D4 · Infrastructure

Container Design and AKS

For the AZ-305 you don't need to operate Kubernetes — you need to design: when to use AKS versus something simpler, how the cluster scales and gets secured, and how ACR fits into the pipeline.

Contents

AKS — architecture and responsibilities
Node pools, scaling and networking
Security and identity in AKS
Container Registry
AKS vs Container Apps vs ACI
Decision table

AKS — architecture and responsibilities

Microsoft manages

• Control plane (API server, etcd, scheduler) — free or with a paid SLA (Standard tier: 99.95% with zones)
• Control plane upgrades and node image patching (auto-upgrade channels)

You manage

• Node pools (VMs): size, scale, zones
• Workloads, cluster RBAC, networking, policies
• Kubernetes versions (N-2 support window)
• AKS Automatic reduces this list (preconfigured opinion)

Node pools, scaling and networking

Node pool design

• System pool (cluster components) + user pools (workloads)
• Specialized pools: GPU, memory, Windows, Spot (cheap, evictable batch)
• Spread nodes across availability zones
• Taints/tolerations and node selectors route pods to the right pool

Scaling — 3 levels

• HPA: more pods based on CPU/metrics
• Cluster Autoscaler: more NODES when pods don't fit (or Node Autoprovisioning/Karpenter)
• KEDA: pods based on events (queues, Kafka) — even down to zero
• Virtual nodes (ACI): instant burst without creating VMs

AKS networking — what falls out

• Kubenet (legacy) vs Azure CNI: CNI gives each pod a VNet IP (direct integration, consumes IPs); CNI Overlay saves IPs while keeping compatibility — the modern default
• Private cluster: API server with a private endpoint — kubectl only from the network
• Ingress: App Gateway for Containers / NGINX (application routing addon); Front Door in front for global reach
• Network policies to microsegment pod-to-pod traffic

Security and identity in AKS

Need	Solution
Authenticate users to the cluster	Entra ID integration + Kubernetes RBAC (or Azure RBAC for K8s)
Pods access Key Vault/Storage without secrets	Microsoft Entra Workload ID (OIDC federation with service accounts)
Key Vault secrets mounted into pods	Secrets Store CSI Driver
Enforce standards (no privileged containers, only approved registries)	Azure Policy for AKS (Gatekeeper/OPA)
Vulnerability scanning of images and runtime	Microsoft Defender for Containers
Encrypting cluster disks with CMK	Disk Encryption Set on the node pools

Azure Container Registry

Tiers and features

• Basic / Standard / Premium
• Premium only: geo-replication (local pulls in multiple regions, a single registry), private endpoints, content trust
• ACR Tasks: cloud builds, auto-rebuild when the base image changes
• AKS integrates without passwords (attach: AcrPull role on the kubelet identity)

Exam signals

• "Clusters in 3 regions must pull with low latency from a single registry" → geo-replicated ACR Premium
• "The registry accessible only from the VNet" → Premium + private endpoint
• "AKS pulls with no credentials" → managed identity + AcrPull

AKS vs Container Apps vs ACI — decision recap

📦Árbol de decisión — Contenedores en Azure

AKS · Container Apps · ACI

Interactivo

Pregunta 1

¿Necesitas acceso completo a la API de Kubernetes (kubectl, operators, CRDs, control total del cluster)?

💡 AKS da Kubernetes real — todos los comandos kubectl, operators del ecosistema K8s, CRDs personalizados. Si solo necesitas ejecutar contenedores sin gestionar Kubernetes, hay opciones más simples.

Criterion	AKS	Container Apps	ACI
Kubernetes API	Yes — full	No (K8s hidden)	No
Operations	You manage the cluster	Serverless	Serverless
Scale to zero	With manual KEDA	Native	N/A (per container)
Ideal case	Complex platforms, operators, multi-team, portability	Event-driven microservices and jobs	One-off containers, AKS burst

Decision table

Requirement	Design
API server SLA + zonal resilience	AKS Standard tier + nodes across zones
kubectl only from the corporate network	Private cluster
Process a queue with pods scaling from zero	KEDA
Instant burst without waiting for new VMs	Virtual nodes (ACI)
Eviction-tolerant batch at the lowest cost	Spot VM node pool
Pods read Key Vault with no stored secrets	Workload Identity + Secrets Store CSI
Prohibit images from outside the corporate registry	Azure Policy for AKS
Fast pulls from clusters in 3 regions	Geo-replicated ACR Premium
Multi-region DR for AKS	One cluster per region + GitOps/IaC + geo-replicated ACR + Front Door

Did you get this topic?

Test what you just learned

A platform runs on AKS in West Europe and will expand to East US and Southeast Asia. Requirements: all 3 clusters must pull images from a single logical registry with low local latency, and the registry must not be accessible from the internet. What do you design?

Ready to test "Container Design and AKS"?

Put what you learned to the test with original AZ-305 exam questions.

Start AZ-305 mock exam

Unlimited mock exams with the Pro plan

PreviousApplication ArchitectureInfrastructure NextMessaging and EventsInfrastructure