First page of Microsoft's 100,000-partner directory, sorted by responsiveness Microsoft Solutions Partner — Security, Modern Work, Infrastructure, App Innovation Microsoft partner since 2006 1,100+ organizations under management
Home/Services/Azure Kubernetes Service (AKS) Design and Deployment
Implementation

Azure Kubernetes Service (AKS) Design and Deployment

Azure Kubernetes Service (AKS) Design and Deployment builds a production-grade AKS platform for teams that have outgrown Azure App Service or inherited a self-managed Kubernetes cluster nobody wants to own. The engagement covers the tier and topology decisions, node-pool sizing, Azure CNI networking powered by Cilium, Microsoft Entra ID sign-in with Azure RBAC for Kubernetes and workload identity for pods, ingress with TLS, Azure Monitor managed Prometheus and Managed Grafana observability, Azure Backup for AKS with a tested restore, an upgrade and maintenance baseline, one containerized workload onboarded through your CI/CD pipeline, and an operations handover document your team runs the cluster from. Projects are quoted after a scoping call — cluster and environment count, network topology, and Windows node requirements move the price — and a single-cluster build typically runs about 4 weeks, managed by Roman Sotnik.

Timeline 4 weeksService owner Roman SotnikMicrosoft AzureAzure Kubernetes ServiceMicrosoft Entra ID

What this engagement is

Two kinds of teams arrive at this page. The first has outgrown Azure App Service: several services that need to share a platform, sidecars, custom networking, background workers that do not fit a web-app model, or a vendor product that ships only as Helm charts. The second has inherited Kubernetes — a kubeadm cluster on virtual machines, or an AKS cluster a contractor built with a local admin kubeconfig, no upgrades in a year, and nobody who knows how the ingress works. Both need the same thing: a cluster designed to Microsoft's AKS baseline guidance, deployed from infrastructure as code, and documented well enough to operate. We start with an honest platform decision. If your workloads would run happily on Azure Container Apps without the Kubernetes API, we say so in the design document — it is cheaper to run and far cheaper to operate — and we scope that instead. If Kubernetes is the right answer, the next decision is AKS Automatic, Microsoft's opinionated configuration with node auto-provisioning, Deployment Safeguards, and managed system node pools enforced by default, versus AKS Standard, where we make every choice explicitly — the usual reasons to choose Standard are Windows node pools, custom node configuration, or network constraints Automatic does not accommodate yet. From there the design covers the things that are painful to change later: the pricing tier (production clusters go on the Standard tier for the financially backed API-server SLA), availability zones, network mode and IP plan (Azure CNI Overlay powered by Cilium is our default, and Microsoft's), whether the API server is private, egress, identity (Microsoft Entra ID sign-in with Azure RBAC for Kubernetes, local accounts disabled, workload identity for pods), ingress, observability, backup, and the upgrade policy — because AKS supports only the latest three Kubernetes minor versions, an upgrade cadence is a design input, not an afterthought. We then deploy it, onboard one workload through your CI/CD pipeline so the pattern is proven end to end, rehearse a restore and an upgrade, and hand over with a runbook and a recorded session. Writing or refactoring application code is out of scope — Application Containerization to Azure packages an existing application into an image, and Legacy Application Modernization to Azure re-platforms aging code — and so is 24/7 operation of the cluster after handover, which is available as a managed follow-on.

Success criteria

01The AKS design document — platform choice (Automatic or Standard), tier, topology, node pools, network and IP plan, identity model, ingress, observability, backup, and upgrade policy — is approved in writing before any production resource is deployed.
02The cluster and its supporting resources are deployed from infrastructure as code (Bicep or Terraform) held in your repository, and can be redeployed from it.
03Kubernetes API access is authenticated by Microsoft Entra ID and authorized through Azure RBAC for Kubernetes; local cluster accounts are disabled and no long-lived static credentials exist in any kubeconfig or pipeline.
04The onboarded workload is reachable through the agreed ingress with a valid TLS certificate, pulls its image from your private Azure Container Registry using managed identity, and reads secrets from Azure Key Vault through workload identity — no secrets in manifests or environment files.
05Dashboards and alert rules in Azure Monitor managed Prometheus, Azure Managed Grafana, and Container Insights cover the agreed conditions — node pressure, crash-looping pods, failed rollouts, certificate expiry, backup failures — and route to your on-call channel.
06A backup of cluster resources and persistent volumes has been taken with Azure Backup for AKS and restored successfully in a test; an upgrade has been rehearsed; the operations runbook has been accepted and the handover session recorded.

What you receive

AKS design document: the platform decision (AKS Automatic or Standard — with an explicit note if Azure Container Apps would serve you better), pricing tier, environments and cluster count, node-pool layout with VM sizes and availability zones, network design (Azure CNI Overlay with Cilium, IP plan, private API server or authorized IP ranges, egress path), identity and RBAC model, ingress choice, upgrade and maintenance policy, and a monthly Azure cost estimate from Microsoft's published pricing.
Infrastructure as code (Bicep or Terraform) for the cluster, node pools, Azure Container Registry, Key Vault, Azure Monitor and Log Analytics workspaces, Azure Managed Grafana, and the Backup vault — in your repository, deployable through your pipeline.
A deployed AKS cluster on the agreed tier: system and user node pools separated, cluster autoscaler or node auto-provisioning configured, availability zones where the region supports them, planned maintenance windows for control-plane and node-image upgrades, and Azure Policy with Deployment Safeguards in the agreed mode.
Identity integration: Microsoft Entra ID authentication with Azure RBAC for Kubernetes authorization, administrator and developer roles mapped to Entra security groups, local accounts disabled, workload identity federation for the onboarded workload, and Key Vault secrets delivered through the Secrets Store CSI driver.
Ingress and TLS: Azure Application Gateway for Containers or the AKS application routing add-on's Gateway API implementation, as agreed in design, with certificates stored in Key Vault and public or private exposure per the network design.
Observability: Azure Monitor managed Prometheus with Azure Managed Grafana dashboards, Container Insights log collection tuned to control ingestion cost, and an alert rule set routed to email, Teams, or your ITSM tool.
Azure Backup for AKS: the backup extension, a Backup vault with the vaulted tier for the agreed retention, a policy covering cluster resources and Azure Disk persistent volumes, and a documented restore test.
One workload onboarded: your existing container image in Azure Container Registry, a Helm chart or Kustomize manifests with resource requests and limits, readiness and liveness probes, and pod disruption budgets, deployed through your CI/CD pipeline to the cluster.
Operations handover document and recorded session: upgrade procedure and version policy, scaling and node-pool changes, certificate and secret rotation, backup and restore, common failure triage, cost levers, and where every setting lives in the code.

How the work unfolds

Discovery and design (week 1)

Review current hosting, the workloads and their images, team skills, the Azure subscription and network you already have, and compliance constraints. Output is the design document — including the Container Apps versus AKS and Automatic versus Standard decisions — which you approve before anything is built.

Foundation (weeks 1–2)

Infrastructure-as-code baseline and supporting resources: virtual network or landing-zone spoke, Azure Container Registry, Key Vault, monitoring workspaces, Managed Grafana, and the Backup vault. Pipeline deployment of the foundation is validated before the cluster exists.

Cluster deployment (week 2)

AKS deployed from code on the agreed tier: node pools, availability zones, Entra ID integration and Azure RBAC, private API server or authorized ranges, Azure Policy and Deployment Safeguards, maintenance windows, and autoscaling.

Ingress, workload identity, and observability (weeks 2–3)

Ingress and TLS stood up, workload identity and Key Vault integration proven with a test pod, Prometheus metrics and Container Insights flowing, Grafana dashboards deployed, alert rules wired to your channel.

Workload onboarding (week 3)

Your Helm chart or Kustomize manifests reviewed or written, resource limits and probes set, the deployment step added to your CI/CD pipeline, a smoke test run, and DNS cut over where the workload replaces an existing endpoint.

Backup, upgrade rehearsal, and hardening review (weeks 3–4)

Backup policy applied and a restore tested; a Kubernetes or node-image upgrade rehearsed on the non-production cluster or pool; the build reviewed against Microsoft's AKS baseline guidance; cost estimate refreshed from real telemetry.

Handover (week 4)

Operations runbook delivered, recorded walkthrough for the team that will run the cluster, open items closed, and acceptance signed.

Prerequisites

An Azure subscription for the cluster — ideally a spoke in an existing landing zone; if you have no governed foundation yet, the Azure Landing Zone engagement comes first — with rights to register resource providers, create role assignments, and create Entra groups and federated credentials, or approval for IT Partner to do so under least-privilege, time-bound access you approve.
At least one workload already packaged as a container image, or buildable into one from documented steps — packaging an application is the containerization engagement, not part of this one.
A CI/CD platform — GitHub Actions or Azure Pipelines — to deploy the workload from; if you have neither, the Azure DevOps and GitHub CI/CD Pipeline Implementation sets one up.
Network decisions or the people who can make them: address space for the cluster's virtual network, whether the API server must be private, egress firewall rules, and any hybrid connectivity — which, if needed, is a separate Site-to-Site VPN or ExpressRoute engagement.
A tier decision, which we advise on: production clusters run on the Standard tier for the uptime SLA; the Premium tier adds long-term support for teams that cannot upgrade Kubernetes at the community cadence.
A named technical owner who will operate the cluster after handover and attend the handover session, plus timely approvals on design and cutover decisions.

Who does what

IT Partner

  • Lead discovery and produce the design document, including the honest platform recommendation and the cost estimate.
  • Write the infrastructure as code and deploy the foundation, the cluster, identity integration, ingress, observability, and backup to the approved design.
  • Onboard the agreed workload through your pipeline and prove ingress, identity, secrets, and monitoring end to end.
  • Rehearse a restore and an upgrade and record the results.
  • Deliver the operations runbook and the recorded handover session, and raise risks, scope changes, and platform constraints as soon as they are found.

Your team

  • Provide subscription, Entra ID, network, and source-control access, and make design decisions when options are presented.
  • Supply the workload's container image, build steps, and configuration, and the developer who knows how it runs.
  • Approve the design document, the cutover window for any endpoint being replaced, and the acceptance criteria.
  • Own Azure consumption and any Microsoft or third-party licensing.
  • Operate the cluster after handover — upgrades, scaling, on-call — or contract managed operations separately.

What's not included

Containerizing or refactoring applications. The onboarded workload must already run as a container image; Application Containerization to Azure packages an existing application, and Legacy Application Modernization to Azure re-platforms aging code.
24/7 cluster operations, on-call, and ongoing upgrades and patching after handover. Your team operates the cluster from the runbook; managed operations are available as a follow-on through Azure Resource Monitoring and Maintenance, and 24/7 support is an optional extra-cost add-on delivered through IT Partner's NOC and support partnerships.
Azure consumption — node virtual machines, the control-plane tier fee, load balancers and Application Gateway for Containers, storage, Log Analytics ingestion, Prometheus samples, Managed Grafana, the Backup vault, and Azure Container Registry — billed by Microsoft directly to you. The design includes an estimate; Microsoft's meters are the bill of record.
Azure landing zone and subscription governance — management groups, hub networking, policy at scale — which is the Azure Landing Zone and Cloud Adoption Framework Implementation.
Hybrid connectivity between your premises and Azure — the Site-to-Site VPN and ExpressRoute Implementation.
Building out the CI/CD platform itself beyond the deployment step for the onboarded workload — the Azure DevOps and GitHub CI/CD Pipeline Implementation.
Additional workloads beyond the one onboarded, multi-cluster or multi-region active-active designs, service mesh (the Istio add-on), GPU node pools, and confidential computing — each can be quoted, and some are added at scoping rather than excluded.
A full Microsoft Defender for Containers rollout and security-operations integration. Enabling the plan is a design option; SOC tooling and response belong to Defender for Cloud and Sentinel engagements.
Application performance tuning, load testing beyond a smoke test, and code-level fixes for problems the cluster reveals.
Formal compliance certification and penetration testing — we build to Microsoft's baseline and can arrange formal testing separately.

Limitations & technical notes

!Pricing is quote-based on purpose: one cluster with a public ingress and one cluster per environment behind a private API server with hub-and-spoke egress are different projects, and Windows node pools, multi-region, or an inherited cluster to untangle move the effort further. The scoping call produces a written fixed quote before you commit.
!AKS supports the latest three Kubernetes minor versions, and each version receives roughly a year of community support on AKS; the Premium tier extends that with long-term support. In practice the cluster needs a Kubernetes upgrade at least twice a year, which the runbook covers — an AKS cluster is not a set-and-forget resource.
!Production clusters go on the Standard tier, which carries Microsoft's financially backed uptime SLA for the API server; the Free tier has none and is for development and test. The SLA figures are Microsoft's, depend on availability-zone configuration, and are confirmed in the design rather than restated here.
!Ingress: the upstream ingress-nginx project ended maintenance in March 2026, and Microsoft supports the managed NGINX in the AKS application routing add-on with critical security patches only through November 2026. New clusters are therefore designed on Application Gateway for Containers or the Gateway API implementation; an inherited cluster on NGINX ingress gets an explicit migration line in the quote.
!Node auto-provisioning (Karpenter-based) currently supports Linux node pools on Azure CNI Overlay with Cilium; Windows node pools use the cluster autoscaler. Microsoft has also announced retirement dates for the older Azure Network Policy Manager, which is why network policy is implemented with Cilium.
!Azure Backup for AKS protects cluster resources and Azure Disk-backed persistent volumes. Data in Azure Files, external databases, or storage outside the cluster needs its own backup path — and we will recommend keeping databases out of the cluster in the first place.
!Monitoring costs scale with Prometheus samples ingested and Container Insights log volume; we tune collection and retention to the design's estimate, but the meters are yours and the estimate is not a cap.
!The 4-week figure assumes one cluster, one onboarded workload, timely access and approvals, and a network design that does not wait on a change board; client-side delays extend the calendar, not the quote.

Frequently asked questions

What does Azure Kubernetes Service (AKS) Design and Deployment include?

A design document you approve first, then a production-grade AKS cluster deployed from infrastructure as code: node pools sized and zoned, Azure CNI Overlay with Cilium networking, Microsoft Entra ID sign-in with Azure RBAC for Kubernetes, workload identity and Key Vault integration for pods, ingress with TLS, Azure Monitor managed Prometheus and Managed Grafana with alerting, Azure Backup for AKS with a tested restore, an upgrade and maintenance baseline, one of your workloads onboarded through your CI/CD pipeline, and an operations runbook with a recorded handover.

Why is there no price on the page, and what drives the quote?

Because cluster builds range widely. The main drivers are the number of clusters and environments, whether the API server is private and how egress is routed, Windows node pools, whether you are starting clean or we are untangling an inherited cluster, and how much of the surrounding foundation — network, registry, monitoring — already exists. After one scoping call you get a written fixed quote, and per our standard terms you pay after you approve delivery.

How long does it take?

About 4 weeks for a single-cluster build with one workload onboarded: design in week one, foundation and cluster in week two, ingress, identity, monitoring, and workload in week three, backup and upgrade rehearsal plus handover in week four. Multiple environments, a private-cluster network design that waits on a change board, or a slow approval on the design document are what stretch it.

Do we actually need Kubernetes, or would Azure Container Apps do?

Often Container Apps does, and the design document says so when it is true. Container Apps runs container images on a Kubernetes-based platform Microsoft operates, with scaling, ingress, and revisions built in and no cluster to upgrade. You need AKS when you need the Kubernetes API itself — operators, custom controllers, DaemonSets, a service mesh, GPU or Windows node pools, specific node configuration, or a vendor product delivered as Helm charts that assumes a real cluster. If you do not need those things, we would rather sell you the smaller engagement.

AKS Automatic or AKS Standard — which do you deploy?

Whichever the design justifies. AKS Automatic, generally available since late 2025, is Microsoft's opinionated configuration: node auto-provisioning, managed system node pools, Azure CNI Overlay with Cilium, Entra ID integration, and Deployment Safeguards enforced by default — a strong choice for a team without a platform engineer. AKS Standard is where we make every setting explicitly, and it is the answer when you need Windows node pools, custom node configuration, or network patterns Automatic does not yet accommodate. Both are AKS; your images, manifests, and pipelines are the same either way.

Which AKS tier do we need — Free, Standard, or Premium?

Production runs on Standard: it carries Microsoft's financially backed uptime SLA for the Kubernetes API server and scales well beyond anything an SMB cluster needs. Free has no SLA and suits development and test clusters. Premium adds long-term support — Microsoft maintains a Kubernetes version for an additional year beyond the community window — which matters if your workloads or vendors cannot keep up with two upgrades a year. The tier is a per-cluster hourly fee billed by Microsoft; we recommend one in the design and you decide.

How do our engineers sign in to the cluster?

With their Microsoft Entra ID accounts. The cluster is deployed with AKS-managed Entra integration and Azure RBAC for Kubernetes authorization, so cluster-admin and namespace-level developer access are Azure role assignments on Entra security groups — governed by your conditional access policies and revoked the day an account is disabled. Local cluster accounts are turned off, so there is no shared admin kubeconfig to leak.

How do pods get access to Key Vault, storage, or a database without secrets?

Through Microsoft Entra Workload ID: a Kubernetes service account is federated with a managed identity, and the pod exchanges its projected token for an Azure access token at run time — no client secret to store or rotate. Secrets that must exist, such as third-party API keys, live in Azure Key Vault and are mounted by the Secrets Store CSI driver. The older pod-managed identity approach is deprecated and we do not deploy it.

Which ingress do you use — and what about NGINX?

For new clusters, Azure Application Gateway for Containers — an Azure-managed data plane outside the cluster with WAF support — or the Gateway API implementation of the AKS application routing add-on, depending on whether you need a WAF and how traffic reaches the cluster. We no longer design new clusters on NGINX ingress: the upstream ingress-nginx project ended maintenance in March 2026, and Microsoft supports the managed NGINX in the add-on with critical security patches only through November 2026. If you inherit a cluster that depends on it, the migration is scoped explicitly.

What monitoring do we get, and what will it cost to run?

Azure Monitor managed Prometheus collects cluster and workload metrics, Azure Managed Grafana presents them on Microsoft's AKS dashboards plus any we add, and Container Insights collects logs into Log Analytics. Alerts for node pressure, crash-looping pods, failed rollouts, certificate expiry, and backup failures route to your channel. Cost is driven by Prometheus samples ingested, log volume, and Grafana users; the design estimates it from Microsoft's published pricing and we tune collection so you are not paying to store logs nobody reads.

What does the backup actually protect?

Azure Backup for AKS snapshots cluster resources — deployments, config, secrets, custom resources — and Azure Disk persistent volumes on the agreed schedule, keeping a vaulted copy for the retention you choose, with cross-region restore available. We take a backup and restore it during the project so the procedure is proven, not assumed. It does not cover databases outside the cluster or data in Azure Files, which keep their own backup — and we recommend running stateful databases outside the cluster on managed Azure services in the first place.

Who upgrades the cluster after handover?

Your team, from the runbook — or IT Partner under a managed operations arrangement. AKS supports the latest three Kubernetes minor versions, so a cluster needs a version upgrade roughly twice a year plus regular node-image updates; we configure auto-upgrade channels and maintenance windows during the build and rehearse an upgrade before handover so the first one your team does is not the first one anyone has done.

Can you run Windows containers on the cluster?

Yes, on AKS Standard with a Windows Server node pool alongside the Linux system pool — the usual reason is a .NET Framework application that cannot move to Linux. Windows pools use the cluster autoscaler rather than node auto-provisioning and carry Windows licensing in the VM price, both of which the design spells out. If the only reason for AKS is one Windows application, we will also tell you whether App Service for Windows containers would be simpler.

Do we need an Azure landing zone first?

Not always, but a cluster deserves a governed home: a subscription with policy, a virtual network with an agreed address plan, and a monitoring workspace it can share with the rest of your estate. If you already have that, the cluster lands in a spoke. If you have nothing but a pay-as-you-go subscription with resources created by hand, the Azure Landing Zone engagement builds the foundation first, and the two can be scoped together.

We inherited a cluster built by someone who left — can you take it over instead of building new?

Sometimes. Discovery examines the existing cluster — version, tier, networking, how people authenticate, what the ingress is, whether anything is in code — and the design document either brings it to the baseline in place or recommends a clean cluster with the workloads migrated across, which is frequently faster and safer than remediating an out-of-support cluster with local admin access and an NGINX ingress nobody maintains. Either way the outcome is the same: code, identity, monitoring, backup, and a runbook.

What happens after handover — do you offer managed operations?

After handover your team owns the cluster with the runbook and the recorded session. If you would rather not run it, managed operations — monitoring, patching, upgrades, backup administration — are available as a separate recurring engagement through Azure Resource Monitoring and Maintenance, and 24/7 support is an optional extra-cost add-on through IT Partner's NOC and support partnerships. Additional workloads are quoted as small fixed-scope add-ons, and the documented pattern means each one is cheaper than the first.

Didn’t find your question?

Ask it here. A real engineer answers by email within one business day — and if it’s a good one, it becomes part of this page so the next person finds it.

Answered by a person, one time, to your inbox. Nothing you type here is published without a human reviewing and anonymizing it first.

Often combined with

Contact us for a quote
4 weeks
Book an AKS scoping call