1 · When AKS Is Right vs Overkill

✅ Choose AKS When

  • 10+ microservices needing independent release cadences
  • Multi-team ownership — namespace isolation needed
  • Complex scaling (mix of CPU, memory, queue-based)
  • Service mesh / advanced traffic splitting required
  • Hybrid workloads (Arc-enabled K8s on-prem)

⚠️ AKS Is Overkill When

  • ≤3 containers with simple HTTP scaling → Container Apps
  • Single batch job or sidecar → ACI
  • Team lacks K8s operational skills and budget for upskilling
  • Monolith with no decomposition plan → App Service
  • Event-driven functions only → Azure Functions

2 · Cluster Architecture

Free control plane: Azure manages and funds the control plane — you pay only for worker node VMs, storage, and networking.

3 · Networking Models — Decision Matrix

Kubenet

  • Pods get IPs from a virtual bridge (NAT)
  • Conserves VNet address space
  • No direct pod ↔ VNet communication
  • Max 400 nodes per cluster
  • Use: Dev/test, small clusters

Azure CNI

  • Every pod gets a VNet IP
  • Direct connectivity — no NAT
  • Consumes subnet IPs fast
  • Network policies natively supported
  • Use: Enterprise, strict NSG/firewall rules

CNI Overlay

  • Pod CIDR overlayed on node subnet
  • Pods routable within cluster, NAT to VNet
  • Saves IP space like kubenet
  • Supports Network Policies
  • Use: Large clusters needing policies + IP conservation
Exam shortcut: "Pods need VNet-routable IPs" → Azure CNI. "Save IP space + network policies" → CNI Overlay. "Simple dev cluster" → Kubenet.

4 · Node Pool Design

PoolModeVM SKUTaints / LabelsPurpose
systemSystemStandard_D4s_v5CriticalAddonsOnly=true:NoScheduleCoreDNS, metrics
generalUserStandard_D8s_v5workload=generalStateless APIs
computeUserStandard_F16s_v2workload=cpu-intensiveML inference
spotUserStandard_D4s_v5 (Spot)kubernetes.azure.com/scalesetpriority=spot:NoScheduleBatch, tolerant workloads
Spot pools: Azure can evict nodes with 30 s notice. Use pod disruption budgets and tolerations — never run stateful primaries on spot.

5 · Scaling: Cluster Autoscaler + HPA + KEDA

How They Interact

  1. HPA/KEDA increases desired pod count based on metrics or events.
  2. If no node capacity, pods enter Pending state.
  3. Cluster Autoscaler detects pending pods → scales out VMSS.
  4. Optionally, Virtual Nodes schedule overflow onto ACI instantly.
KEDA for AZ-305: Scales to zero replicas (cost saving) and supports 60+ event sources (Service Bus, Event Hub, Cosmos DB change feed).

6 · Identity & RBAC

Workload Identity (Recommended)

  • Replaces pod-managed identity (deprecated).
  • Kubernetes Service Account → federated with Azure AD Managed Identity.
  • No secrets in pods — OIDC token exchange via projected volume.

Azure RBAC for Kubernetes

  • Unify Azure IAM and K8s RBAC — single policy plane.
  • Assign Azure Kubernetes Service RBAC Reader/Writer/Admin/Cluster Admin at namespace or cluster scope.
  • Conditional Access policies apply to kubectl sessions.
Best practice: Enable Azure RBAC + Workload Identity + disable local accounts for zero-secret, auditable clusters.

7 · Ingress & Service Mesh

OptionLayerTLSWAFBest For
NGINX Ingress ControllerL7cert-managerModSecurity (DIY)General web apps, OSS standard
Application Gateway Ingress (AGIC)L7Native + Key VaultWAF v2 built-inEnterprise WAF + Azure-native
Istio Service MeshL4-L7mTLS autoVia ext authzAdvanced traffic mgmt, observability
AKS managed Istio: Azure now offers Istio as a managed add-on — control plane managed by Azure, reducing ops burden.

8 · Real-World: Fintech Microservices Platform

Scenario

A fintech company runs 25 microservices (payments, fraud detection, KYC, notifications) serving 50 K TPS at peak. Requirements: PCI-DSS compliance, zero-downtime deploys, burst during market open.

Architecture Decisions

  • Networking: Azure CNI — pods need direct VNet IPs for NSG rules + private endpoint access to Azure SQL / Cosmos DB.
  • Node pools: System (3 nodes) + General API (6–20 nodes, autoscale) + GPU pool for fraud ML (2 spot + 1 on-demand) + Spot batch for report generation.
  • Scaling: HPA on CPU for APIs + KEDA scaling on Service Bus queue depth for payment processing + Cluster Autoscaler min 6 / max 20.
  • Identity: Workload Identity per service → least-privilege access to Key Vault, Storage, Cosmos. Azure RBAC, local accounts disabled.
  • Ingress: AGIC with WAF v2 (OWASP 3.2 rules) + Istio mesh for mTLS between services (PCI requirement).
  • Deployment: Flux GitOps with progressive delivery (Flagger canary) — automated rollback on error-rate spike.

🎯 Exam Tip

AZ-305 loves scenario questions mixing networking + scaling + identity. Remember: Azure CNI when pods must be VNet-routable; KEDA when scaling on events (not just CPU); Workload Identity is the modern answer for pod-to-Azure auth (never store credentials in pods). If they mention "WAF for AKS" → AGIC + Application Gateway WAF v2.

📝 Knowledge Check