Container Platform on Azure

Overview

Azure offers two primary container platforms — AKS (Azure Kubernetes Service) and Azure Container Apps — supported by Azure Container Registry (ACR) for image storage and Azure Container Instances (ACI) for on-demand single containers. The containerisation journey on Azure starts with ACR for image storage, moves through a CI/CD pipeline that builds and pushes images, and ends with either Container Apps or AKS running those images behind an Application Gateway or Azure Load Balancer.

Container Apps is built on Kubernetes and KEDA internally, but that complexity is fully managed. You declare revision traffic weights, scaling rules, and environment variables; Azure provisions and scales the underlying infrastructure. AKS exposes the full Kubernetes API — node pools, taints, custom admission controllers, CNI selection, and GPU scheduling — suited to teams that need those primitives or have existing Kubernetes expertise to justify the overhead.

Architecture Overview

%%{init:{'theme':'base','themeVariables':{'fontSize':'14px','fontFamily':'Inter, system-ui, sans-serif','primaryColor':'#DBEAFE','primaryTextColor':'#1e3a5f','primaryBorderColor':'#2563EB','lineColor':'#374151','clusterBkg':'#F9FAFB','clusterBorder':'#D1D5DB','edgeLabelBackground':'#FFFFFF'},'flowchart':{'curve':'orthogonal','padding':30,'nodeSpacing':65,'rankSpacing':75,'useMaxWidth':true}}}%%
flowchart TD
    START([Developer Pushes Code])

    START --> CI[CI Pipeline\nBuild container image\nRun tests and SAST]
    CI --> SCAN{Image Security\nScan Passed?}
    SCAN -->|Vulnerabilities found| FAIL[Block deployment\nNotify engineer\nLog to Defender for Containers]
    SCAN -->|Clean| ACR_PUSH[Push to ACR\nImmutable tags\nRetention policy active]

    ACR_PUSH --> DEPLOY{Deployment\nTarget}
    DEPLOY -->|No K8s complexity needed| CAPP[Azure Container Apps\nRevision-based deployment\nScale-to-zero supported]
    DEPLOY -->|Kubernetes ecosystem| AKS[AKS Cluster\nUser node pool\nHelm or GitOps]

    CAPP --> AGWY[Application Gateway\nor Azure Front Door\nHTTPS ingress]
    AKS --> AGWY

    AGWY --> USERS([Users Reach the Application])

    style START fill:#4f8ef7,color:#fff
    style USERS fill:#10b981,color:#fff
    style FAIL fill:#fef3c7
    style ACR_PUSH fill:#e0f2fe

Azure Service Topology

%%{init:{'theme':'base','themeVariables':{'fontSize':'14px','fontFamily':'Inter, system-ui, sans-serif','primaryColor':'#DBEAFE','primaryTextColor':'#1e3a5f','primaryBorderColor':'#2563EB','lineColor':'#374151','clusterBkg':'#F9FAFB','clusterBorder':'#D1D5DB','edgeLabelBackground':'#FFFFFF'},'flowchart':{'curve':'orthogonal','padding':30,'nodeSpacing':65,'rankSpacing':75,'useMaxWidth':true}}}%%
flowchart TD
    INTERNET[Internet Traffic]

    subgraph REGISTRY["Azure Container Registry (Premium)"]
        REPO[Private Repository\nPublic network disabled\nPrivate endpoint only]
        SCAN_ACR[Defender for Containers\nContinuous CVE scanning\nGeo-replication enabled]
    end

    subgraph AKS_CLUSTER["AKS Cluster"]
        subgraph SYSPOOL["System Node Pool — D4s_v5 × 3"]
            COREDNS[CoreDNS\nCluster DNS]
            KONNECT[Konnectivity\nAPI server tunnel]
            METRICS[metrics-server\nResource metrics]
        end
        subgraph USERPOOL["User Node Pool — D8s_v5 (3–20, autoscaler)"]
            APP1[App Pod A\nWorkload Identity\nno host process]
            APP2[App Pod B\nWorkload Identity\nno host process]
            APP3[App Pod C\nWorkload Identity\nno host process]
        end
    end

    subgraph IDENTITY["Identity — Entra ID"]
        WI[Workload Identity\nOIDC federation\nno secrets in pods]
        MI[Managed Identity\nKubelet identity\nAcrPull role]
    end

    subgraph OBSERVE["Observability"]
        MON[Azure Monitor\nContainer Insights\nPrometheus scrape]
        LAW[Log Analytics Workspace\nQuery and alerts\nRetention policy]
    end

    INTERNET --> AKS_CLUSTER
    REPO --> MI
    MI -->|AcrPull| AKS_CLUSTER
    SCAN_ACR -.->|Scans| REPO
    WI -->|OIDC token exchange| APP1 & APP2 & APP3
    SYSPOOL -.->|taint: CriticalAddonsOnly| USERPOOL
    AKS_CLUSTER --> MON --> LAW

    style INTERNET fill:#4f8ef7,color:#fff
    style SCAN_ACR fill:#e0f2fe
    style WI fill:#e0f2fe

Implementation Guide

Bicep — AKS Managed Cluster

// Microsoft.ContainerService/managedClusters@2023-07-01
resource aksCluster 'Microsoft.ContainerService/managedClusters@2023-07-01' = {
  name: clusterName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    enableRBAC: true
    aadProfile: {
      managed: true
      enableAzureRBAC: true
    }
    oidcIssuerProfile: {
      enabled: true
    }
    securityProfile: {
      workloadIdentity: {
        enabled: true
      }
      imageCleaner: {
        enabled: true
        intervalHours: 48
      }
    }
    networkProfile: {
      networkPlugin: 'azure'
      networkPolicy: 'azure'
      loadBalancerSku: 'standard'
      outboundType: 'userAssignedNATGateway'
    }
    agentPoolProfiles: [
      {
        name: 'system'
        mode: 'System'
        count: 3
        vmSize: 'Standard_D4s_v5'
        availabilityZones: [ '1', '2', '3' ]
        osDiskType: 'Ephemeral'
        upgradeSettings: {
          maxSurge: '33%'
        }
        nodeTaints: [ 'CriticalAddonsOnly=true:NoSchedule' ]
      }
      {
        name: 'apppool'
        mode: 'User'
        count: 3
        minCount: 3
        maxCount: 20
        enableAutoScaling: true
        vmSize: 'Standard_D8s_v5'
        availabilityZones: [ '1', '2', '3' ]
        osDiskType: 'Ephemeral'
        upgradeSettings: {
          maxSurge: '33%'
        }
      }
    ]
    addonProfiles: {
      azurePolicy: {
        enabled: true
      }
      omsAgent: {
        enabled: true
        config: {
          logAnalyticsWorkspaceResourceID: logAnalyticsWorkspaceId
        }
      }
    }
  }
}

// Grant kubelet identity AcrPull on the registry
resource acrPullAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: containerRegistry
  name: guid(containerRegistry.id, aksCluster.id, acrPullRoleId)
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', acrPullRoleId)
    principalId: aksCluster.properties.identityProfile.kubeletidentity.objectId
    principalType: 'ServicePrincipal'
  }
}

Bicep — Azure Container Registry (Premium)

// Microsoft.ContainerRegistry/registries@2023-07-01
resource containerRegistry 'Microsoft.ContainerRegistry/registries@2023-07-01' = {
  name: registryName
  location: location
  sku: {
    name: 'Premium'
  }
  properties: {
    adminUserEnabled: false
    publicNetworkAccess: 'Disabled'
    zoneRedundancy: 'Enabled'
    policies: {
      retentionPolicy: {
        days: 30
        status: 'enabled'
      }
    }
  }
}

Terraform equivalent: Use azurerm_kubernetes_cluster with identity { type = "SystemAssigned" }, oidc_issuer_enabled = true, workload_identity_enabled = true, and separate azurerm_kubernetes_cluster_node_pool for the user pool. Use azurerm_container_registry with sku = "Premium", public_network_access_enabled = false, zone_redundancy_enabled = true, and azurerm_role_assignment binding AcrPull to the kubelet identity principal.

Decision Criteria

Recommendation for most Ascendion projects: Start with Azure Container Apps. Graduate to AKS when you need a specific Kubernetes capability — custom operators, advanced network policy, GPU workloads, or client-mandated Kubernetes.

Cost Model

Cost optimisation levers:

• Use Ephemeral OS disks on all node pools — no managed disk cost per node, faster node provisioning.
• Enable cluster autoscaler on the user pool; set scale-down-delay-after-add to 10 minutes to avoid thrashing.
• Spot node pools for non-production environments and batch workloads reduce VM cost by up to 90%.
• ACR geo-replication adds a second replica charge — only enable it for regions that actually serve production traffic.
• Defender for Containers is charged per vCore of running nodes; audit enablement scope to production only.

Anti-Patterns to Avoid

Flowchart

References

1. Microsoft — AKS best practices. https://learn.microsoft.com/azure/aks/best-practices
2. Microsoft — Workload Identity overview. https://learn.microsoft.com/azure/aks/workload-identity-overview
3. Microsoft — Container Apps vs AKS. https://learn.microsoft.com/azure/container-apps/compare-options
4. Microsoft — Upgrade an AKS cluster. https://learn.microsoft.com/azure/aks/upgrade-cluster
5. CNCF — Cloud Native Landscape. https://landscape.cncf.io
6. Portal: AWS container platform comparison. /technology/cloud/aws-container-platform/