Azure AKS Architecture Diagram: Components, Patterns, and Production Best Practices

Core Architecture Components

An AKS cluster is fundamentally split into two main parts:

1. Control Plane (Fully Managed by Azure)

The control plane is a managed Azure service, meaning you don't manage the underlying machines. It provides the core Kubernetes services and orchestrates application workloads. Microsoft operates and abstracts key components like:

• API Server (kube-apiserver): Exposes the Kubernetes API. Users and components interact with the cluster through it.
• etcd: A distributed key-value store that holds all cluster state and configuration data.
• Scheduler: Assigns pods to worker nodes based on resource availability and constraints.
• Controller Manager: Runs control loops that watch the API server for state changes and reconciles the cluster to match the desired state.
• Cloud Controller Manager: Integrates Kubernetes with underlying Azure services like load balancers and storage.

The control plane is replicated across multiple availability zones for high availability.

2. Nodes (Data Plane - Customer Managed)

Nodes are the Azure virtual machines in your subscription that run your application workloads. Nodes are organized into node pools in your subscription.

Node Pools:

• System Node Pools: Host critical system pods such as CoreDNS and metrics-server. They should be kept separate from application workloads using taints.
• User Node Pools: Host your application workload pods.

Each node runs the kubelet and a container runtime (like containerd). Networking is provided by the Azure Container Networking Interface (CNI) plugin.

Networking: The Foundation of AKS

Networking is a critical design area for any AKS cluster. AKS offers several networking models.

Azure CNI (Recommended)

• How it works: Integrates directly with your Azure Virtual Network (VNet). Pods receive IP addresses from the VNet subnet, making them "first-class citizens" directly routable to other Azure services, on-premises systems, and peered VNets.
• Azure CNI Overlay (Recommended Baseline): Pods receive IP addresses from a separate, private CIDR range, reducing the strain on your VNet IP space. This is the recommended option for most clusters.
• Azure CNI with Cilium (Enterprise Standard): For enterprise deployments, Azure CNI powered by Cilium is now the recommended standard. It uses an eBPF-based data plane, offering improved performance, built-in network policy enforcement, and enhanced observability.

Common Architecture Patterns

Microsoft provides several reference architectures on the Azure Architecture Center to guide your AKS design.

1. Baseline Architecture for an AKS Cluster

This is the recommended starting point for most production AKS clusters. It follows Azure Well-Architected Framework best practices and integrates with Azure services to deliver observability and security.

Key features of the Baseline Architecture:

• Hub-Spoke Network Topology: Deploys the AKS cluster in a spoke VNet connected to a central hub VNet that hosts shared services like Azure Firewall.
• Integration with Azure Services: Utilizes services like Azure Application Gateway, Azure Container Registry (ACR), and Azure Firewall.
• Security: Implements features like Microsoft Entra Workload ID and egress restrictions.

You can download the Visio file for this architecture.

2. Microservices Architecture on AKS

This architecture builds on the baseline and shows a microservices application deployed to AKS. It describes a basic AKS configuration you can use as a starting point for most deployments.

Data Flow Example:

1. A client sends an HTTPS request to the ingress controller.
2. The request is routed to an ingestion microservice.
3. The ingestion service processes the request and sends a message to an Azure Service Bus queue.
4. A workflow microservice consumes the message from the queue.
5. The workflow service communicates with other microservices (delivery, drone scheduler, package) and external data stores (like Azure Managed Redis).
6. A separate GET request retrieves the status from a delivery microservice.

You can download the Visio file for this architecture.

3. Advanced AKS Microservices Architecture

For more complex scenarios, this advanced architecture includes configurations for network policies (Cilium NetworkPolicy), pod autoscaling, and distributed tracing.

Key Components:

• Ingress: Uses Azure Application Gateway to route external HTTPS traffic into the cluster.
• Asynchronous Communication: Uses Azure Service Bus to decouple microservices.
• State Management: Uses Azure Managed Redis and Azure Cosmos DB for external data storage.
• Security: Uses Advanced Container Networking Services with Cilium to enforce network policies and encrypt pod-to-pod traffic.
• Observability: Ingest data into Azure Monitor for end-to-end visibility.

You can download the Visio file for this architecture.

4. AKS Baseline for Multiregion Clusters

This pattern details how to run multiple AKS clusters across regions in an active/active, highly available configuration.

Key Components:

• Regional AKS Clusters: Deployed in separate Azure regions.
• Regional Hub-Spoke Networks: Each region has its own hub-spoke network setup.
• Regional Key Vaults: For storing region-specific secrets and keys.
• Global Traffic Management: Azure Front Door or Traffic Manager routes traffic across regions, routing to the nearest healthy region if one fails.
• Azure Kubernetes Fleet Manager: Coordinates cluster and node image updates across all regional clusters.

You can download the Visio file for this architecture.

Production Best Practices

When designing an AKS cluster for production, it's crucial to distinguish between cluster and workload best practices.

Tools for Creating AKS Architecture Diagrams

You can create professional AKS architecture diagrams using several tools:

• Microsoft Visio: The recommended tool. Official reference architectures from the Azure Architecture Center include downloadable Visio files.
• Draw.io (diagrams.net): A free, browser-based tool with a built-in Azure shape library.
• AI-Powered Tools:
  • AI Line Studio: Generates Azure architecture diagrams from natural language prompts in seconds. For Azure-specific workflows, use the AI cloud diagram generator.
  • Visual Paradigm AI: A browser-based tool that aligns your architecture with the Azure Well-Architected Framework.

Summary

To start building your own Azure AKS architecture diagrams, explore the Azure architecture diagram tool for templates and examples. For automated diagram generation, try the AI cloud diagram generator to turn an AKS description into a visual instantly.