In this post, we are going to explore all the aspects of AKS, including an overview of the Azure Kubernetes Service (AKS), container solutions in Azure, when to use AKS, key features, getting started with AKS, and best practices and reference architectures. AKS provides a reliable and scalable platform for containerized applications, making it a popular choice for organizations looking to adopt containerized technologies.

What is Azure Kubernetes Service (AKS)?

Azure Kubernetes Service (AKS) is a managed Kubernetes service that you can use to deploy and manage containerized applications. You need minimal container orchestration expertise to use AKS. AKS reduces the complexity and operational overhead of managing Kubernetes by offloading much of that responsibility to Azure. AKS is an ideal platform for deploying and managing containerized applications that require high availability, scalability, and portability, and for deploying applications to multiple regions, using open-source tools, and integrating with existing DevOps tools.

Overview of AKS

AKS reduces the complexity and operational overhead of managing Kubernetes by shifting that responsibility to Azure. When you create an AKS cluster, Azure automatically creates and configures a control plane for you at no cost. The Azure platform manages the AKS control plane, which is responsible for the Kubernetes objects and worker nodes that you deploy to run your applications. Azure takes care of critical operations like health monitoring and maintenance, and you only pay for the AKS nodes that run your applications.

Container solutions in Azure

Azure offers a range of container solutions designed to accommodate various workloads, architectures, and business needs.

Choose an Azure container service – Azure Architecture Center | Microsoft Learn

For more information to understand Containerization, Container Ecosystem in Azure, Use case, Containerization Decision Tree for Legacy Applications, Refer this post:

Rehost an on-premises application to Containers – Rajeev Singh | Coder, Blogger, YouTuber (singhrajeev.com)

When to use AKS

The following list describes some of the common use cases for AKS, but by no means is an exhaustive list:

• Lift and shift to containers with AKS: Migrate existing applications to containers and run them in a fully-managed Kubernetes environment.
• Microservices with AKS: Simplify the deployment and management of microservices-based applications with streamlined horizontal scaling, self-healing, load balancing, and secret management.
• Secure DevOps for AKS: Efficiently balance speed and security by implementing secure DevOps with Kubernetes.
• Bursting from AKS with ACI: Use virtual nodes to provision pods inside ACI that start in seconds and scale to meet demand.
• Machine learning model training with AKS: Train models using large datasets with familiar tools, such as TensorFlow and Kubeflow.
• Data streaming with AKS: Ingest and process real-time data streams with millions of data points collected via sensors, and perform fast analyses and computations to develop insights into complex scenarios.
• Using Windows containers on AKS: Run Windows Server containers on AKS to modernize your Windows applications and infrastructure.

Features of AKS

The following table lists some of the key features of AKS:

Getting started with AKS.

Let’s explore below topics for AKS.

• Core Kubernetes concepts for AKS.
• Choose a Kubernetes Option – Edge Compute or bare-metal
• Run and Evaluate application deployment on AKS.
• Review the Azure Well-Architected Framework for AKS to understand how to design and operate reliable, secure, efficient, and cost-effective applications on AKS.
• Plan your design and operations for AKS using our reference architectures.
• Explore configuration options and recommended best practices for cost optimization on AKS.
• Microservices and AKS architecture.
• Security best practices.
• Monitoring best practices.

Core Kubernetes concepts for AKS.

To explore code Kubernetes, check out these urls.

App Modernization using AKS (Azure Kubernetes Services) – Rajeev Singh | Coder, Blogger, YouTuber (singhrajeev.com)

Azure Kubernetes Services (AKS) core concepts – Azure Kubernetes Service | Microsoft Learn

Choose a Kubernetes Option

Choose a Kubernetes at the edge compute option

Choose a Kubernetes at the edge compute option – Azure Architecture Center | Microsoft Learn

Choose a bare-metal Kubernetes at the edge platform option

Choose a bare-metal Kubernetes at the edge platform option – Azure Architecture Center | Microsoft Learn

MicroK8s by Canonical:

1. Delivered as a snap package, easy to install on Linux.
2. Creates a single-node cluster, manageable with MicroK8s tooling.
3. Packaged with kubectl, supports add-ons like helm, dns, ingress.
4. Supports multinode, Windows nodes (with Calico CNI), and HA scenarios.
5. Resource requirements vary based on the environment.

K3s by Rancher:

2. A lightweight Kubernetes distribution, deployed as a single binary.
3. Comes with embedded tools like kubectl and ctr.
4. SQLite3 is the default storage system, with support for other options.
5. Does not support Windows nodes.
6. HA can be achieved with an external or embedded database.

kubeadm

3. A tool for creating ground-up Kubernetes clusters.
4. Suitable for standard compute environments with Linux/Windows nodes.

Bare-metal Kubernetes offers a flexible and customizable approach to edge computing, with options like MicroK8s and K3s providing easy installation and management. Kubeadm allows for more traditional cluster creation. The choice between these options should be guided by the specific needs of the use case, such as resource requirements, desired level of operational simplicity, and support for high availability and Windows nodes.

Run and Evaluate application deployment on AKS.

Review the Azure Well-Architected Framework

Let’s review the Azure Well-Architected Framework for AKS to understand how to design and operate reliable, secure, efficient, and cost-effective applications on AKS.

Azure Well-Architected Framework based on the five pillars of architecture excellence:

• Reliability
• Security
• Cost optimization
• Operational excellence
• Performance efficiency

Understanding the Well-Architected Framework pillars can help produce a high-quality, stable, and efficient cloud architecture.

You can review your workload by using the  Azure Well-Architected Framework Review assessment.

Let’s understand these, Pillars.

Now, based on the above, let’s summarize the

Implementing these best practices will help you build reliable, secure, cost-effective, operationally efficient, and high-performing AKS clusters. Remember to tailor these recommendations to your specific workload requirements.

By following these best practices, you’ll create robust and efficient AKS clusters that meet your workload needs.

Plan your design and operations for AKS using our reference architectures.

Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. Azure Kubernetes Service (AKS) makes it simple to deploy a managed Kubernetes cluster in Azure.

Organizations are at various points in their understanding, rationalizing, and adoption of Kubernetes on Azure. Your organization’s journey will likely follow a similar path to many other technologies you’ve adopted; learning, aligning your organization around roles & responsibilities, and deploying production-ready workloads. From there, you’ll iterate; growing your product as your customer and business demands change.

Path to Production

• AKS is chosen for its benefits and trade-offs for specific workloads.
• The AKS Baseline Cluster is the starting point for building production-ready clusters.
• Organizations can start with the baseline and modify it according to their workload’s needs.

Baseline Infrastructure for AKS

• Provides a recommended baseline infrastructure for deploying an AKS cluster on Azure.
• Focuses on the AKS cluster itself, integrating with Azure services for observability and securing in-cluster traffic.
• Influenced by business requirements and serves as a starting point for pre-production and production stages.

Networking Configuration

• Utilizes a hub-spoke network topology for segregated management and minimized exposure to the public internet.
• Supports multi-regional growth and provides workload isolation.

Cluster Compute

• Concentrates on the compute resources required for the base AKS cluster.

Container Image Reference

• Addresses the management and storage of container images.

Policy Management

• Covers the implementation of policies for managing cluster resources.

Identity Management

• Discusses the integration of Microsoft Entra ID for the cluster and workload to manage identities and secure data flow.

Business Continuity

• Emphasizes scalability, cluster and node availability, and multi-region support for business continuity.

Operations

• Includes recommendations for cluster and workload CI/CD pipelines, cluster health metrics, and cost management.

The AKS Baseline Architecture is a foundational guide for setting up an AKS cluster within Azure. It emphasizes the importance of a secure, scalable, and well-managed Kubernetes environment. By following this baseline, organizations can ensure that their AKS clusters are set up with best practices in mind, paving the way for efficient operations and the ability to adapt to business needs.

Microservices

• Running microservices requires configuring network policies, pod autoscaling, and setting up distributed tracing.

Summary of Advanced Azure Kubernetes Service (AKS) Microservices Architecture

The Advanced Azure Kubernetes Service (AKS) Microservices Architecture builds upon the AKS Baseline architecture, providing additional configurations for running microservices on Azure Kubernetes Services. Here are the key points and sections:

Workflow:

1. Implements the Publisher-Subscriber, Competing Consumers, and Gateway Routing cloud design patterns.
2. Key steps:
   • An HTTPS request schedules a drone pickup.
   • The request passes through Azure Application Gateway into the in-cluster ingestion web application (an AKS microservice).
   • The ingestion web application produces a message and sends it to the Service Bus message queue.
   • The backend system assigns a drone and notifies the user.
   • The workflow includes consuming message information, interacting with microservices (e.g., Delivery, Drone Scheduler, Package), and returning delivery status.

Components:

2. Azure Kubernetes Service (AKS):
   • Managed Kubernetes cluster hosted in Azure.
   • AKS infrastructure features used:
     • System and user node pool separation.
     • AKS-managed Microsoft Entra ID for role-based access control (RBAC).
     • Azure Policy Add-on for AKS.
     • Azure Container Networking Interface (CNI).
     • Azure Monitor container insights.
3. Virtual Network:
   • Default virtual network created by AKS for agent nodes.
   • Can be customized for advanced scenarios.
4. Ingress:
   • Exposes HTTP(S) routes to services within the cluster.
5. Azure Load Balancer:
   • Routes internet traffic to the ingress controller.
6. External Data Stores:
   • Microservices write state to external data stores (e.g., Azure SQL Database, Azure Cosmos DB).
7. Microsoft Entra ID:
   • Used for managing Azure resources (e.g., Azure load balancers) and user authentication.
8. Azure Container Registry:
   • Stores private Docker images deployed to the cluster.
9. Azure Pipelines:
   • Runs automated builds, tests, and deployments.

The Advanced AKS Microservices Architecture enhances the baseline by addressing infrastructure and DevOps considerations.

By following this architecture, organizations can deploy and manage microservices efficiently on AKS, leveraging Azure’s robust features and best practices.

High-Security Compliance

• For regulated environments, the baseline cluster can be made highly secure to restrict interactions within the cluster.
• If you need a regulated environment, make the baseline implementation highly secure and restrict interactions to and from of the cluster. This use case is demonstrated in a cluster that’s designed to run a PCI-DSS 3.2.1 workload.

AKS regulated cluster for PCI-DSS 3.2.1 – Azure Architecture Center | Microsoft Learn

Business Continuity and Disaster Recovery

• A resilient solution involves multiple instances of the baseline cluster across regions in an active/active configuration.

The AKS Multi-Region, Multi-Cluster Architecture is designed to run multiple instances of Azure Kubernetes Service (AKS) clusters across different regions in an active/active and highly available configuration. Here are the major points and sections:

1. Multiple Clusters/Multiple Regions:
   • Deployment of multiple AKS clusters, each in a separate Azure region.
   • Network traffic is routed between all regions during normal operations.
   • In case one region becomes unavailable, traffic is rerouted to the closest operational region.
2. Hub-Spoke Network Per Region:
   • A regional hub-spoke network pair is deployed for each regional AKS instance.
   • Azure Firewall Manager policies manage firewall policies across all regions.
3. Regional Key Store:
   • Azure Key Vault is provisioned in each region to store sensitive values and keys specific to that region’s AKS instance and supporting services.
4. Azure Front Door:
   • Utilized for load balancing and routing traffic to a regional Azure Application Gateway instance, which sits in front of each AKS cluster.
   • Enables layer seven global routing, which is essential for this architecture.
5. Log Analytics:
   • Regional Log Analytics instances are used for storing regional networking metrics and diagnostic logs.
   • A shared Log Analytics instance stores metrics and diagnostic logs for all AKS instances.
6. Container Registry:
   • A single Azure Container Registry stores the container images for the workload.
   • Geo-replication ensures continued access to images even if a region experiences an outage.
7. Design Patterns:
   • Geographical Node (geodes), where any region can service any request.
   • Deployment Stamps, where multiple independent copies of an application or application component are deployed from a single source.

The AKS Multi-Region, Multi-Cluster Architecture provides a robust framework for deploying AKS clusters across multiple regions. It ensures high availability and resilience by leveraging Azure’s advanced networking, security, and container management features. This architecture is ideal for organizations seeking to maintain operational continuity and optimize performance for users across different geographical locations.

Best Practices

• The Cloud Adoption Framework provides guidance through the phases of the cloud adoption lifecycle.
• It includes tools and content to simplify the adoption of Kubernetes and cloud-native practices at scale.

Kubernetes in the Cloud Adoption Framework:

To prepare for this phase of the cloud adoption lifecycle, use the following exercises:

• Application development and deployment: Examine patterns and practices of application development, configure continuous integration and continuous delivery (CI/CD) pipelines, and implement site reliability engineering (SRE) best practices.
• Cluster design and operations: Identify for cluster configuration and network design. Ensure future scalability by automating infrastructure provisioning. Maintain high availability by planning for business continuity and disaster recovery.
• Cluster and application security: Familiarize yourself with Kubernetes security essentials. Review the secure setup for clusters and application security guidance.
• AKS landing zone accelerator: The AKS landing zone accelerator provides an architectural approach and reference implementation that enables effective workload and scenario operationalization of landing zones on Azure, at scale and aligned with the Azure roadmap and the Microsoft Cloud Adoption Framework for Azure.

Best Practices:

Start by aligning your cluster with Microsoft’s AKS Baseline Cluster.

Best Practices for Cluster Operations 

Building and running applications successfully in Azure Kubernetes Service (AKS) requires understanding and implementation of some key concepts, including:

• Multi-tenancy and scheduler features.
• Cluster and pod security.
• Business continuity and disaster recovery.

The AKS product group, engineering teams, and field teams (including global black belts (GBBs)) contributed to, wrote, and grouped the following best practices and conceptual articles. Their purpose is to help cluster operators and developers better understand the concepts above and implement the appropriate features.

The Azure Kubernetes Service (AKS) best practices guide is a comprehensive resource for cluster operators and developers to build and manage applications effectively. Here are the major points and sections:

1. Cluster Operator Best Practices:
   • Understand application needs in collaboration with developers.
   • Implement deployment and testing patterns for quality assurance.
   • Manage multi-tenancy, security, and disaster recovery.
2. Developer Best Practices:
   • Focus on application development within the AKS environment.
   • Utilize AKS features for efficient application management.
3. Key Concepts:
   • Multi-tenancy and scheduler features for resource allocation.
   • Cluster and pod security for protecting applications.
   • Business continuity strategies for uninterrupted service.
4. Multi-Tenancy:
   • Core components and logical isolation with namespaces.
   • Resource quotas and pod disruption budgets for stability.
   • Advanced scheduler features like taints, tolerations, and affinity rules.
5. Authentication and Authorization:
   • Integration with Microsoft Entra ID and Kubernetes RBAC.
   • Azure RBAC and pod identities for secure access control.
6. Cluster Security and Upgrades:
   • Secure API server access and container restrictions.
   • Manage upgrades and node reboots for system integrity.
7. Container Image Management:
   • Secure image and runtime environments.
   • Automated builds on base image updates for consistency.
8. Pod Security:
   • Secure resource access and limit credential exposure.
   • Utilize pod identities and digital key vaults for data protection.
9. Network and Storage:
   • Choose appropriate network models and ingress solutions.
   • Implement storage types and backups for data resilience.

Adhering to these best practices ensures that AKS clusters are optimized for performance, security, and scalability. By following these guidelines, cluster operators and developers can create a robust and efficient environment for deploying and managing containerized applications in Azure.

Best Practices for AKS Workloads

The Azure Kubernetes Service Checklist – ✨ Be ready for production ✨ (the-aks-checklist.com)

Business Continuity

• Scalability and availability are key, with support for multi-region deployment.

Operations Guide

Getting your workload deployed on AKS is a great milestone and this is when day-2 operations are going to be top-of-mind. Microsoft’s AKS Day 2 Operations Guide was built for your ease of reference. This will help ensure you are ready to meet the demands of your customers and ensure you are prepared for break-fix situations via optimized triage processes.

Day-2 operations help you:

• Keep up to date with your service-level agreement (SLA) or service-level objective (SLO) requirements.
• Troubleshoot customer support requests.
• Stay current with the latest platform features and security updates.
• Plan for future growth.

Triage practices for AKS operations

A root-cause analysis for an Azure Kubernetes Service (AKS) cluster is often challenging. To simplify the process, consider triaging issues by using a top-down approach based on the cluster hierarchy. Start at the cluster level and drill down if necessary.

The following section provides an overview of a series about triage practices, which describes the top-down approach in detail. The articles provide examples that use a set of tools and dashboards. The articles describe how these examples highlight symptoms of problems.

Common problems that are addressed in this series include:

• Network and connectivity problems that are caused by improper configuration.
• Broken communication between the control plane and the node.
• Kubelet pressures that are caused by insufficient compute, memory, or storage resources.
• Domain Name System (DNS) resolution problems.
• Nodes that run out of disk input/output operations per second (IOPS).
• An admission control pipeline that blocks several requests to the API server.
• A cluster that doesn’t have permissions to pull from the appropriate container registry.

The triage practices series

Stay current with AKS

Kubernetes and AKS are both moving fast. The platform is evolving and just knowing what’s on the roadmap might help you make architectural decisions and understand planned deprecations; consider bookmarking it.

Azure Kubernetes Service Roadmap (Public) (github.com)

Check latest updates: AKS Automatic – AKS Engineering Blog (azure.github.io)

Quickstart: Deploy an Azure Kubernetes Service (AKS) Automatic cluster (preview) – Azure Kubernetes Service | Microsoft Learn

Azure Arc-enabled Kubernetes

Azure Kubernetes Service offers you a managed Kubernetes experience on Azure, however there are workloads or situations that might be best suited for placing your own Kubernetes clusters under Azure Arc-enabled Kubernetes management. This includes your clusters such as RedHat OpenShift, RedHat RKE, and Canonical Charmed Kubernetes. Azure Arc management can also be used with Kubernetes Cluster API Provider Azure clusters to benefit from the Azure Resource Manager representation of the cluster and availability of cluster extensions like Azure Monitor container insights and Azure Policy. Azure Arc-enabled Kubernetes can also be used with AKS on Azure Stack HCI clusters and with Kubernetes clusters running on other cloud providers.

Azure Arc-enabled Kubernetes

Managed service provider

If you’re a managed service provider, you already use Azure Lighthouse to manage resources for multiple customers. Azure Kubernetes Service supports Azure Lighthouse so that you can manage hosted Kubernetes environments and deploy containerized applications within your customers’ tenants.

What is Azure Lighthouse? – Azure Lighthouse | Microsoft Learn

Explore configuration options and recommended best practices for cost optimization on AKS.

Optimize Costs in Azure Kubernetes Service (AKS) – Azure Kubernetes Service | Microsoft Learn

Cost optimization is about maximizing the value of resources while minimizing unnecessary expenses within your cloud environment. This process involves identifying cost effective configuration options and implementing best practices to improve operational efficiency. An AKS environment can be optimized to minimize cost while taking into account performance and reliability requirements.

1. Prepare the Application Environment: Evaluate the resource requirements of your application to choose the right VM types, considering factors like cost-effectiveness and performance.
2. Build Cloud Native Applications: Design your applications to be as lean and efficient as possible, which can help reduce costs.
3. Monitor Your Environment and Spend: Use tools like Microsoft Cost Management to increase visibility into your spending and resource usage.
4. Optimize Workloads Through Autoscaling: Implement autoscaling to adjust resources automatically based on workload demands, which can lead to cost savings.
5. Save with Azure Discounts: Take advantage of Azure discounts, such as Azure Reservations, to reduce costs.

Cost optimization in AKS is an ongoing process that requires a strategic approach to infrastructure selection, application design, monitoring, and workload management. By following these best practices, you can maximize the value of your resources and minimize unnecessary expenses, leading to a more cost-effective cloud environment. Implementing these measures can significantly contribute to the operational efficiency and financial health of your AKS deployments.

Cost Optimization design principles – Microsoft Azure Well-Architected Framework | Microsoft Learn

1. Develop Cost-Management Discipline: Establish a culture within your team that prioritizes budget awareness, expense tracking, and cost reporting. This involves understanding how your workload aligns with organizational goals and financial operations (FinOps) practices¹.
2. Design with a Cost-Efficiency Mindset: When designing your architecture, consider the return on investment (ROI) and financial constraints. Make sure that the allocated budgets enable you to meet your goals and that you’re maximizing the investment in resources through better utilization or reduction¹.
3. Design for Usage Optimization: Focus on spending only on what is necessary to achieve the highest ROI. This means maximizing the use of resources and operations to avoid wasteful expenditure¹.
4. Design for Rate Optimization: Seek the best rates for your usage patterns. This could involve choosing the right pricing model or service tier to match your workload requirements¹.
5. Monitor and Optimize Over Time: Continuously monitor your environment and adjust as needed. This includes setting, measuring, and protecting financial targets to ensure ongoing cost optimization¹.

The principles of cost optimization in the Azure Well-Architected Framework emphasize the importance of a disciplined approach to cost management, efficient design, usage optimization, rate optimization, and continuous monitoring. By adhering to these principles, you can manage costs effectively and ensure that you are getting the most value out of your Azure workloads. Implementing these strategies will help sustain and improve your ROI, making your cloud architecture both cost-effective and well-aligned with your business objectives.

Embrace FinOps to build a cost saving culture

Financial operations (FinOps) is a discipline that combines financial accountability with cloud management and optimization. It focuses on driving alignment between finance, operations, and engineering teams to understand and control cloud costs. The FinOps foundation has released several notable projects:

• FinOps Framework – an operating model for how to practice and implement FinOps.
• FOCUS Specification – a technical specification and open standard for cloud usage, cost, and billing data across all major cloud provider services.

Azure Kubernetes Service (AKS) – Cost Optimization Techniques – Microsoft Community Hub

FinOps Foundation – What is FinOps?

Microservices and AKS architecture.

Below reference architecture shows a microservices application deployed to Azure Kubernetes Service (AKS). It describes a basic AKS configuration that can be the starting point for most deployments. 

Microservices architecture on AKS – Rajeev Singh | Coder, Blogger, YouTuber (singhrajeev.com)

Security best practices.

The below post explores Kubernetes security best practices.

AKS Security: Best practices – Rajeev Singh | Coder, Blogger, YouTuber (singhrajeev.com)

Monitoring best practices.

The below post explores the monitoring data generated by AKS and analyzed with Azure Monitor 

Monitor Azure Kubernetes Service (AKS) – Rajeev Singh | Coder, Blogger, YouTuber (singhrajeev.com)

Conclusion

This document provides an overview of the Azure Kubernetes Service (AKS), including key topics including an overview, container solutions in Azure, when to use AKS, key features, getting started with AKS, and best practices and reference architectures.

In conclusion, Azure Kubernetes Service (AKS) is a powerful container orchestration service that provides scalability, flexibility, high availability, and automated deployment capabilities for containerized applications on Azure. By implementing the best practices and reference architectures provided in this document, you can design and operate reliable, secure, efficient, and cost-effective applications on AKS.

References:

What is Azure Kubernetes Service (AKS)? – Azure Kubernetes Service | Microsoft Learn