nodes still draw power.
• Let the autoscaler or node auto-provisioning remove nodes you aren’t using.
• Stop development clusters overnight and at weekends.
• Try ARM-based VM sizes where your images support them, since they do more work per watt.
• Share clusters between teams with namespaces, instead of one small cluster per application.
• Cut log volume and keep chatty traffic inside a zone, so less data is stored and moved.
• The Azure Emissions Impact Dashboard estimates the footprint of a subscription. Check what it includes for AKS before you cite a figure.

Purchase options

What you actually pay for

• The pricing tier of each cluster, if it isn’t Free, per hour
• Virtual machines in every node pool, with discounts if you reserve or use Spot
• Managed disks, load balancers, public IPs and NAT gateways
• Outbound data transfer and cross-zone traffic where it applies
• Monitoring, Defender and other add-ons you turn on

The same orders-api service, shaped for Azure: a private Standard-tier cluster over three zones, Azure CNI Overlay with Cilium, Entra sign-in with Azure RBAC, local accounts off and Workload ID on. The Azure CLI tab builds it, links the application’s managed identity to one service account and applies the manifest with kubectl. Terraform builds the same cluster. The Python tab runs inside the pod and writes a receipt to Blob Storage with the federated token, no secret needed. The C# tab runs from a pipeline and reports nodes and pods that need attention. Replace the names, group IDs and subscription with your own. A cluster bills from the moment it exists, so delete the test one when you’re done.

# Placeholders: replace names, the admin group ID and the storage account with your own.
RG=rg-orders
LOC=centralindia
CLUSTER=aks-orders-prod
ACR=acrordersexample
STORAGE=storordersexample
ADMIN_GROUP=00000000-0000-0000-0000-000000000000

az group create --name $RG --location $LOC
az network vnet create --resource-group $RG --name vnet-orders --address-prefixes 10.20.0.0/16 \
  --subnet-name snet-nodes --subnet-prefixes 10.20.0.0/22
SUBNET_ID=$(az network vnet subnet show --resource-group $RG --vnet-name vnet-orders --name snet-nodes --query id -o tsv)
az acr create --resource-group $RG --name $ACR --sku Standard

# The cluster: Standard tier, three zones, overlay networking with Cilium, Entra sign-in, no local accounts, private API server.
az aks create --resource-group $RG --name $CLUSTER --location $LOC --tier standard \
  --zones 1 2 3 --node-count 3 --node-vm-size Standard_D4ds_v5 \
  --enable-cluster-autoscaler --min-count 3 --max-count 9 \
  --vnet-subnet-id $SUBNET_ID --network-plugin azure --network-plugin-mode overlay --pod-cidr 192.168.0.0/16 \
  --network-dataplane cilium --network-policy cilium \
  --enable-managed-identity --enable-aad --enable-azure-rbac --aad-admin-group-object-ids $ADMIN_GROUP --disable-local-accounts \
  --enable-oidc-issuer --enable-workload-identity --enable-private-cluster \
  --auto-upgrade-channel patch --node-os-upgrade-channel NodeImage \
  --attach-acr $ACR --generate-ssh-keys

# Updates only between 02:00 and 06:00 on Sundays (UTC).
az aks maintenanceconfiguration add --resource-group $RG --cluster-name $CLUSTER --name aksManagedAutoUpgradeSchedule \
  --schedule-type Weekly --day-of-week Sunday --interval-weeks 1 --start-time 02:00 --duration 4 --utc-offset +00:00

# The application's identity: a managed identity, a narrow role on one storage account, and a federated credential for one service account.
az identity create --resource-group $RG --name id-orders-api
CLIENT_ID=$(az identity show --resource-group $RG --name id-orders-api --query clientId -o tsv)
PRINCIPAL_ID=$(az identity show --resource-group $RG --name id-orders-api --query principalId -o tsv)
ISSUER=$(az aks show --resource-group $RG --name $CLUSTER --query oidcIssuerProfile.issuerUrl -o tsv)
az identity federated-credential create --resource-group $RG --identity-name id-orders-api --name orders-api \
  --issuer "$ISSUER" --subject system:serviceaccount:orders:orders-api --audiences api://AzureADTokenExchange
az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal \
  --role "Storage Blob Data Contributor" \
  --scope $(az storage account show --resource-group $RG --name $STORAGE --query id -o tsv)

# Let the support group read one namespace.
az role assignment create --assignee $ADMIN_GROUP --role "Azure Kubernetes Service RBAC Reader" \
  --scope "$(az aks show --resource-group $RG --name $CLUSTER --query id -o tsv)/namespaces/orders"

# Deploy. The API server is private, so run kubectl from the VNet, or wrap commands in "az aks command invoke".
az aks get-credentials --resource-group $RG --name $CLUSTER
kubelogin convert-kubeconfig -l azurecli
kubectl apply -f - <<EOF
apiVersion: v1
kind: Namespace
metadata:
  name: orders
  labels:
    pod-security.kubernetes.io/enforce: restricted
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: orders-api
  namespace: orders
  annotations:
    azure.workload.identity/client-id: "$CLIENT_ID"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-api
  namespace: orders
spec:
  replicas: 3
  selector:
    matchLabels:
      app: orders-api
  template:
    metadata:
      labels:
        app: orders-api
        azure.workload.identity/use: "true"
    spec:
      serviceAccountName: orders-api
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app: orders-api
      containers:
        - name: api
          image: $ACR.azurecr.io/orders-api:1.4.2
          ports:
            - containerPort: 8080
          env:
            - name: RECEIPT_ACCOUNT_URL
              value: https://$STORAGE.blob.core.windows.net
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8080
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
---
apiVersion: v1
kind: Service
metadata:
  name: orders-api
  namespace: orders
spec:
  selector:
    app: orders-api
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: orders-api
  namespace: orders
spec:
  ingressClassName: webapprouting.kubernetes.azure.com
  rules:
    - host: orders.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: orders-api
                port:
                  number: 80
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: orders-api
  namespace: orders
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: orders-api
  minReplicas: 3
  maxReplicas: 12
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: orders-api
  namespace: orders
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: orders-api
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: orders-api-from-ingress
  namespace: orders
spec:
  podSelector:
    matchLabels:
      app: orders-api
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: app-routing-system
      ports:
        - port: 8080
EOF
kubectl -n orders rollout status deployment/orders-api

# Later: which versions can this cluster move to?
az aks get-upgrades --resource-group $RG --name $CLUSTER --output table

# Placeholders: pass in your own group ID and storage account.
variable "location" {
  type    = string
  default = "centralindia"
}

variable "admin_group_id" {
  type = string
}

variable "storage_account_id" {
  type = string
}

resource "azurerm_resource_group" "orders" {
  name     = "rg-orders"
  location = var.location
}

resource "azurerm_virtual_network" "orders" {
  name                = "vnet-orders"
  location            = azurerm_resource_group.orders.location
  resource_group_name = azurerm_resource_group.orders.name
  address_space       = ["10.20.0.0/16"]
}

resource "azurerm_subnet" "nodes" {
  name                 = "snet-nodes"
  resource_group_name  = azurerm_resource_group.orders.name
  virtual_network_name = azurerm_virtual_network.orders.name
  address_prefixes     = ["10.20.0.0/22"]
}

resource "azurerm_kubernetes_cluster" "orders" {
  name                = "aks-orders-prod"
  location            = azurerm_resource_group.orders.location
  resource_group_name = azurerm_resource_group.orders.name
  dns_prefix          = "orders-prod"
  sku_tier            = "Standard"

  private_cluster_enabled   = true
  local_account_disabled    = true
  oidc_issuer_enabled       = true
  workload_identity_enabled = true

  automatic_upgrade_channel = "patch"
  node_os_upgrade_channel   = "NodeImage"

  default_node_pool {
    name                 = "system"
    vm_size              = "Standard_D4ds_v5"
    vnet_subnet_id       = azurerm_subnet.nodes.id
    zones                = ["1", "2", "3"]
    auto_scaling_enabled = true
    min_count            = 3
    max_count            = 9

    upgrade_settings {
      max_surge = "33%"
    }
  }

  identity {
    type = "SystemAssigned"
  }

  network_profile {
    network_plugin      = "azure"
    network_plugin_mode = "overlay"
    network_data_plane  = "cilium"
    network_policy      = "cilium"
    pod_cidr            = "192.168.0.0/16"
  }

  azure_active_directory_role_based_access_control {
    azure_rbac_enabled     = true
    admin_group_object_ids = [var.admin_group_id]
  }

  maintenance_window_auto_upgrade {
    frequency   = "Weekly"
    interval    = 1
    duration    = 4
    day_of_week = "Sunday"
    start_time  = "02:00"
    utc_offset  = "+00:00"
  }
}

resource "azurerm_user_assigned_identity" "orders_api" {
  name                = "id-orders-api"
  location            = azurerm_resource_group.orders.location
  resource_group_name = azurerm_resource_group.orders.name
}

resource "azurerm_federated_identity_credential" "orders_api" {
  name                = "orders-api"
  resource_group_name = azurerm_resource_group.orders.name
  parent_id           = azurerm_user_assigned_identity.orders_api.id
  issuer              = azurerm_kubernetes_cluster.orders.oidc_issuer_url
  subject             = "system:serviceaccount:orders:orders-api"
  audience            = ["api://AzureADTokenExchange"]
}

resource "azurerm_role_assignment" "orders_blob" {
  scope                = var.storage_account_id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_user_assigned_identity.orders_api.principal_id
}

output "orders_api_client_id" {
  value = azurerm_user_assigned_identity.orders_api.client_id
}

# Runs inside the orders-api pod. The Workload ID webhook projects a token file into the pod and sets AZURE_CLIENT_ID,
# AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE; DefaultAzureCredential notices them and swaps the token for an Entra token.
import json
import os
from datetime import datetime, timezone

from azure.core.exceptions import ResourceExistsError
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient


class ReceiptStore:
    def __init__(self, account_url=None, container="receipts"):
        self.container = container
        credential = DefaultAzureCredential(exclude_interactive_browser_credential=True)
        self.service = BlobServiceClient(account_url or os.environ["RECEIPT_ACCOUNT_URL"], credential=credential)

    def put(self, order_id, total):
        now = datetime.now(timezone.utc)
        name = "%s/%s.json" % (now.strftime("%Y/%m/%d"), order_id)
        blob = self.service.get_blob_client(self.container, name)
        payload = json.dumps({"order": order_id, "total": total, "at": now.isoformat()})
        try:
            blob.upload_blob(payload.encode(), overwrite=False)    # an order id is written once
        except ResourceExistsError:
            return name + " (already stored)"
        return name


if __name__ == "__main__":
    store = ReceiptStore()
    print("saved", store.put("A-1042", 1249.50))

// dotnet add package KubernetesClient
// A quick health report for a pipeline: nodes that are not Ready, and pods stuck in Pending with the scheduler's reason.
// The kubeconfig written by "az aks get-credentials" plus kubelogin handles the Entra sign-in.
using k8s;
using k8s.Models;

var client = new Kubernetes(KubernetesClientConfiguration.BuildConfigFromConfigFile());
int problems = 0;

V1NodeList nodes = await client.CoreV1.ListNodeAsync();
foreach (V1Node node in nodes.Items)
{
    var ready = node.Status.Conditions.FirstOrDefault(c => c.Type == "Ready");
    if (ready?.Status != "True")
    {
        problems++;
        Console.WriteLine($"NODE  {node.Metadata.Name}: not ready ({ready?.Reason ?? "no Ready condition"})");
    }
}

V1PodList pending = await client.CoreV1.ListNamespacedPodAsync("orders", fieldSelector: "status.phase=Pending");
foreach (V1Pod pod in pending.Items)
{
    problems++;
    var why = pod.Status.Conditions?.FirstOrDefault(c => c.Type == "PodScheduled" && c.Status == "False");
    Console.WriteLine($"POD   {pod.Metadata.Name}: pending - {why?.Message ?? "no scheduling message yet"}");
}

Console.WriteLine(problems == 0 ? $"{nodes.Items.Count} nodes ready, no pending pods in 'orders'." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

If you only need to run a few containers, look at Azure Container Apps or App Service first, since they hide Kubernetes entirely. For event-driven code with no cluster use Azure Functions. The data behind a cluster typically lives outside it, for example in Azure SQL Database or Azure Blob Storage.