Azure Kubernetes Service Tutorial: Containers from Scratch (2026)

Published: October 26, 2025 | Category: Microsoft | Reading time: ~15 min

Kubernetes was intimidating when I first approached it — pods, services, ingress, operators. But after migrating our microservices to AKS, I cannot imagine going back to manually managed VMs. Azure Kubernetes Service handles the control plane, upgrades, and scaling, letting your team focus on application workloads.

Azure Kubernetes Service (AKS) is Microsoft's managed Kubernetes service. It provisions, upgrades, and scales the Kubernetes control plane for you. AKS integrates with Azure AD, Azure Policy, Container Registry, and monitoring. You pay only for worker nodes and associated Azure resources.

📖 Table of Contents

Cluster Creation and Node Pools
Deploying Applications with Kubernetes Manifests
Scaling and Horizontal Pod Autoscaler
Networking: Ingress, Service Mesh, and Network Policies
Storage: Persistent Volumes and Storage Classes
Security: Azure AD Integration, RBAC, and Pod Identity

Cluster Creation and Node Pools

Create a cluster with Azure CLI, Portal, or Terraform. Choose node size, count, and availability zones. System node pool runs core system pods. User node pools run your workloads. Enable cluster autoscaler for automatic scaling.

az aks create --resource-group MyRG --name myAKSCluster --node-count 3 --node-vm-size Standard_DS2_v2 --enable-cluster-autoscaler --min-count 1 --max-count 10
az aks get-credentials --resource-group MyRG --name myAKSCluster

Deploying Applications with Kubernetes Manifests

Define deployments, services, and configmaps in YAML. kubectl apply deploys to the cluster. Deployments manage replica sets with rolling updates. Services expose pods internally (ClusterIP) or externally (LoadBalancer). ConfigMaps and Secrets manage configuration.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      labels:
        app: webapp
    spec:
      containers:
      - name: webapp
        image: myregistry.azurecr.io/webapp:latest
        ports:
        - containerPort: 80

Scaling and Horizontal Pod Autoscaler

HPA automatically scales pods based on CPU, memory, or custom metrics. Cluster autoscaler adds nodes when pods cannot be scheduled. Combine both for full elasticity. Use Pod Disruption Budgets for availability during updates.

kubectl autoscale deployment webapp --cpu-percent=70 --min=3 --max=20
# Or YAML:
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: webapp
  minReplicas: 3
  maxReplicas: 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

Networking: Ingress, Service Mesh, and Network Policies

Ingress controllers (NGINX, Application Gateway) route external traffic. Services: ClusterIP, NodePort, LoadBalancer. Network policies isolate pod-to-pod traffic. Service mesh (Istio, Linkerd) provides mTLS, traffic splitting, and observability.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: myapp.contoso.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webapp
            port:
              number: 80

Storage: Persistent Volumes and Storage Classes

Pods use PersistentVolumeClaims to request storage. Azure Disk (ReadWriteOnce) for single pod. Azure Files (ReadWriteMany) for multi-pod access. Storage classes define performance tier and replication. CSI drivers handle provisioning.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data-pvc
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: managed-premium
  resources:
    requests:
      storage: 100Gi

Security: Azure AD Integration, RBAC, and Pod Identity

AKS integrates with Azure AD for authentication. Kubernetes RBAC controls access to resources. Azure Policy for Kubernetes enforces compliance. Pod Managed Identity gives pods Azure AD identities for accessing Azure services.

az aks update --resource-group MyRG --name myAKSCluster --enable-aad --enable-azure-rbac
kubectl create rolebinding dev-edit --clusterrole=edit --user=user@contoso.com --namespace=dev

Frequently Asked Questions

Does AKS cost extra beyond the VMs?

The AKS control plane is free. You pay for worker node VMs, storage, and networking. Premium tier adds SLA for the control plane.

How do I upgrade my AKS cluster?

Use az aks upgrade for control plane and node pools. AKS supports multiple Kubernetes versions with a rolling deprecation policy. Upgrade node pools one at a time.

Can I run Windows containers on AKS?

Yes. AKS supports Windows Server node pools running Windows containers. Use the osType: Windows selector in your deployment YAML.

How does AKS handle disaster recovery?

Deploy clusters across regions. Use Azure Traffic Manager or Front Door for global load balancing. Back up persistent data with Velero or Azure Backup.

Originally published on Ayodhyyya. Last updated June 1, 2026.