Azure AKS baseline cluster

When to use it

This template follows the shape of Microsoft's AKS baseline reference architecture, trimmed to the parts you need to explain the design. Internet traffic enters through Application Gateway with Web Application Firewall rules and reaches the private AKS cluster through an ingress controller. Outbound traffic is forced through Azure Firewall with a user-defined route, so the cluster can only call the destinations you allow. Images come from Azure Container Registry over Private Link, and pods read secrets and certificates from Key Vault with the Secrets Store CSI driver and Entra workload identity.

The baseline is secure by default but carries a lot of moving parts and a steady monthly cost before any workload runs. It suits regulated workloads and shared platforms. For a single team or a proof of concept, Azure Container Apps gives you containers without running the cluster. Send container insights and Kubernetes audit logs to Log Analytics from the start.