Advanced Azure Kubernetes Service Configurations

Customizing Node Pools and VM Scale Sets

AKS offers granular control over your cluster's compute resources through node pools. You can create multiple node pools, each with different VM sizes, operating systems, or even dedicated hardware like GPUs, allowing you to optimize for various workloads.

Creating Additional Node Pools

Use the Azure CLI or Azure portal to add new node pools to an existing AKS cluster. This is crucial for segregating workloads, for example, placing latency-sensitive applications on nodes with faster CPUs or data-intensive jobs on nodes with more RAM.


az aks nodepool add \
    --resource-group myResourceGroup \
    --cluster-name myAKSCluster \
    --name gpuNodepool \
    --node-count 1 \
    --node-vm-size Standard_NC6 \
    --labels=gpu=true \
    --no-wait

VM Scale Set Configuration

Each node pool is backed by an Azure Virtual Machine Scale Set (VMSS). You can configure various aspects of the VMSS, such as auto-scaling settings, availability zones, and custom data, to tailor your node infrastructure.

Networking: Advanced Options

Network Policies

Implement fine-grained network segmentation within your cluster using Kubernetes Network Policies. This is essential for enhancing security by controlling traffic flow between pods.

Note: Network Policy support requires the Azure CNI network plugin to be enabled during cluster creation or by upgrading your cluster.

Example Network Policy to allow ingress only from pods with the label app=backend:


apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend
spec:
  podSelector:
    matchLabels:
      app: frontend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: backend

Ingress Controllers and Load Balancing

Explore advanced ingress controller configurations, including custom annotations, SSL termination, and integration with Azure Application Gateway or Azure Front Door for robust traffic management and global load balancing.

Storage Solutions for AKS

AKS integrates seamlessly with Azure Storage services. Beyond basic Persistent Volumes, consider:

  • Azure Files: For shared file storage, accessible by multiple pods.
  • Azure NetApp Files: High-performance file storage for demanding enterprise workloads.
  • Dynamic Provisioning: Automatically create Azure Disk or Azure Files based on StorageClass definitions.

Storage Classes

Define custom StorageClass resources to abstract underlying storage details, enabling users to request storage with specific performance characteristics (e.g., SSD vs. HDD, throughput tiers).

Security Best Practices and Advanced Features

Azure Active Directory Integration

Leverage Azure AD for robust authentication and authorization of users accessing your AKS cluster. This simplifies identity management and enhances security posture.

Configure role-based access control (RBAC) within Kubernetes and map it to Azure AD groups for fine-grained permissions.

Secrets Management

Integrate AKS with Azure Key Vault for secure storage and management of sensitive data like API keys, passwords, and certificates. Avoid storing secrets directly in container images or configuration files.

Pod Security Policies (Deprecated, consider Pod Security Admission)

Understand the concepts behind enforcing security constraints on pods, such as restricting privileged containers, allowed host paths, and required security contexts. While Pod Security Policies are deprecated, their principles inform the newer Pod Security Admission controller.

Monitoring, Logging, and Diagnostics

Container Insights

Enable Container Insights for comprehensive monitoring of your AKS cluster, including performance metrics, log aggregation, and anomaly detection. Visualize your cluster's health through Azure Monitor dashboards.

Azure Policy for Kubernetes

Govern and enforce organizational standards and compliance requirements across your AKS clusters using Azure Policy. This allows you to manage policies for configurations, security settings, and resource deployments.