Navigating the Azure Kubernetes Service Landscape — Foundations and Core Architecture

Azure Kubernetes Service (AKS) is a beacon in the evolving realm of cloud-native technologies, a managed container orchestration platform that simplifies the otherwise complex process of deploying and maintaining Kubernetes clusters. Designed to relieve developers and IT operators from the cumbersome overhead of infrastructure management, AKS empowers them to focus squarely on the agility and scalability of their applications.

The essence of AKS lies in its integration with Microsoft Azure’s extensive ecosystem, offering a seamless experience that combines cloud reliability with the robust container orchestration capabilities Kubernetes is renowned for. Unlike a traditional Kubernetes installation, where administrators wrestle with cluster setup, control plane management, and node provisioning, AKS abstracts much of this complexity by managing the control plane while allowing users to scale and configure the node pools according to workload demands.

At its core, AKS operates with a division of responsibilities: the control plane is Azure-managed, while users control the nodes, which are virtual machines hosting the containers. This separation not only enhances security by isolating critical control components but also enables automatic updates, patches, and maintenance orchestrated by Azure, thereby reducing operational risks.

Understanding the Control Plane Components

The control plane in AKS is the linchpin of cluster operations, coordinating scheduling, state management, and API interactions. It includes several vital components:

• The API server acts as the cluster’s gateway, handling all REST commands to manage cluster state.

• The etcd database stores the entire cluster state, preserving consistency and resilience.

• The scheduler assigns workloads to nodes based on resource availability and policies.

 

• The controller manager monitors the system’s state, ensuring that the desired number of pods and nodes remain operational.

 

This managed control plane frees users from the burden of manual cluster upkeep, enabling automatic scaling and self-healing features that maintain high availability and fault tolerance.

Nodes, Pods, and the Granularity of Workload Management

In AKS, the virtual machines, referred to as nodes, are the workhorses that execute containerized applications. Each node runs the Kubernetes agent and supports one or multiple pods—the smallest deployable units in Kubernetes. Pods can contain one or several tightly coupled containers that share resources such as network namespaces and volumes, facilitating efficient inter-container communication.

AKS supports multiple node pools, allowing administrators to run different types of virtual machines within a single cluster. This multi-pool strategy is crucial for running heterogeneous workloads, such as combining CPU-intensive batch jobs with memory-optimized services. This granularity not only optimizes cost but also enhances performance and operational flexibility.

Resource limits and requests within pods enable Kubernetes to allocate and manage CPU and memory efficiently, ensuring that no container monopolizes the node resources. This granular resource governance is critical in multi-tenant environments where workload isolation is paramount.

The Subtle Art of Deployments and StatefulSets

Deploying applications on AKS hinges on Kubernetes objects like Deployments and StatefulSets, which define the desired state for application pods and manage their lifecycle.

Deployments are the standard method for managing stateless applications, providing declarative updates, rolling rollbacks, and scaling capabilities. They ensure that the specified number of replicas is always running, and if any pod fails, Kubernetes will create a new one to maintain equilibrium.

StatefulSets, by contrast, manage stateful applications that require stable identities, ordered deployment, and persistent storage, such as databases or message queues. These are essential when applications need to maintain data integrity and session continuity despite container restarts or migrations.

Namespaces: Partitioning the Cluster for Logical Separation

Namespaces are an underappreciated yet powerful feature in AKS, enabling logical segmentation of the cluster’s resources. They are essential in multi-team or multi-application environments, allowing resource quotas, access policies, and network rules to be applied with precision.

By employing namespaces, organizations can prevent resource contention and enforce security boundaries, fostering operational harmony in shared environments. The combination of namespaces with role-based access control fortifies the security model, ensuring users and applications only have access to their designated resources.

The Strategic Importance of Storage in AKS

Storage integration in AKS is indispensable for workloads that require persistent data beyond the ephemeral lifecycle of containers. AKS leverages Azure Disk and Azure Files to provide robust, scalable storage options.

Azure Disk delivers high-performance block storage suitable for applications demanding low latency and high IOPS, such as databases. Azure Files offers shared file systems using the SMB protocol, ideal for scenarios requiring concurrent access by multiple pods.

Storage classes in AKS dictate the provisioning policies, balancing performance with cost-efficiency. The ability to dynamically provision storage volumes based on application needs underpins the scalability and flexibility of AKS clusters.

Reflections on AKS’s Role in Modern Cloud Architectures

Azure Kubernetes Service embodies a philosophical shift in how organizations approach application deployment and management. It signals a movement from monolithic, hardware-bound operations toward fluid, scalable, and resilient cloud-native architectures.

Its managed nature liberates enterprises from the mundane yet critical task of cluster maintenance, allowing them to allocate their expertise and resources towards innovation and value generation. Furthermore, AKS’s integration with Azure’s security, monitoring, and governance frameworks offers a compelling proposition for enterprises that require both agility and compliance.

As digital ecosystems grow increasingly complex, the nuanced capabilities of AKS—ranging from multi-pool node management to persistent storage orchestration—become not just advantageous but imperative. These features collectively enable organizations to deploy highly available, scalable applications capable of withstanding the unpredictable tides of modern IT demands.

 Mastering Azure Kubernetes Service Operations — Deployment, Scaling, and Security

Azure Kubernetes Service (AKS) offers a streamlined yet powerful platform for deploying and managing containerized applications at scale. However, its true strength emerges when developers and administrators delve into operational aspects like deployment strategies, efficient scaling, and robust security measures. This part of the series explores these operational dimensions, providing insight into best practices and nuanced features that elevate AKS from a mere container orchestration tool to a strategic pillar of modern cloud infrastructure.

The Deployment Paradigm in AKS: Beyond Basic Containers

Deployment within AKS is more than launching containers—it requires a comprehensive understanding of application lifecycle management and the orchestration mechanisms Kubernetes provides. Declarative configuration files written in YAML or JSON form the blueprint, specifying pods, replica sets, services, and other Kubernetes objects.

A key feature is rolling updates, allowing new versions of an application to be deployed incrementally, minimizing downtime and preserving user experience. AKS manages this process by gradually replacing old pods with new ones while monitoring health to prevent service disruption. If a newly deployed pod fails readiness checks, the rollout pauses or rolls back, ensuring stability.

Another critical aspect is canary deployments, which enable new versions to be released to a small subset of users initially. This strategy allows teams to observe real-world performance and behavior before full-scale rollout, reducing risk in production environments.

Helm, the package manager for Kubernetes, is widely used in AKS to manage complex deployments. Helm charts package Kubernetes manifests into reusable, configurable units, simplifying application installation, upgrades, and rollbacks, especially in multi-component systems.

Scaling Strategies: Elasticity in AKS

The ability to scale applications dynamically is a cornerstone of cloud-native architecture, and AKS provides multiple mechanisms for this elasticity.

Horizontal Pod Autoscaler (HPA)

HPA automatically adjusts the number of pod replicas based on observed CPU utilization or custom metrics. It is particularly effective for workloads with fluctuating demand, ensuring that applications remain responsive while optimizing resource usage.

By integrating HPA with Azure Monitor and custom metrics adapters, AKS supports sophisticated autoscaling policies that can consider memory usage, queue length, or external signals.

Cluster Autoscaler

Beyond pods, AKS can scale the underlying virtual machine nodes themselves. The Cluster Autoscaler monitors pod resource requests and, when it detects insufficient capacity, adds nodes to the cluster. Conversely, it removes underutilized nodes to reduce costs.

This dual-layer scaling mechanism—pods and nodes—provides fine-grained control over application performance and budget management.

Manual Scaling and Scale Sets

Administrators can manually scale node pools or pods through the Azure CLI or portal interfaces. AKS also supports Azure Virtual Machine Scale Sets, which offer flexible VM provisioning and scaling tied directly to AKS node pools, facilitating rapid adjustment to workload demands.

Securing AKS Clusters: Defense in Depth

Security in AKS extends across multiple layers, from network segmentation to identity management, protecting clusters and workloads from increasingly sophisticated threats.

Role-Based Access Control (RBAC)

RBAC is fundamental to enforcing least-privilege access within AKS. By assigning roles and permissions at granular levels, organizations ensure that users and services interact with cluster resources only within their scope.

Integration with Azure Active Directory (AAD) enhances RBAC by enabling centralized identity and access management, simplifying user authentication, and policy enforcement.

Network Policies and Isolation

Network policies define how pods communicate within the cluster and with external resources. AKS supports Azure-native network policies as well as Kubernetes-standard policies, enabling administrators to implement micro-segmentation and limit attack surfaces.

By isolating critical workloads into separate namespaces combined with network restrictions, teams can prevent lateral movement of threats and enforce compliance.

Secrets Management

Sensitive data such as API keys, passwords, and certificates is managed in AKS using Kubernetes Secrets, which store such information securely and provide controlled access to containers.

Integration with Azure Key Vault allows for centralized secret management outside the cluster, enhancing security posture by reducing exposure to cluster compromise and enabling seamless secret rotation.

Azure Defender for Kubernetes

Azure Defender offers advanced threat protection for AKS, monitoring for vulnerabilities, misconfigurations, and anomalous behavior. It integrates with Azure Security Center to provide continuous assessment and actionable recommendations, bolstering cluster security.

Monitoring and Logging: Observability for Reliability

Maintaining reliable AKS deployments requires comprehensive observability into cluster health and workload performance.

Azure Monitor and Container Insights

Azure Monitor with Container Insights collects telemetry data, including CPU, memory, node status, and network metrics. It also tracks Kubernetes-specific metrics like pod restarts and failed scheduling attempts.

Dashboards provide visual insights and enable alerting on anomalous patterns, facilitating proactive troubleshooting and capacity planning.

Log Analytics

Logs from Kubernetes components, containers, and nodes flow into Azure Log Analytics, where queries and analytics uncover root causes of failures or performance bottlenecks.

Structured log data supports advanced search, correlation, and long-term retention, critical for auditing and forensic analysis.

Networking Nuances in AKS

Networking in AKS is complex yet essential for high-performing applications.

Azure CNI and Kubenet Networking

AKS offers two networking models: Azure Container Networking Interface (CNI) and Kubenet.

Azure CNI assigns IP addresses from the Azure virtual network directly to pods, allowing seamless integration with other Azure services and network policies. This model is optimal for enterprise environments requiring extensive network control and compliance.

Kubenet uses NAT to assign pod IP addresses, conserving IP space but limiting direct pod communication across subnets.

Ingress Controllers and Load Balancing

Ingress controllers route external traffic to services within the cluster based on rules defined in ingress resources. AKS supports multiple ingress controllers such as NGINX and Azure Application Gateway, enabling flexible routing, SSL termination, and Web Application Firewall integration.

Load balancers distribute traffic to pod replicas, ensuring high availability and fault tolerance. Azure Load Balancer operates at Layer 4 for TCP/UDP traffic, while Azure Application Gateway provides Layer 7 load balancing with more advanced routing capabilities.

Disaster Recovery and Backup Strategies

In production environments, disaster recovery is crucial.

AKS clusters rely on backing up cluster configurations, persistent volumes, and application data.

Tools like Velero facilitate backup and restore of Kubernetes resources and persistent volumes, enabling swift recovery from data loss or cluster corruption.

Azure Backup integrates with AKS persistent storage, offering enterprise-grade snapshot and restore functionality.

Operational Excellence with AKS

Mastering AKS operations entails more than deploying containers—it requires a cohesive strategy encompassing deployment best practices, scaling mechanisms, security frameworks, observability, networking intricacies, and disaster preparedness.

By leveraging AKS’s managed features alongside Azure’s rich ecosystem, organizations can achieve operational excellence that supports scalable, secure, and resilient applications. This operational maturity not only improves service reliability but also accelerates innovation by freeing teams from the drudgery of infrastructure management.

AKS, when fully harnessed, becomes a catalyst for agile digital transformation, empowering enterprises to meet the ever-shifting demands of the cloud era with confidence.

 Advanced AKS Management — Networking, Storage, and Cost Optimization

Azure Kubernetes Service offers a formidable platform for container orchestration, but real mastery involves understanding its advanced management aspects,  particularly networking intricacies, storage solutions, and cost optimization techniques. These elements are critical for enterprises aiming to build efficient, scalable, and cost-effective cloud-native applications. In this third installment, we unravel these sophisticated layers, equipping you with a deeper grasp of AKS operational excellence.

Exploring the Complexities of AKS Networking

Networking in Kubernetes often represents one of the most challenging components due to its layered architecture and the need for seamless communication between pods, services, and external endpoints.

Azure CNI vs. Kubenet Networking Models

AKS supports two primary networking models: Azure Container Networking Interface (CNI) and Kubenet. Azure CNI assigns IP addresses from the Azure virtual network directly to pods, enabling full network integration and visibility. This approach allows pods to communicate with other Azure resources as first-class citizens on the network, which is vital for enterprises requiring strict compliance, security policies, or hybrid connectivity.

In contrast, Kubenet assigns pods IPs from an internal network with Network Address Translation (NAT) to allow external communication. Kubenet conserves IP addresses but restricts pod-to-pod communication across nodes, making it more suited for smaller or simpler environments.

Selecting between Azure CNI and Kubenet depends on workload scale, networking requirements, and IP address availability. The nuanced trade-offs reflect the intricate balance between network performance, security, and manageability.

Network Policies: Enforcing Microsegmentation

In dynamic containerized environments, network policies are crucial to implement zero-trust security and microsegmentation. AKS supports Kubernetes-native network policies, as well as Azure-native policies, enabling granular control over traffic flow between pods and external endpoints.

Administrators can define ingress and egress rules to limit communication, thereby reducing attack surfaces and containing potential breaches. When combined with Azure Firewall or Azure Application Gateway, network policies form a multi-layered defense that hardens cluster security.

Ingress Controllers: Managing External Access

Ingress controllers provide a flexible mechanism to expose HTTP and HTTPS routes from outside the cluster to services within. AKS supports popular ingress controllers such as NGINX, Traefik, and Azure Application Gateway Ingress Controller (AGIC).

The Azure Application Gateway ingress controller is especially noteworthy as it integrates Azure’s Layer 7 load balancing and Web Application Firewall capabilities with Kubernetes, delivering enterprise-grade traffic routing, SSL termination, and protection against common web vulnerabilities.

Properly architecting ingress allows for streamlined management of external traffic, SSL certificates, and path-based routing, enhancing both security and performance.

Storage in AKS: Persistent and Ephemeral Solutions

Storage is a critical component in Kubernetes clusters to support stateful workloads. AKS accommodates various storage types tailored to workload requirements.

Azure Disks and Azure Files

Azure Disks provide block-level storage for persistent volumes attached to pods. They deliver high performance, low latency, and durability, suitable for databases and other I/O intensive applications.

Azure Files offers shared file storage accessible via SMB or NFS protocols, enabling multi-pod read/write access. This flexibility is advantageous for applications requiring shared access to configuration files or persistent data across pods.

Kubernetes Persistent Volume Claims (PVCs) abstract these storage types, allowing pods to request storage resources dynamically.

Dynamic Provisioning and Storage Classes

Dynamic provisioning automates the creation of persistent volumes based on predefined StorageClasses, eliminating manual intervention. AKS provides several StorageClasses with varying performance tiers (Standard HDD, Standard SSD, Premium SSD) ,allowing teams to optimize cost and performance based on workload profiles.

Understanding and configuring appropriate StorageClasses is paramount for balancing cost efficiency with application requirements.

Ephemeral Storage and Local SSDs

For workloads requiring temporary storage, ephemeral volumes and local SSDs can be leveraged. Ephemeral storage is tied to the pod lifecycle and is ideal for caching or scratch data.

Local SSDs on AKS nodes provide ultra-low latency but lack persistence across node failures. These are typically used in high-performance computing or in-memory processing scenarios.

Cost Management and Optimization Strategies in AKS

Running Kubernetes workloads at scale involves substantial cloud expenditure, making cost management a vital consideration.

Right-Sizing Node Pools

Proper sizing of node pools, in terms of CPU, memory, and instance types, is fundamental. Overprovisioned nodes inflate costs without performance gains, while undersized nodes lead to resource contention and degraded user experience.

Azure offers a variety of VM sizes optimized for general-purpose, compute, memory, or storage-intensive workloads. Matching node types to workload profiles can yield significant savings.

Utilizing Spot Instances

AKS supports Azure Spot VMs, which offer unused Azure capacity at steep discounts but can be evicted with little notice. These are ideal for fault-tolerant, batch, or non-critical workloads.

Incorporating spot instances into node pools requires a hybrid approach to ensure critical workloads remain on standard nodes, balancing cost reduction with reliability.

Autoscaling for Cost Efficiency

Horizontal Pod Autoscaler and Cluster Autoscaler together enable scaling resources dynamically with demand. This elasticity prevents paying for idle capacity during off-peak hours while maintaining responsiveness under load.

Implementing autoscaling policies with metrics such as CPU, memory, or custom application signals ensures resources closely match demand, optimizing expenditure.

Monitoring and Budget Alerts

Azure Cost Management tools integrate with AKS to provide detailed usage reports, cost analysis, and budget alerts. Proactively monitoring expenditure helps teams identify anomalies, forecast trends, and make informed decisions to curb unnecessary spending.

Integrating DevOps Pipelines with AKS

Modern application delivery hinges on continuous integration and continuous deployment (CI/CD) pipelines. AKS’s seamless integration with Azure DevOps, Jenkins, and GitHub Actions accelerates development velocity while ensuring quality and security.

Using Infrastructure as Code (IaC) tools like Terraform or Azure Resource Manager templates, teams can provision and manage AKS clusters and associated resources programmatically, enhancing reproducibility and minimizing manual errors.

Automated pipelines can validate YAML manifests, run security scans, and deploy container images to AKS clusters, embodying DevSecOps principles that embed security early in the development lifecycle.

Handling Stateful Applications and Database Workloads

While Kubernetes was initially designed for stateless applications, AKS now supports stateful workloads effectively through persistent storage and StatefulSets.

StatefulSets manage the deployment and scaling of stateful pods, ensuring stable network identities and persistent storage. This is essential for databases, message queues, and other applications requiring ordered deployment and graceful scaling.

Running databases such as PostgreSQL or MongoDB on AKS requires careful planning around data durability, backup strategies, and disaster recovery to avoid data loss and ensure high availability.

Observability and Troubleshooting: Maintaining Cluster Health

Observability extends beyond monitoring resource utilization to include tracing, metrics aggregation, and event correlation.

Tools like Prometheus and Grafana are widely adopted for collecting and visualizing metrics. Azure Monitor’s Container Insights provides a managed solution integrated with Azure’s native monitoring capabilities.

Tracing solutions such as OpenTelemetry help diagnose distributed application issues by following request paths through microservices.

Proactive troubleshooting minimizes downtime and maintains user trust in mission-critical applications.

The Synergy of Advanced Management in AKS

Advanced management of AKS encompasses a nuanced understanding of networking models, storage architectures, and cost optimization strategies. These dimensions intersect to form a resilient, efficient, and scalable Kubernetes ecosystem.

By carefully architecting these layers, organizations unlock the full potential of AKS, transforming it into a robust foundation for cloud-native innovation.

This synergy of operational excellence accelerates business agility, reduces waste, and fortifies security — all indispensable in today’s digital landscape.

Security Best Practices and Future Trends in Azure Kubernetes Service

In the dynamic landscape of cloud-native applications, security remains paramount. Azure Kubernetes Service provides robust tools and frameworks to safeguard containerized workloads, yet mastering AKS security demands an intricate understanding of both Kubernetes fundamentals and Azure-specific features. In this final part of our series, we explore comprehensive security best practices tailored to AKS environments, coupled with emerging trends that will shape the future of Kubernetes management on Azure.

The Imperative of Security in Kubernetes Environments

Container orchestration platforms like AKS introduce novel attack surfaces, given their complexity and multi-tenant nature. Unlike traditional monolithic systems, containers often run ephemeral workloads, dynamically scaling across multiple nodes, which complicates consistent security enforcement.

Hence, security in AKS is not merely an afterthought but a foundational pillar that permeates cluster design, deployment pipelines, runtime operations, and incident response strategies.

Implementing Role-Based Access Control (RBAC) Effectively

RBAC is fundamental in Kubernetes for controlling user and service permissions. AKS integrates Kubernetes RBAC with Azure Active Directory (AAD), allowing organizations to manage access through centralized identities.

Administrators should adhere to the principle of least privilege, granting users only the permissions necessary to perform their roles. This minimizes potential damage from compromised accounts or insider threats.

Creating fine-grained roles and binding them specifically to namespaces or resources ensures containment and accountability within clusters.

Leveraging Azure Active Directory Integration for Secure Authentication

Azure AD integration enables seamless single sign-on (SSO) for AKS clusters, unifying identity management across Azure services and Kubernetes.

This integration supports multi-factor authentication (MFA), conditional access policies, and centralized user lifecycle management, which significantly enhances security posture.

By using Azure AD groups and managed identities, teams can orchestrate secure interactions between applications and Azure resources without embedding sensitive credentials in code or configurations.

Securing Container Images and Registries

Container images are the foundation of Kubernetes workloads; thus, their security integrity is crucial.

Organizations should employ private container registries such as Azure Container Registry (ACR) to store images securely. Implementing image scanning tools that detect vulnerabilities, malware, or misconfigurations before deployment helps prevent introducing compromised images into production.

Immutable image tags and signing images using tools like Notary or Cosign increase trustworthiness and traceability in deployment pipelines.

Network Security with Azure Firewall and Policy Enforcement

Complementing Kubernetes network policies, Azure Firewall provides an advanced perimeter defense, filtering traffic based on application and network-level rules.

Deploying Azure Firewall alongside AKS ensures that only legitimate, authorized traffic reaches cluster endpoints.

Furthermore, Azure Policy enables administrators to enforce compliance across AKS clusters by validating configurations, such as restricting privileged containers, enforcing required labels, or disallowing unapproved container registries.

This declarative governance model reduces drift from security baselines and regulatory requirements.

Secrets Management: Protecting Sensitive Information

Kubernetes supports Secrets to store sensitive data like API keys, passwords, and certificates; however, these secrets are base64-encoded and must be protected further.

Using Azure Key Vault integration with AKS provides hardware security module (HSM)-backed encryption, centralized secret management, and audit logging.

This setup eliminates risks associated with storing secrets directly in Kubernetes manifests or etcd databases.

Applications can retrieve secrets dynamically at runtime without exposing them in code repositories or container images.

Runtime Security: Monitoring and Incident Response

Securing running workloads involves detecting anomalous behaviors and mitigating threats in real time.

Tools like Azure Defender for Kubernetes offer threat detection, vulnerability assessments, and behavioral analytics specifically designed for AKS environments.

In addition, deploying open-source solutions such as Falco or Aqua Security enables deep visibility into container activity, identifying unauthorized access, privilege escalations, or suspicious network connections.

Establishing incident response procedures that include alerting, automated remediation, and forensic analysis prepares teams to react swiftly and minimize damage.

Data Protection and Compliance in AKS

Organizations must protect data both in transit and at rest, especially when handling sensitive or regulated information.

Enabling TLS encryption for pod communication, securing ingress traffic with HTTPS, and leveraging Azure Disk encryption for persistent volumes are vital measures.

AKS also supports compliance certifications, including ISO, SOC, and GDPR, making it suitable for enterprises operating under stringent regulatory frameworks.

Regular audits and compliance checks using Azure Security Center and Azure Policy help maintain adherence and prepare for external inspections.

Embracing Zero Trust Architecture in AKS Deployments

Zero Trust principles advocate for “never trust, always verify” even within trusted networks. Applying these concepts to AKS involves strict identity verification, least privilege access, continuous monitoring, and microsegmentation.

Implementing service mesh technologies such as Istio or Linkerd introduces mutual TLS encryption between services, fine-grained traffic control, and observability.

These meshes enforce security policies consistently and transparently across microservices, enhancing the overall security fabric.

Future Trends: AI-Driven Security and Kubernetes Evolution

Looking ahead, AI and machine learning are poised to revolutionize Kubernetes security by enabling predictive threat detection, automated anomaly detection, and intelligent policy recommendations.

Azure is progressively integrating AI-powered security services that augment human analysts and DevOps teams with actionable insights.

Additionally, the Kubernetes ecosystem is evolving to incorporate enhanced security features such as runtime enforcement with WebAssembly modules, extended audit logging, and improved secret management.

Adopting these innovations early will position organizations to stay ahead of emerging threats and operational complexities.

Conclusion

Security is an evolving challenge that requires continuous vigilance, innovation, and adherence to best practices. Azure Kubernetes Service provides a rich toolkit to build secure containerized applications, but ultimate success depends on how organizations implement and integrate these capabilities.

By mastering identity management, network segmentation, secret protection, and runtime security, teams can build resilient environments that withstand sophisticated attacks.

Coupled with forward-looking adoption of AI and zero trust paradigms, AKS users are well equipped to navigate the complexities of cloud-native security in an increasingly hostile digital world.

 

• Category: other
• Tags: azure, Core Architecture, Kubernetes, Service