Azure Kubernetes Service: Managed Control Plane, Node Pools, Identity, and Networking
A production model for AKS architecture, Entra authentication, node pools, CNI choices, upgrades, observability, availability, and shared responsibility.
Azure Kubernetes Service manages the Kubernetes control plane while customer node pools run workloads in Azure virtual machines. The API server, scheduler, controllers, and cluster state are service responsibilities; pod specifications, identities, network exposure, persistent data, and node-pool strategy remain customer concerns.
System and user node pools
Every production design should isolate critical system pods from application pressure. System node pools host components such as CoreDNS and metrics services; user pools separate application workloads by VM family, operating system, zone, scaling policy, labels, or taints. Autoscaling responds to scheduling demand but does not repair incorrect requests or unavailable quota.
Identity and access
Microsoft recommends Entra ID authentication for the API server. Authorization may combine Kubernetes RBAC with supported Azure integration. Workloads should use managed workload identity rather than embedded service-principal secrets. Keep cluster administration, node identity, image-pull permission, and application resource access as distinct roles.
Network and ingress
Public or private control-plane access, Azure CNI options, subnet sizing, network policy, DNS, load balancers, application gateways, and ingress controllers all affect reachability. A private cluster still needs outbound paths for required Azure and artifact endpoints. Record which component owns TLS, source IP preservation, and health checks.
Upgrades and operations
Plan control-plane and node-image upgrades through supported version paths and maintenance windows. Respect disruption budgets, but also verify that workloads have multiple replicas and topology spread. Azure Monitor, managed Prometheus options, Kubernetes events, audit data, and application telemetry form the diagnostic picture. Costs include nodes, disks, load balancers, egress, logs, and paid service tiers or add-ons; the managed control plane does not make the surrounding system free.
Sources: AKS core concepts, AKS cluster authentication, AKS control-plane networking