Azure AKS Delivery – Secure & Scalable Kubernetes Production Platform

The application domain is hosted in Azure DNS and resolves to the public IP address of Azure Application Gateway (WAF v2) in the public subnet. The Web Application Firewall runs in Prevention mode with the Microsoft-managed Default Rule Set to block OWASP Top 10 attacks such as SQL injection and cross-site scripting, together with custom rules for rate limiting and blocking unwanted sources. Application Gateway terminates TLS, redirects HTTP to HTTPS, and can load certificates directly from Azure Key Vault.

Application Gateway forwards clean traffic to the Traefik ingress controller, which runs inside the cluster in the private subnet and is exposed through an internal Azure load balancer. Traefik routes requests to the correct microservice by host name and path, and applies middleware such as retries, header rules, and per-route rate limits, so routing rules are managed with the services as Kubernetes resources.

AKS runs the Kubernetes control plane as a managed service. Cluster access is integrated with Microsoft Entra ID and Azure role-based access control, local accounts are disabled, and the API server can be restricted to authorized IP ranges or made private. Automatic upgrade channels and planned maintenance windows keep the cluster and node images up to date at predictable times.

A system node pool runs critical cluster components, while application workloads run on separate nodes. Nodes are backed by Virtual Machine Scale Sets and spread across availability zones, and pod topology spread constraints and pod disruption budgets keep replicas distributed and available during upgrades and node replacement.

Node Auto Provisioning, the managed Karpenter implementation for AKS, provisions worker capacity for application workloads. When pods cannot be scheduled, it selects the virtual machine sizes that best fit their CPU, memory, and architecture requirements and creates nodes within seconds to minutes. NodePool and AKSNodeClass resources define allowed VM families, capacity types including Azure Spot Virtual Machines for interruptible workloads, and limits. Consolidation replaces underused nodes with fewer or smaller ones, reducing idle capacity, and node expiry ensures nodes are regularly refreshed with the latest images.

The Horizontal Pod Autoscaler scales each microservice on CPU, memory, or custom metrics, and the KEDA add-on can scale workloads on event sources such as message queues. As pod counts rise, Node Auto Provisioning adds the nodes they need, and as they fall, it removes the spare capacity.

Stateful components use persistent volumes backed by Azure Managed Disks through the Azure Disk CSI driver, with zone-redundant storage options where available. Disks are encrypted at rest, and volume snapshots support backup and recovery.

Images are stored in Azure Container Registry. The cluster pulls images using its kubelet managed identity with the AcrPull role, so no registry passwords are stored in the cluster or pipelines.

Application secrets, connection strings, and certificates are stored in Azure Key Vault and mounted into pods by the Azure Key Vault provider for the Secrets Store CSI Driver. Microsoft Entra Workload ID gives each workload its own federated identity with access only to the secrets it needs, so no credentials are written into manifests or images.

Source code lives in GitHub. On every merge, an Azure DevOps build pipeline compiles the service, runs tests, builds the container image, and pushes it to Azure Container Registry with a unique version tag. An Azure DevOps release pipeline then deploys the new version to AKS using Helm charts or Kubernetes manifests, with approvals and checks before production. Pipelines connect to Azure through service connections that use workload identity federation, avoiding long-lived secrets.

Container insights in Azure Monitor collects metrics and logs from the cluster, nodes, and pods, and Azure Monitor managed service for Prometheus can store Kubernetes and application metrics for dashboards in Azure Managed Grafana. Application Insights traces requests across microservices and records failures and response times. Alert rules notify the team about failing pods, node pressure, ingress errors, and slow responses.