Azure Kubernetes Service (AKS) Cheat Sheet
Commands and concepts for provisioning, scaling, and managing Kubernetes clusters on Azure with AKS.
2 PagesAdvancedJan 25, 2026
Create & Connect to a Cluster
Provision an AKS cluster and configure kubectl.
bash
az aks create \ --resource-group myRG \ --name myAKSCluster \ --node-count 3 \ --node-vm-size Standard_DS2_v2 \ --generate-ssh-keys \ --enable-managed-identityaz aks get-credentials --resource-group myRG --name myAKSClusterkubectl get nodes
Scaling
Manually and automatically scale the node pool.
bash
# Manual scaleaz aks scale --resource-group myRG --name myAKSCluster --node-count 5# Enable cluster autoscaleraz aks update --resource-group myRG --name myAKSCluster \ --enable-cluster-autoscaler --min-count 1 --max-count 10
Upgrades & Node Pools
Upgrade Kubernetes version and manage node pools.
bash
az aks get-upgrades --resource-group myRG --name myAKSClusteraz aks upgrade --resource-group myRG --name myAKSCluster \ --kubernetes-version 1.29.2az aks nodepool add --resource-group myRG --cluster-name myAKSCluster \ --name gpupool --node-count 2 --node-vm-size Standard_NC6
Core Concepts
Key core concepts to know.
- Node Pool- A group of VMs of the same size/config running cluster workloads
- Managed Identity- Azure AD identity for the cluster to authenticate to other Azure services
- Cluster Autoscaler- Automatically adds/removes nodes based on pending pod resource demand
- Virtual Nodes- Burst pods to Azure Container Instances without provisioning extra VMs
- Azure CNI vs Kubenet- Networking modes: CNI assigns VNet IPs to pods, kubenet uses an overlay network
Common kubectl Commands
Key common kubectl commands to know.
- kubectl get pods -A- List pods across all namespaces
- kubectl apply -f deploy.yaml- Apply a manifest to the cluster
- kubectl logs <pod>- View container logs from a pod
- kubectl describe node <name>- Inspect node capacity, conditions, and events
- kubectl scale deployment <name> --replicas=5- Manually scale a deployment
Azure AD Workload Identity for Pods
Federate a Kubernetes service account with an Azure AD identity so pods get Azure permissions without secrets.
yaml
apiVersion: v1kind: ServiceAccountmetadata: name: my-app-sa namespace: default annotations: azure.workload.identity/client-id: <managed-identity-client-id> labels: azure.workload.identity/use: "true"---apiVersion: apps/v1kind: Deploymentmetadata: name: my-appspec: template: metadata: labels: azure.workload.identity/use: "true" spec: serviceAccountName: my-app-sa containers: - name: my-app image: myregistry.azurecr.io/my-app:1.0
Autoscale Pods with HPA and KEDA
Scale pods on CPU with the built-in HPA, or on external metrics (queue depth) with KEDA.
yaml
apiVersion: autoscaling/v2kind: HorizontalPodAutoscalermetadata: name: my-app-hpaspec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: my-app minReplicas: 2 maxReplicas: 20 metrics: - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 70---# KEDA ScaledObject (install: az aks addon enable -a azure-keda ...)apiVersion: keda.sh/v1alpha1kind: ScaledObjectmetadata: name: queue-scaledobjectspec: scaleTargetRef: name: my-app minReplicaCount: 0 triggers: - type: azure-queue metadata: queueName: work-items queueLength: "5"
Restrict Pod Traffic with a NetworkPolicy
Deny cross-namespace traffic by default and allow only what's needed (requires Azure CNI or Calico network policy).
yaml
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata: name: default-deny-ingress namespace: prodspec: podSelector: {} policyTypes: [Ingress]---apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata: name: allow-frontend-to-backend namespace: prodspec: podSelector: matchLabels: { app: backend } ingress: - from: - podSelector: matchLabels: { app: frontend } ports: - protocol: TCP port: 8080 policyTypes: [Ingress]
PodDisruptionBudget for Safe Node Upgrades
Guarantee minimum availability during voluntary disruptions like node upgrades or scale-downs.
bash
cat <<EOF | kubectl apply -f -apiVersion: policy/v1kind: PodDisruptionBudgetmetadata: name: my-app-pdbspec: minAvailable: 2 selector: matchLabels: app: my-appEOF# AKS respects PDBs during node image/version upgrades and# during cluster autoscaler scale-down eviction
Advanced Networking & Security Concepts
Concepts beyond basic CNI/kubenet for production clusters.
- Azure CNI Overlay- Pods get IPs from a private overlay space, not the VNet, avoiding IP exhaustion at scale
- Private cluster- API server has no public IP; access via private endpoint or jumpbox only
- Azure Policy for AKS- Enforces Kubernetes admission policies (e.g. disallow privileged pods) via Gatekeeper
- Workload Identity- OIDC federation replacing pod-managed identity/AAD pod-identity for Azure AD auth
- Application Gateway Ingress Controller (AGIC)- Uses Azure Application Gateway as the cluster's L7 ingress instead of NGINX
- Node image upgrade channel- Auto-upgrades the node OS image on a schedule independent of Kubernetes version upgrades
Pro Tip
Separate system and application workloads into distinct node pools (a dedicated system node pool plus user node pools) so critical cluster components aren't starved of resources by application pods.
Was this cheat sheet helpful?
Explore Topics
#AzureKubernetesServiceAKS#AzureKubernetesServiceAKSCheatSheet#CloudComputing#Advanced#CreateConnectToACluster#Scaling#UpgradesNodePools#CoreConcepts#Kubernetes#InfrastructureAsCode#CheatSheet#SkillVeris
