Azure Kubernetes Service

As explained in Azure Security

AKS, or Azure Kubernetes Service, is Microsoft's managed Kubernetes service for deploying and operating Kubernetes clusters in Azure.

Azure Kubernetes Service (AKS) is Azure’s managed Kubernetes offering. Azure creates and configures the control plane, allowing teams to focus on applications instead of managing cluster infrastructure. section 4.3.5

AKS uses shared responsibility. Microsoft maintains the control plane and provides weekly worker-node patches and images, while you apply worker-node operating-system and runtime patches and keep the Kubernetes version current. section 4.3.5

Secure AKS across the container lifecycle:

• Build images from trusted base images and scan them for known vulnerabilities before pushing them to a container registry. section 4.4.2
• Continue scanning registry images for newly surfaced vulnerabilities, including zero-day vulnerabilities. section 4.4.2
• Secure the registry by disabling public access, encrypting images at rest, and enforcing role-based access control (RBAC). section 4.4.2
• Use Kubernetes admission controllers to enforce organization-wide policies, including least-privilege container access, trusted registries, and CPU and memory limits. section 4.4.2
• Limit Kubernetes API-server access, such as by placing the server in a private virtual network and enforcing RBAC. section 4.4.2

Figure 4.10 In AKS, Microsoft configures and maintains the control plane.

Use the figure to distinguish Azure-maintained AKS control-plane components from customer-managed worker-node responsibilities. section 4.3.5

How Azure Security covers it

How deep it goes

Explains the managed boundary and lifecycle security controls, but stops short of provisioning commands or detailed cluster configuration.

Examples

Uses trusted base images, image scanning, private registries, admission policies, API-server isolation, and worker-node patching as concrete practices.

What you can do after

Operate AKS securely by maintaining worker nodes, updating Kubernetes versions, and enforcing image, registry, deployment, and API-access controls.

How it connects

Connects Kubernetes clusters with container images, container registries, admission controllers, virtual networks, and role-based access control.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• Kubernetes-as-a-Servicekind of · Kubernetes-as-a-Service is a managed service in which a provider operates the Kubernetes control plane and related cluster infrastructure for users.
• cloud-native architectureused by · Cloud-native architecture is an approach to designing and operating applications to exploit cloud infrastructure and services, including distributed operation, elasticity, and automated management.
• Kubernetes Enginealternative to · Google Kubernetes Engine is Google Cloud’s managed service for running Kubernetes clusters and containerized workloads.
• workloadkind of · A workload is the amount, pattern, or set of work, tasks, or processing activity assigned to or carried out by a person, application, or computing system.
• Kuberneteskind of · Kubernetes is an open-source platform for orchestrating and automating the deployment, scaling, and management of containerized workloads across computing clusters.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.