1 · When AKS Is Right vs Overkill
✅ Choose AKS When
- 10+ microservices needing independent release cadences
- Multi-team ownership — namespace isolation needed
- Complex scaling (mix of CPU, memory, queue-based)
- Service mesh / advanced traffic splitting required
- Hybrid workloads (Arc-enabled K8s on-prem)
⚠️ AKS Is Overkill When
- ≤3 containers with simple HTTP scaling → Container Apps
- Single batch job or sidecar → ACI
- Team lacks K8s operational skills and budget for upskilling
- Monolith with no decomposition plan → App Service
- Event-driven functions only → Azure Functions
2 · Cluster Architecture
Free control plane: Azure manages and funds the control plane — you pay only for worker node VMs, storage, and networking.
3 · Networking Models — Decision Matrix
Kubenet
- Pods get IPs from a virtual bridge (NAT)
- Conserves VNet address space
- No direct pod ↔ VNet communication
- Max 400 nodes per cluster
- Use: Dev/test, small clusters
Azure CNI
- Every pod gets a VNet IP
- Direct connectivity — no NAT
- Consumes subnet IPs fast
- Network policies natively supported
- Use: Enterprise, strict NSG/firewall rules
CNI Overlay
- Pod CIDR overlayed on node subnet
- Pods routable within cluster, NAT to VNet
- Saves IP space like kubenet
- Supports Network Policies
- Use: Large clusters needing policies + IP conservation
Exam shortcut: "Pods need VNet-routable IPs" → Azure CNI. "Save IP space + network policies" → CNI Overlay. "Simple dev cluster" → Kubenet.
4 · Node Pool Design
| Pool | Mode | VM SKU | Taints / Labels | Purpose |
|---|---|---|---|---|
| system | System | Standard_D4s_v5 | CriticalAddonsOnly=true:NoSchedule | CoreDNS, metrics |
| general | User | Standard_D8s_v5 | workload=general | Stateless APIs |
| compute | User | Standard_F16s_v2 | workload=cpu-intensive | ML inference |
| spot | User | Standard_D4s_v5 (Spot) | kubernetes.azure.com/scalesetpriority=spot:NoSchedule | Batch, tolerant workloads |
Spot pools: Azure can evict nodes with 30 s notice. Use pod disruption budgets and tolerations — never run stateful primaries on spot.
5 · Scaling: Cluster Autoscaler + HPA + KEDA
How They Interact
- HPA/KEDA increases desired pod count based on metrics or events.
- If no node capacity, pods enter
Pendingstate. - Cluster Autoscaler detects pending pods → scales out VMSS.
- Optionally, Virtual Nodes schedule overflow onto ACI instantly.
KEDA for AZ-305: Scales to zero replicas (cost saving) and supports 60+ event sources (Service Bus, Event Hub, Cosmos DB change feed).
6 · Identity & RBAC
Workload Identity (Recommended)
- Replaces pod-managed identity (deprecated).
- Kubernetes Service Account → federated with Azure AD Managed Identity.
- No secrets in pods — OIDC token exchange via projected volume.
Azure RBAC for Kubernetes
- Unify Azure IAM and K8s RBAC — single policy plane.
- Assign
Azure Kubernetes Service RBAC Reader/Writer/Admin/Cluster Adminat namespace or cluster scope. - Conditional Access policies apply to
kubectlsessions.
Best practice: Enable Azure RBAC + Workload Identity + disable local accounts for zero-secret, auditable clusters.
7 · Ingress & Service Mesh
| Option | Layer | TLS | WAF | Best For |
|---|---|---|---|---|
| NGINX Ingress Controller | L7 | cert-manager | ModSecurity (DIY) | General web apps, OSS standard |
| Application Gateway Ingress (AGIC) | L7 | Native + Key Vault | WAF v2 built-in | Enterprise WAF + Azure-native |
| Istio Service Mesh | L4-L7 | mTLS auto | Via ext authz | Advanced traffic mgmt, observability |
AKS managed Istio: Azure now offers Istio as a managed add-on — control plane managed by Azure, reducing ops burden.
8 · Real-World: Fintech Microservices Platform
Scenario
A fintech company runs 25 microservices (payments, fraud detection, KYC, notifications) serving 50 K TPS at peak. Requirements: PCI-DSS compliance, zero-downtime deploys, burst during market open.
Architecture Decisions
- Networking: Azure CNI — pods need direct VNet IPs for NSG rules + private endpoint access to Azure SQL / Cosmos DB.
- Node pools: System (3 nodes) + General API (6–20 nodes, autoscale) + GPU pool for fraud ML (2 spot + 1 on-demand) + Spot batch for report generation.
- Scaling: HPA on CPU for APIs + KEDA scaling on Service Bus queue depth for payment processing + Cluster Autoscaler min 6 / max 20.
- Identity: Workload Identity per service → least-privilege access to Key Vault, Storage, Cosmos. Azure RBAC, local accounts disabled.
- Ingress: AGIC with WAF v2 (OWASP 3.2 rules) + Istio mesh for mTLS between services (PCI requirement).
- Deployment: Flux GitOps with progressive delivery (Flagger canary) — automated rollback on error-rate spike.
🎯 Exam Tip
AZ-305 loves scenario questions mixing networking + scaling + identity. Remember: Azure CNI when pods must be VNet-routable; KEDA when scaling on events (not just CPU); Workload Identity is the modern answer for pod-to-Azure auth (never store credentials in pods). If they mention "WAF for AKS" → AGIC + Application Gateway WAF v2.