Running Production Workloads on Azure Kubernetes Service

Introduction

Azure Kubernetes Service (AKS) is a managed container orchestration service that simplifies deploying, managing, and scaling containerized applications. This guide covers essential practices for running production workloads.

Cluster Setup

Node Pool Configuration

For production, use multiple node pools:

# Create system node pool
az aks nodepool add \
    --resource-group myResourceGroup \
    --cluster-name myAKSCluster \
    --name systempool \
    --node-count 3 \
    --mode System

# Create user node pool for workloads
az aks nodepool add \
    --resource-group myResourceGroup \
    --cluster-name myAKSCluster \
    --name workloadpool \
    --node-count 5 \
    --node-vm-size Standard_D4s_v3 \
    --mode User

Security Best Practices

1. Enable Azure AD Integration

az aks update \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --enable-aad \
    --aad-admin-group-object-ids <group-id>

2. Use Managed Identities

Enable workload identity for secure Azure service access:

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    azure.workload.identity/client-id: <client-id>
  name: workload-identity-sa

3. Network Policies

Implement network policies to control traffic:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Scaling Strategies

Horizontal Pod Autoscaler

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  minReplicas: 3
  maxReplicas: 100
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

Cluster Autoscaler

Enable automatic node scaling:

az aks update \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --enable-cluster-autoscaler \
    --min-count 3 \
    --max-count 10

Monitoring and Observability

Enable Container Insights

az aks enable-addons \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --addons monitoring

Prometheus and Grafana

Deploy the monitoring stack for comprehensive observability.

Conclusion

Running production workloads on AKS requires careful planning around security, scaling, and monitoring. Follow these best practices to ensure reliable and secure deployments.