Azure Kubernetes Service manages the Kubernetes control plane while you operate node pools, workloads, networking choices, policies, upgrades, scaling, security, and application reliability. Choose AKS when Kubernetes' orchestration ecosystem and portability justify its operational complexity—not simply because an application uses a container.
Lab: 60–90 minutes · Cost warning: worker nodes, disks, load balancers, IPs, logs, registry, and networking charge while present · Cleanup immediately after the lab.
Use AKS for many coordinated services, Kubernetes APIs/operators, sophisticated scheduling, service mesh needs, or a platform team offering shared cluster capabilities. Prefer Container Apps or App Service when a team needs to run a small number of standard web services without owning Kubernetes operations.
Microsoft operates the managed control plane under the service model. You choose cluster version, maintenance and upgrade strategy, node OS/images, pools, network plugin, ingress, workload identity, policy, secrets, backups, logging, and workloads.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Search Kubernetes services → Create. Review preset, version, automatic upgrade, node pools, authentication, authorization, networking, integrations, monitoring, Defender, and tags. Do not carry a development preset into production without review. After deployment, use Connect to obtain the current credential instructions.
Create Kubernetes manifests for Namespace, Deployment, Service, ConfigMap, service account, probes, requests/limits, disruption budget, and network policy. Avoid kubectl run as the source of truth.
Use an ingress or Gateway API implementation for HTTP routing. A LoadBalancer service can create a public IP and load balancer. Prefer private ingress for internal services and put a managed edge such as Front Door/Application Gateway in front when required.
AKS workload identity maps a Kubernetes service account to an Entra application or user-assigned managed identity using OIDC federation. Pods receive tokens without Kubernetes secrets containing Azure credentials. Give each workload the narrow role it needs; do not reuse the node identity for application data access.
Declare cluster, node pools, network, private DNS, registry integration, identities, role assignments, policy, Defender, monitoring, and GitOps extension. Kubernetes workload manifests should remain in a deployment/GitOps repository. Separate cluster infrastructure lifecycle from application release lifecycle.
AKS creates a managed node resource group; deleting the parent cluster resource group should remove it, but verify that no separately created registry, DNS, identity, or logging resource remains.