Kubernetes and AKS basics for exams

Kubernetes is an open-source orchestrator that keeps containers running across a group of machines, in the shape you declare. Azure Kubernetes Service (AKS) is the managed version: Azure runs the control plane, you run the workloads and, in AKS Standard, the node pools. On an exam, choose AKS when the scenario needs the full Kubernetes API, existing manifests or Helm charts, or fine control of scheduling and networking; choose Container Apps when the team wants containers and scaling without administering Kubernetes. If you do not know what a container or an image is yet, read Docker basics first.

The layers, from the cluster down to the container

Kubernetes is easiest to learn from the outside in. Each layer contains the next one.

Cluster. A control plane plus nodes. In AKS the control plane is Azure-managed: the API server (kube-apiserver), the state store (etcd), the scheduler, the controller manager and the cloud controller manager. You never get a VM for these. The Microsoft documentation states that this holds in both AKS cluster modes.

Nodes. The virtual machines that run your containers. Each runs a kubelet, a network proxy (or Cilium on clusters using Azure CNI powered by Cilium) and a container runtime (containerd). Nodes are grouped into node pools, which by default are backed by Virtual Machine Scale Sets. A system node pool hosts critical system pods such as CoreDNS; user node pools host your applications. AKS creates a second, node resource group for the infrastructure behind the cluster (VMs, scale sets, storage). Agent nodes are billed as ordinary VMs.

Pods. The smallest deployable unit: one or more containers sharing network and storage. Usually one container per pod. Pods are disposable: when one dies it is replaced, with a new name and a new IP address.

Deployments. You rarely create pods by hand. A Deployment declares the desired state, such as three replicas of an image, and its controller changes reality to match. Changing the pod template, for example the image tag, creates a new ReplicaSet and scales it up while the old one scales down. That is the default RollingUpdate strategy, and each pod-template change is recorded as a revision you can roll back to (kubectl rollout undo); scaling the replica count does not create a revision.

Services. Because pods come and go, a Service gives a stable address to a set of pods chosen by a label selector. The type decides who can reach it: ClusterIP (default) is internal to the cluster, NodePort opens a port on each node, and LoadBalancer provisions an external load balancer through the cloud provider. In a Service, port is what the Service listens on and targetPort is the pod’s port.

Namespaces. Logical partitions of a cluster. A new AKS cluster has default, kube-system, kube-public and kube-node-lease. Microsoft advises against deploying your own apps to kube-system.

Reading a manifest

Declarative YAML is how Kubernetes is operated (the same idea as in IaC declarative vs imperative; YAML syntax is covered in JSON vs YAML vs XML).

apiVersion: apps/v1
kind: Deployment
metadata:
  name: shop
spec:
  replicas: 3
  selector:
    matchLabels:
      app: shop
  template:
    metadata:
      labels:
        app: shop
    spec:
      containers:
      - name: web
        image: contoso.azurecr.io/shop:1.4
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: shop
spec:
  type: LoadBalancer
  selector:
    app: shop
  ports:
  - port: 80
    targetPort: 8080

Read it in three questions. How many copies? Three. Which image? shop:1.4 from a registry. How does traffic arrive? A public load balancer on port 80, forwarded to pod port 8080 on pods labelled app: shop. The Deployment’s selector must match the labels in the pod template, or the API rejects it. If the Service selector does not match the pod labels, the Service has no endpoints and the application is “running but unreachable”.

Apply it with kubectl apply -f shop.yaml, watch it with kubectl get pods, and change the image with an edit and another apply.

What AKS adds

• Two cluster modes. AKS Automatic is a more fully managed experience with production-ready defaults; AKS Standard gives you direct control of node pools, scaling and networking. The Standard cluster mode is not the same thing as the Standard pricing tier.
• Pricing tiers for cluster management. Free, Standard and Premium. Free has no financially backed uptime SLA; Standard enables an uptime SLA by default; Premium adds Microsoft maintenance beyond community support. Check the current pricing-tier page for node limits, since these change.
• Registry access. AKS pulls from Azure Container Registry using the cluster’s kubelet managed identity, which is granted the AcrPull role. The shortcut is az aks update --attach-acr. A pod stuck in ImagePullBackOff usually means a wrong image name or missing registry permission. See managed identities vs service principals.
• Monitoring. Container insights collects node, pod and container metrics and logs into Log Analytics; see Azure Monitor and Log Analytics.

Four kinds of scaling

HPA and Cluster Autoscaler work as a pair: HPA adds pods, and when no node has room, the Cluster Autoscaler adds nodes. Microsoft warns against combining a KEDA ScaledObject with a separate HPA on the same workload, and against HPA and VPA on the same CPU or memory metric.

Which exams test this

AZ-104 covers Container Registry, Container Instances and Container Apps in the portal; its outline does not name AKS.

How exam questions are built around it

• “Existing Kubernetes manifests”, “Helm”, “custom operators” point to AKS. “No Kubernetes expertise”, “scale to zero” point to Container Apps. The full comparison is in the Azure compute selection guide.
• Pending pods point to the Cluster Autoscaler or node capacity. More replicas under load points to HPA. Queue-driven, zero when idle points to KEDA.
• ImagePullBackOff means the image could not be pulled: name, tag or registry permission. CrashLoopBackOff means the container starts and exits, so read kubectl logs --previous.
• Unreachable application means check the Service selector against pod labels, then the target port, then the Service type.
• “Who patches the control plane” is Azure. In AKS Standard you still design node pools and their lifecycle; Automatic preconfigures more of it.

Practice questions

Go deeper

• AKS core concepts (Microsoft Learn)
• AKS scaling overview (Microsoft Learn)
• Integrate Azure Container Registry with AKS (Microsoft Learn)
• Deployments (Kubernetes docs) and Services
• Related on this site: CI/CD explained and the study method guide.