Azure Kubernetes Service (AKS) Beginner's Guide: Architecture, Networking, Ingress & Security

Azure Kubernetes Service (AKS) is Microsoft's managed Kubernetes cluster service. Microsoft fully manages the Kubernetes (k8s) control plane (etcd, kube-apiserver, kube-controller-manager, kube-scheduler) for free, and users only manage worker nodes (VMs). It is the standard service for serious container orchestration on Azure, widely adopted for microservices, CI/CD, scalable web apps, and ML pipeline platforms. As of 2026, it is one of Azure's flagship compute services, with 30-40% of new development projects built on AKS.

The control plane is free on the Standard tier (Free SLA, 99.5%). Enabling the Uptime SLA (99.95%) costs $73/month plus worker node VM costs. Worker nodes follow standard Azure VM pricing (Pay-as-you-go, Reserved Instance, Spot eligible). Load balancers, public IPs, and storage are billed separately. A typical dev environment (D2s_v5 x 3 nodes) runs $200-350/month, while production (D4s_v5 x 5 nodes + Uptime SLA + LB + Premium SSD) runs around $1,000-2,000/month. For cost optimization, Spot Node Pools, Reserved Instances, and KEDA-based pod autoscaling (scale-to-zero during idle) are effective.

An AKS cluster consists of: 1) Control Plane (Microsoft-managed): etcd, kube-apiserver, kube-controller-manager, kube-scheduler. 2) Node Pools: groups of VMs (System Node Pool runs kube-system pods; User Node Pools run application pods). 3) Networking: Azure CNI (pods get VNet IPs), Kubenet (NAT), or Azure CNI Overlay (pods get overlay IPs, more efficient). 4) Storage: Azure Disk CSI Driver (Premium SSD / Ultra Disk), Azure File CSI Driver (SMB / NFS), Azure Blob CSI Driver. 5) Add-ons: HTTP Application Routing, Application Gateway Ingress Controller (AGIC), Azure Policy, Azure Monitor for Containers, Microsoft Defender for Containers.

Azure CNI is recommended for nearly all new projects. Kubenet (legacy): pods use an internal IP range (10.244.0.0/16) with NAT for external traffic. Low IP consumption and simple, but limited pod-to-pod communication and limited Network Policy support. Azure CNI (Classic): pods get IPs directly from a VNet subnet, allowing direct communication with VNet resources, other VNets, and on-prem. Full Network Policy support, but heavy IP consumption (up to 250 IPs per node). Azure CNI Overlay (GA 2023, current recommendation): pods use an overlay IP range and do not consume VNet IPs, combining Azure CNI flexibility with IP efficiency. For new AKS deployments, Azure CNI Overlay is the only sensible choice and has become the standard AKS networking pattern.

Main AKS Ingress options: 1) Application Gateway Ingress Controller (AGIC): uses Azure Application Gateway WAF v2 as Ingress, WAF integration, Azure-managed, mid-tier cost. 2) NGINX Ingress Controller: the OSS standard, strong community support, lowest cost (internal LB only). 3) Istio (Service Mesh): also handles inter-service communication; complex but powerful for mTLS and observability. 4) Application Gateway for Containers (AGC, GA 2024): the next generation of Application Gateway, Kubernetes Gateway API compliant, more features and better performance. Use NGINX for simple needs, AGIC or AGC if you need WAF, and Istio when inter-microservice communication is complex. AGC went GA in 2024 and is expected to become the mainstream AGIC successor.

Authentication from AKS pods to Azure resources (Storage Accounts, Key Vaults, etc.) has evolved. AAD Pod Identity (legacy): installs the aad-pod-identity add-on in the cluster and assigns Azure Identities based on pod IPs. Slated for retirement in September 2024 and treated as legacy. AKS Workload Identity (new, recommended): uses standard Kubernetes Service Accounts + Azure AD + OIDC federation. Pods present a Service Account OIDC token to Azure AD to obtain access tokens. Simple, scalable, and performant. As of 2026, Workload Identity is the only choice for AKS, and existing AAD Pod Identity users must migrate to Workload Identity.

Key security measures: 1) Private Cluster (expose the API Server only on a private IP, blocking public access). 2) Enable Microsoft Defender for Containers (vulnerability scanning + runtime detection). 3) Enforce organizational policies via Azure Policy for AKS (e.g., disallow privileged containers). 4) Manage pod authentication with Microsoft Entra Workload Identity. 5) Scan images with Azure Container Registry (ACR) + Trivy / Microsoft Defender. 6) Restrict in-cluster traffic with Network Policy (Calico). 7) Control API Server access with RBAC for Kubernetes + Microsoft Entra ID integration. 8) Enable automatic AKS Update / Node Image updates. 9) Send audit logs to Microsoft Sentinel. 10) Encrypt Kubernetes Secrets (envelope encryption with Key Vault). These are mandatory items for production AKS meeting SOC2 / ISO 27001 audits.

AZ-104 (Administrator) domain 3 covers AKS fundamentals. AZ-204 (Developer Associate, note: retires July 2026) covers AKS deployment from a developer's perspective. AZ-400 (DevOps Engineer Expert) covers CI/CD and GitOps (Argo CD / FluxCD) to AKS. AZ-305 (Solutions Architect Expert) covers architectural choices (AKS vs Container Apps vs Functions). SC-100 (Cybersecurity Architect Expert) covers AKS security. Outside Microsoft, pairing with CKA (Certified Kubernetes Administrator), CKAD (Application Developer), and CKS (Security) is a powerful combination for DevOps engineers. See the Azure DevOps Engineer career roadmap for details.