AKS Cluster

Azure Kubernetes Service is Microsoft’s managed Kubernetes. zop.dev provisions an AKS cluster with Azure AD-integrated RBAC, Key Vault secret rotation, workload identity, and the monitoring toolchain installed.

AKS built on the upstream azurerm module v9.4.1

AKS cluster (upstream Azure/aks/azurerm v9.4.1) with SystemAssigned identity, workload identity, OIDC issuer, Azure Policy, Key Vault secrets provider with rotation, managed AAD RBAC, and auto scaling; three AAD groups (admins/editors/viewers) with role assignments; Key Vault plus secrets; public IP and DNS A record; storage account; federated identity credential for cert-manager; ACR pull role; disk encryption set. Helm add-ons: cert-manager, kube-prometheus-stack, grafana, fluent-bit, kubernetes-event-exporter, prometheus-msteams, reloader, replicator, metrics-server, ingress-nginx.

Kubernetes 1.31.10 and the node_config shape

Kubernetes default 1.31.10 (overridable); node_config {node_type, min_count, max_count, required_workload_type}; resource_group_name; log_analytics_workspace_enabled; private cluster off by default; shared observability, fluent-bit, alert, and certificate configuration shapes.

No cluster-autoscaler chart is installed

No Karpenter or cluster-autoscaler chart. AKS native autoscaling is used instead.

The cluster is the smallest thing created

The AKS resource itself arrives surrounded: 3 AAD groups (admins, editors, viewers) with role assignments, a Key Vault holding platform secrets, a public IP with a DNS A record, a storage account, a disk encryption set, a federated identity credential for cert-manager, and an ACR pull role assignment. On top of that land 10 Helm add-ons: cert-manager, kube-prometheus-stack, grafana, fluent-bit, kubernetes-event-exporter, prometheus-msteams, reloader, replicator, metrics-server, and ingress-nginx. An audit of “what did cluster provisioning create” has to look in AAD, Key Vault, networking, and the cluster itself.

Identity is Azure-native end to end

The cluster runs with a SystemAssigned identity, workload identity, an OIDC issuer, and managed AAD RBAC. Who-can-do-what inside Kubernetes is answered by AAD group membership, not by distributing kubeconfigs. The Key Vault secrets provider ships with rotation enabled, and cert-manager authenticates through a federated identity credential rather than a stored secret. The design goal is visible: no static credential anywhere in the cluster’s own plumbing.

Native autoscaling, not Karpenter

Unlike zop.dev’s EKS build, there is no Karpenter and no cluster-autoscaler chart. AKS native autoscaling handles node scale from node_config’s min_count and max_count per pool. That means node-scaling behaviour and its tuning knobs are the ones Azure documents, and node pool composition (node_type, required_workload_type) is decided in configuration rather than by a scheduler-driven provisioner.

Two settings to decide on day one

Private cluster is off by default, and flipping it later is a rebuild-grade change, so decide before workloads land. log_analytics_workspace_enabled is the billing lever: Log Analytics charges by ingested GB, and a chatty cluster can make the monitoring workspace a visible line item all by itself.