AKS is Azure's managed Kubernetes service — Azure manages the control plane (free), you manage node pools. Key features: system pools (system workloads) and user node pools (app workloads), Spot VMs for cost savings, Cluster Autoscaler for node scaling, KEDA for event-driven pod scaling, Workload Identity (replaces pod identity) for keyless auth to Azure services, Azure CNI for VNet-native networking, and Azure Monitor for containers for observability.
Keyless Azure authentication from AKS pods.
Storing Azure credentials as Kubernetes secrets is a security anti-pattern — any pod can read Secrets in its namespace. Workload Identity federates a Kubernetes service account with an Azure managed identity via OIDC. No secrets, automatic token rotation.
HPA can only scale on CPU/memory — it can't scale to zero. KEDA scales pods based on external metrics (Service Bus queue depth, Kafka consumer lag, HTTP request count). At zero load, zero pods, zero cost.
If application workloads share the system node pool, a misconfigured deployment can OOM the node running CoreDNS, breaking all DNS resolution. System pool gets taints; application pods scheduled only on user pools.
Sign in to share your feedback and join the discussion.