Azure Kubernetes Service: Production Best Practices Guide

Running AKS in production requires more than a standard cluster create command. Security, reliability, and observability must be baked in. This guide covers the essential baseline for 2020 deployments.

Network Architecture (CNI)

flowchart TB
    subgraph VNET
        subgraph AKSSubnet
            Pod1[Pod 10.240.0.4]
            Pod2[Pod 10.240.0.5]
        end
        
        AGW[App Gateway WAF] --> AKSSubnet
    end
    
    Apps --> AGW
    
    style AKSSubnet fill:#E1F5FE

Uptime SLA

By default, the AKS control plane is free but has no financial SLA. For production, enable **Uptime SLA**.

az aks update --resource-group myResourceGroup --name myAKSCluster --uptime-sla

System Node Pools

Isolate your workloads from system pods (CoreDNS, Metrics Server) by using a dedicated System Node Pool.

az aks nodepool add     --resource-group myResourceGroup     --cluster-name myAKSCluster     --name systempool     --mode System     --node-taints CriticalAddonsOnly=true:NoSchedule

Key Takeaways

• Use **Azure CNI** for advanced networking and VNET integration.
• Enable **Managed Identity** to remove SPN management headaches.
• Use **Azure Policy for Kubernetes** to enforce constraints (e.g., no privileged pods).