Notes to Self

AKS Cluster Cluster Info The PowerShell module provides cluster details in JSON format. To gather AKS cluster info: Get-AzAksCluster -ResourceGroupName <resource-group-name> -Name <cluster-name> JSON fields currentKubernetesVersion - the version of K8s currently running kubernetesVersion - the target version of K8s AgentPoolProfiles - array of agent pool definitions Count - # of active nodes VmSize - Azure VM SKU, e.g., Standard_D16ds_v5 OsDiskType - disk type available, typically Ephemeral OsDiskSizeGB - disk size in GB OsType - Linux or Windows OsSKU - e.g., Ubuntu MaxCount, MinCount - max and min nodes in pool Mode - User or System. BP: System exclusively for K8s components EnableAutoScaling ScaleDownMode - action when scaling down, e.g., Delete Type - node types, e.g., VirtualMachineScaleSets OrchestratorVersion CurrentOrchestratorVersion NodeImageVersion - e.g., AKSUbuntu-2204gen2containerd-202604.24.0 UpgradeSettings - settings used during node pool upgrades MaxSurge - Pct increase of nodes, e.g., 25% NodeLabels - array of K8s labels NodeTaints - array of K8s taints Identity.UserAssignedIdentities - the security principals assigned to the cluster. BP: use a user-assigned Managed Identity. NOTE: AzCLI and Azure PowerShell module emit different JSON. ...

Managed Identity Managed Identity provides a secure service principal for an Azure (typically compute) resource for accessing other resources. Prefer over credential-based (e.g., user/pwd) authentication with an OAuth token flow. Entra’s OAuth 2.0 Client Credentials Grant Flow 24-hour token expiration; Azure refreshs at 12 hours Uninterrupted if Entra unavailable < 24 hours Certificate based, rather than credentials Certs valid for 90 days; Azure rotates at 45 days Types User-assigned Created and managed as a separate resource Owner responsible for deprovising May be assigned to multiple resources System-assigned Available for some Azure resources Azure manages, including deprovisioning (shares the resource’s lifecycle) Assigned to exactly 1 resource Naming: uses the same name as the resource Application Registration A global (to Azure) identification of an application. An app reg uniquely identifies an app and may also store properties, e.g., secrets, client id, certificates. App reg facilitates how the app authenticates, Roles/rights asso’d with a service principal. The app reg belongs to the Az tenant where it was registered (home tenant). The app reg may be used in other Az Tenants. App reg trusts Entra ID, but not vice-versa. Good for need to authenticate users; SSO app id across Az tenants operate outside Az

Controller Types ReplicaSet: scales application to have multiple instances of the same pod Deployment: ReplicaSet + rolling update + rollback + versioning StatefulSet: Adds Unique Identity, Persistent Network Identity, Persistent Storage DaemonSet: Runs exactly one pod per node. Includes pod scheduling, pod identity, rollback strategy.