Azure Kubernetes Service (AKS): Deploy and Manage Clusters

Overview

This tutorial covers the complete lifecycle of Azure Kubernetes Service (AKS) clusters, from initial deployment through production management. You'll learn to create and configure AKS clusters, manage node pools, implement networking policies, scale applications, and monitor cluster health—all critical skills for the Azure Administrator (AZ-104) certification.

Prerequisites:

• Azure subscription with owner or contributor access
• Azure CLI installed (version 2.40+)
• kubectl installed (version 1.24+)
• Basic understanding of Kubernetes concepts
• Familiarity with Azure resource groups and virtual networks

Why This Matters for AZ-104: AKS represents a significant portion of Azure's container orchestration strategy. The AZ-104 exam heavily tests your ability to deploy clusters, configure networking, manage access control, and troubleshoot common issues. Understanding AKS is essential for managing modern application infrastructure in Azure.

Getting Started

Before deploying your first AKS cluster, ensure your environment is properly configured. Start by installing required tools and authenticating with Azure.

Step 1: Install and Verify Azure CLI

#!/bin/bash
# Install Azure CLI (macOS example using Homebrew)
brew install azure-cli

# Verify installation
az --version

# Login to Azure
az login

# Set your subscription (if you have multiple)
az account set --subscription "Your-Subscription-ID"

# Verify current subscription
az account show --query '{id:id, name:name}' -o table

Step 2: Install kubectl

#!/bin/bash
# Install kubectl using Azure CLI
az aks install-cli

# Verify installation
kubectl version --client --short

# For Linux, alternative installation:
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/

Step 3: Create Resource Group

#!/bin/bash
# Create a resource group for all AKS resources
RG_NAME="myaksresourcegroup"
LOCATION="eastus"

az group create \
  --name $RG_NAME \
  --location $LOCATION

# Verify creation
az group show --name $RG_NAME --query '{name:name, location:location}' -o table

Creating Your First AKS Cluster

Deploying an AKS cluster involves specifying compute resources, networking configuration, and authentication settings. Let's create a production-ready cluster with best practices applied.

Basic Cluster Deployment

#!/bin/bash
RG_NAME="myaksresourcegroup"
CLUSTER_NAME="myakscluster"
LOCATION="eastus"
NODE_COUNT=3
VM_SIZE="Standard_D2s_v3"
K8S_VERSION="1.28"

# Create AKS cluster with essential parameters
az aks create \
  --resource-group $RG_NAME \
  --name $CLUSTER_NAME \
  --node-count $NODE_COUNT \
  --vm-set-type VirtualMachineScaleSets \
  --load-balancer-sku standard \
  --enable-managed-identity \
  --network-plugin azure \
  --network-policy azure \
  --docker-bridge-address 172.17.0.1/16 \
  --service-cidr 10.0.0.0/16 \
  --dns-service-ip 10.0.0.10 \
  --kubernetes-version $K8S_VERSION \
  --enable-cluster-autoscaling \
  --min-count 3 \
  --max-count 10 \
  --zones 1 2 3 \
  --generate-ssh-keys

echo "Cluster creation initiated. This typically takes 5-10 minutes."

# Monitor cluster creation status
az aks show \
  --resource-group $RG_NAME \
  --name $CLUSTER_NAME \
  --query 'provisioningState' -o tsv

Configure kubectl Context

#!/bin/bash
RG_NAME="myaksresourcegroup"
CLUSTER_NAME="myakscluster"

# Get cluster credentials and merge with kubeconfig
az aks get-credentials \
  --resource-group $RG_NAME \
  --name $CLUSTER_NAME \
  --overwrite-existing

# Verify connection
kubectl cluster-info
kubectl get nodes -o wide
kubectl get namespaces

Common Pitfall: Many administrators forget to enable managed identity and network policies during cluster creation. These cannot be easily added later without recreating the cluster. Always enable them from the start for production environments.

Managing Node Pools and Scaling

Node pools allow you to run different workload types on separate node groups. This is crucial for production environments with mixed workload requirements.

Add Additional Node Pool

#!/bin/bash
RG_NAME="myaksresourcegroup"
CLUSTER_NAME="myakscluster"
NEW_POOL_NAME="gpunodes"
NODE_COUNT=2
VM_SIZE="Standard_NC6s_v3"  # GPU-enabled VM

# Add node pool with GPU capability
az aks nodepool add \
  --resource-group $RG_NAME \
  --cluster-name $CLUSTER_NAME \
  --name $NEW_POOL_NAME \
  --node-count $NODE_COUNT \
  --vm-set-type VirtualMachineScaleSets \
  --node-vm-size $VM_SIZE \
  --labels workload=gpu tier=premium

# View all node pools
az aks nodepool list \
  --resource-group $RG_NAME \
  --cluster-name $CLUSTER_NAME \
  -o table

# Verify nodes in kubectl
kubectl get nodes --show-labels

Configure Cluster Autoscaling

#!/bin/bash
RG_NAME="myaksresourcegroup"
CLUSTER_NAME="myakscluster"
POOL_NAME="nodepool1"

# Enable autoscaling on node pool
az aks nodepool update \
  --resource-group $RG_NAME \
  --cluster-name $CLUSTER_NAME \
  --name $POOL_NAME \
  --enable-cluster-autoscaler \
  --min-count 3 \
  --max-count 15

# Check autoscaling configuration
az aks nodepool show \
  --resource-group $RG_NAME \
  --cluster-name $CLUSTER_NAME \
  --name $POOL_NAME \
  --query 'autoScaling' -o json

Networking and Security Configuration

Proper networking setup prevents unauthorized access and ensures efficient pod communication. Azure network policies provide microsegmentation at the cluster level.

Enable Network Policy (Post-Creation)

#!/bin/bash
# Note: Network policy must be enabled during cluster creation
# If not enabled, you must create a new cluster
# Check if network policy is enabled
az aks show \
  --resource-group $RG_NAME \
  --name $CLUSTER_NAME \
  --query 'networkProfile.networkPolicy' -o tsv

# Apply a network policy to restrict traffic
kubectl apply -f - <

Configure RBAC and Access Control

#!/bin/bash
RG_NAME="myaksresourcegroup"
CLUSTER_NAME="myakscluster"

# Enable Azure AD integration (recommended approach)
az aks update \
  --resource-group $RG_NAME \
  --name $CLUSTER_NAME \
  --enable-aad \
  --aad-admin-group-object-ids ""

# Create Kubernetes role for developers
kubectl apply -f - <

Monitoring and Troubleshooting

Effective monitoring ensures cluster health and enables rapid issue detection. Azure Monitor for Containers integrates seamlessly with AKS.

Enable Container Insights

#!/bin/bash
RG_NAME="myaksresourcegroup"
CLUSTER_NAME="myakscluster"
WORKSPACE_NAME="${CLUSTER_NAME}Workspace"

# Create Log Analytics workspace
az monitor log-analytics workspace create \
  --resource-group $RG_NAME \
  --workspace-name $WORKSPACE_NAME

# Get workspace ID
WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group $RG_NAME \
  --workspace-name $WORKSPACE_NAME \
  --query id -o tsv)

# Enable Container Insights
az aks enable-addons \
  --resource-group $RG_NAME \
  --name $CLUSTER_NAME \
  --addons monitoring \
  --workspace-resource-id $WORKSPACE_ID

# Verify addon status
az aks show \
  --resource-group $RG_NAME \
  --name $CLUSTER_NAME \
  --query 'addonProfiles' -o json

Common Troubleshooting Commands

#!/bin/bash
# Check cluster health and node status
kubectl get nodes -o wide
kubectl describe node 

# Inspect pod status and events
kubectl get pods --all-namespaces
kubectl describe pod  -n 
kubectl logs  -n  --previous

# Check resource utilization
kubectl top nodes
kubectl top pods --all-namespaces

# Inspect events for troubleshooting
kubectl get events --all-namespaces --sort-by='.lastTimestamp'

# Test cluster connectivity
kubectl run debug-pod --image=busybox --restart=Never -- sleep 3600
kubectl exec -it debug-pod -- sh
kubectl delete pod debug-pod

Exam Tips for Azure Administrator (AZ-104)

Key Concepts to Master:

• Cluster creation parameters: Network plugin selection (Azure vs kubenet), service CIDR, DNS configuration, and managed identities are frequently tested
• Node pool management: Understand when to use multiple node pools for different workload types and how autoscaling works
• Network policies: Know the difference between Kubernetes network policies and Azure network policies; understand CIDR ranges
• RBAC configuration: Master role and rolebinding creation, service account usage, and Azure AD integration
• Monitoring and diagnostics: Understand Container Insights setup, Log Analytics workspace integration, and metric queries

Common Exam Scenarios:

• "A company needs to ensure pods can only communicate within specific namespaces. Which feature should you implement?" Answer: Network policies with namespace selectors
• "You must scale your cluster from 3 to 15 nodes based on demand. Which setting enables automatic scaling?" Answer: Cluster autoscaler on node pools
• "How do you restrict access to cluster resources based on Azure AD groups?" Answer: Enable AAD integration and configure RBAC roles
• "Your cluster deployment failed due to IP address conflicts. What should you verify?" Answer: Service CIDR, pod CIDR, and Docker bridge address ranges don't overlap

Quick Reference Commands:

#!/bin/bash
# Essential one-liners for exam scenarios

# List all AKS clusters
az aks list --query '[].{name:name, rg:resourceGroup}' -o table

# Scale node pool
az aks nodepool scale --resource-group RG --cluster-name CLUSTER --name POOL --node-count 5

# Get cluster kubeconfig
az aks get-credentials --resource-group RG --name CLUSTER

# Enable cluster autoscaler
az aks nodepool update --resource-group RG --cluster-name CLUSTER --name POOL --enable-cluster-autoscaler --min-count 3 --max-count 10

# Check node pool details
az aks nodepool show --resource-group RG --cluster-name CLUSTER --name POOL -o json

# Upgrade Kubernetes version
az aks upgrade --resource-group RG --name CLUSTER --kubernetes-version 1.28

Summary

You've learned to deploy production-ready AKS clusters with proper networking, security, and monitoring configurations. Key takeaways include: enabling managed identity and network policies during cluster creation, using multiple node pools for workload isolation, implementing network policies for microsegmentation, configuring RBAC with Azure AD integration, and setting up Container Insights for comprehensive monitoring.

Next Steps: Deploy a multi-tier application to your AKS cluster, implement ingress controllers, configure persistent storage, and practice troubleshooting common deployment issues. These hands-on experiences will solidify your understanding for the AZ-104 exam.

For additional certification preparation, refer to the Azure Administrator (AZ-104) Complete Study Guide on CloudNinjas.ca, which covers networking, storage, and compliance alongside containerization strategies.