# AKS Cluster

> zop.dev provisions AKS through the upstream Azure/aks/azurerm module v9.4.1, Kubernetes 1.31.10 by default, and creates 3 AAD groups, a Key Vault, a public IP with a DNS A record, a storage account, a disk encryption set, an ACR pull role, and 10 Helm add-ons alongside. Autoscaling is AKS-native, with no Karpenter.

Source: https://zop.dev/integrations/provision/azure/aks-cluster
Updated: 2026-08-19

---

Azure Kubernetes Service is Microsoft's managed Kubernetes. zop.dev provisions an AKS cluster with Azure AD-integrated RBAC, Key Vault secret rotation, workload identity, and the monitoring toolchain installed.

## AKS built on the upstream azurerm module v9.4.1

AKS cluster (upstream Azure/aks/azurerm v9.4.1) with SystemAssigned identity, workload identity, OIDC issuer, Azure Policy, Key Vault secrets provider with rotation, managed AAD RBAC, and auto scaling; three AAD groups (admins/editors/viewers) with role assignments; Key Vault plus secrets; public IP and DNS A record; storage account; federated identity credential for cert-manager; ACR pull role; disk encryption set. Helm add-ons: cert-manager, kube-prometheus-stack, grafana, fluent-bit, kubernetes-event-exporter, prometheus-msteams, reloader, replicator, metrics-server, ingress-nginx.

## Kubernetes 1.31.10 and the node_config shape

```text
Kubernetes default 1.31.10 (overridable); node_config {node_type, min_count, max_count, required_workload_type}; resource_group_name; log_analytics_workspace_enabled; private cluster off by default; shared observability, fluent-bit, alert, and certificate configuration shapes.
```

## No cluster-autoscaler chart is installed

No Karpenter or cluster-autoscaler chart. AKS native autoscaling is used instead.

## The cluster is the smallest thing created

The AKS resource itself arrives surrounded: 3 AAD groups (admins, editors, viewers) with role
assignments, a Key Vault holding platform secrets, a public IP with a DNS A record, a storage
account, a disk encryption set, a federated identity credential for cert-manager, and an ACR
pull role assignment. On top of that land 10 Helm add-ons: cert-manager, kube-prometheus-stack,
grafana, fluent-bit, kubernetes-event-exporter, prometheus-msteams, reloader, replicator,
metrics-server, and ingress-nginx. An audit of "what did cluster provisioning create" has to
look in AAD, Key Vault, networking, and the cluster itself.

## Identity is Azure-native end to end

The cluster runs with a SystemAssigned identity, workload identity, an OIDC issuer, and managed
AAD RBAC. Who-can-do-what inside Kubernetes is answered by AAD group membership, not by
distributing kubeconfigs. The Key Vault secrets provider ships with rotation enabled, and
cert-manager authenticates through a federated identity credential rather than a stored secret.
The design goal is visible: no static credential anywhere in the cluster's own plumbing.

## Native autoscaling, not Karpenter

Unlike zop.dev's EKS build, there is no Karpenter and no cluster-autoscaler chart. AKS native
autoscaling handles node scale from `node_config`'s min_count and max_count per pool. That means
node-scaling behaviour and its tuning knobs are the ones Azure documents, and node pool
composition (`node_type`, `required_workload_type`) is decided in configuration rather than by a
scheduler-driven provisioner.

## Two settings to decide on day one

Private cluster is off by default, and flipping it later is a rebuild-grade change, so decide
before workloads land. `log_analytics_workspace_enabled` is the billing lever: Log Analytics
charges by ingested GB, and a chatty cluster can make the monitoring workspace a visible line
item all by itself.