{ "categories": [ { "name": "Architecture and Governance" }, { "name": "Identity and Access Management" }, { "name": "Governance and Security" }, { "name": "Resource Organization and Cost Governance" }, { "name": "Network Topology and Connectivity" }, { "name": "Storage" }, { "name": "Operations" }, { "name": "Lifecycle and Support" }, { "name": "Observability" }, { "name": "BC and DR" }, { "name": "Windows" }, { "name": "Application Deployment" }, { "name": "Cost and Sustainability" } ], "status": [ { "name": "Not verified", "description": "This check has not been looked at yet" }, { "name": "Open", "description": "There is an action item associated to this check" }, { "name": "Fulfilled", "description": "This check has been verified, with no further action items" }, { "name": "Not required", "description": "Recommendation understood, but not needed by current requirements" }, { "name": "N/A", "description": "Not applicable for the current design" } ], "severities": [ { "name": "High" }, { "name": "Medium" }, { "name": "Low" } ], "metadata": { "name": "Azure AKS Review", "state": "GA", "reviewed": "2026-11-05" }, "items": [ { "text": "Choose AKS only when Kubernetes fits the workload", "description": "Compare AKS with Azure Container Apps, App Service, and other managed platforms against portability, orchestration, networking, team skills, operational cost, and compliance needs. Record the decision and the workload owner before provisioning a cluster.", "guid": "1d82a4d2-05da-4235-a18f-aa5802d6c20a", "subcategory": "architecture", "category": "Architecture and Governance", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/architecture/guide/choose-azure-container-service" }, { "text": "Choose AKS Automatic or Standard deliberately", "description": "Evaluate AKS Automatic for managed production defaults and Standard for infrastructure customization. Verify feature, region, networking, Windows, and operational constraints. Validate service-managed defaults rather than assuming either mode makes applications production-ready.", "guid": "04de9192-7cbc-4f4e-ac63-15fab4aa3f23", "subcategory": "architecture", "category": "Architecture and Governance", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/intro-aks-automatic" }, { "text": "Review the platform against the AKS Well-Architected baseline", "description": "Review reliability, security, cost optimization, operational excellence, and performance efficiency using the AKS baseline architecture and Well-Architected guidance. Record design trade-offs, owners, residual risks, and evidence for each applicable control.", "guid": "5c03211e-95c6-42f1-ae3c-5a034d2e4d4b", "subcategory": "architecture", "category": "Architecture and Governance", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks/baseline-aks" }, { "text": "Document shared responsibility and operational ownership", "description": "Define ownership for cluster configuration, workload patching, identities, data protection, upgrades, monitoring, incident response, and costs. AKS manages the control plane; customers still own application resilience, workload configuration, and service dependencies.", "guid": "3cd6546a-0dee-4d90-aff7-5e4163312724", "subcategory": "architecture", "category": "Architecture and Governance", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/support-policies" }, { "text": "Use landing-zone governance and explicit environment boundaries", "description": "Place clusters in the intended management group, subscription, and network architecture. Define Azure Policy, resource naming and tags, budget ownership, data residency, and separation of production from nonproduction access and change paths.", "guid": "325d59e7-a4a8-42b1-aa05-0543ef39ff24", "subcategory": "architecture", "category": "Architecture and Governance", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks-start-here" }, { "text": "Define evidence-based review outcomes and exceptions", "description": "For each applicable check, record an owner, evidence, status, and a time-bound remediation or risk acceptance. Priorities are review guidance, not a universal risk score. Explicitly mark nonapplicable items and revisit the assessment after major changes.", "guid": "41d13d9b-98ad-4be7-af3b-2a179e378290", "subcategory": "architecture", "category": "Architecture and Governance", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/well-architected/what-is-well-architected-framework" }, { "text": "Gate preview features and verify regional availability", "description": "Prefer generally available supported features for production. Review preview terms, SLA exclusions, region and cloud availability, Kubernetes minimums, and exit plans before any approved exception. Feature names alone do not establish production support.", "guid": "92bdb43d-9279-406b-aa38-86fd8a2103ea", "subcategory": "architecture", "category": "Architecture and Governance", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/support-policies" }, { "text": "Use AKS-managed Microsoft Entra authentication", "description": "Integrate cluster sign-in with AKS-managed Microsoft Entra ID. Use group-based access, Conditional Access where applicable, and kubelogin; do not use the retired legacy Entra integration.", "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", "subcategory": "security", "category": "Identity and Access Management", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/entra-id-control-plane-authentication", "simple": 1 }, { "text": "Choose and enforce least-privilege cluster authorization", "description": "Choose Azure RBAC for Kubernetes authorization or Kubernetes RBAC with Microsoft Entra groups. Distinguish Azure management-plane roles from in-cluster data-plane permissions, avoid routine cluster-admin access, and test denied operations.", "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", "subcategory": "security", "category": "Identity and Access Management", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/kubernetes-rbac-entra-id", "simple": -1, "security": 1 }, { "text": "Pull images from ACR using the kubelet managed identity", "description": "Grant the kubelet identity AcrPull for a non-ABAC registry. For an ABAC-enabled registry, assign Container Registry Repository Reader at the appropriate scope; --attach-acr is not supported in that permissions mode. Keep the ACR admin account disabled.", "guid": "100f8f70-3ec6-44bb-ab07-95eef965e80d", "subcategory": "security", "category": "Identity and Access Management", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration" }, { "text": "Use managed identities for cluster infrastructure", "description": "Use managed identities rather than service principals for the AKS control plane and kubelet. Scope permissions separately; workloads must use their own federated identities, not inherit node permissions.", "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", "subcategory": "security", "category": "Identity and Access Management", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/managed-identity-overview", "simple": 1 }, { "text": "Limit access to admin kubeconfig (get-credentials --admin)", "description": "To limit who can get that Kubernetes configuration (kubeconfig) information and to limit the permissions they then have, you can use Azure role-based access control (Azure RBAC).", "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", "subcategory": "security", "category": "Identity and Access Management", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/control-kubeconfig-access", "simple": -1, "security": 1 }, { "text": "Use kubelogin and federated identities for automation", "description": "Use the supported kubelogin authentication flow for Microsoft Entra-integrated clusters. Prefer workload identity federation or managed identity for CI/CD instead of long-lived client secrets, and validate noninteractive access from the deployment runner.", "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", "subcategory": "identity", "category": "Identity and Access Management", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/kubelogin-authentication", "simple": -1, "security": 1 }, { "text": "Disable local accounts and test emergency access", "description": "Disable local Kubernetes accounts on Microsoft Entra-integrated clusters. Document an audited emergency-access procedure, restrict who can change the setting, and rotate previously issued cluster certificates where required.", "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", "subcategory": "identity", "category": "Identity and Access Management", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/local-accounts", "simple": -1, "security": 1 }, { "text": "Use time-bound privileged access where required", "description": "Use Microsoft Entra Privileged Identity Management for eligible group or Azure role assignments. Require approval and MFA for privileged operations, log activation, and test access expiry.", "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", "subcategory": "identity", "category": "Identity and Access Management", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/entra-id-control-plane-authentication", "simple": -1, "security": 1 }, { "text": "Pre-create a kubelet identity when role assignment requires it", "description": "Use a pre-created user-assigned kubelet identity when permissions must exist before cluster creation. Grant only the registry and infrastructure access it needs; account for role-assignment propagation delays.", "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", "subcategory": "identity", "category": "Identity and Access Management", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/managed-identity-overview", "simple": -1, "security": 1 }, { "text": "Apply Conditional Access to interactive cluster access", "description": "Evaluate Microsoft Entra Conditional Access for administrators, including MFA and device requirements. Test the chosen kubelogin flow and document separate controls for workload and automation identities.", "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", "subcategory": "identity", "category": "Identity and Access Management", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/entra-id-control-plane-authentication", "security": 1, "simple": -1 }, { "text": "Map regulated workloads to current compliance requirements", "description": "Map controls to the current regulatory standard, such as PCI DSS 4.x, and validate the AKS shared-responsibility model. Use supported FIPS-enabled images where mandated; an architecture example or Azure certification does not itself make an application compliant.", "guid": "42d4aefe-2383-470e-b019-c30df24996b2", "subcategory": "security", "category": "Governance and Security", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/pci-intro", "cost": -1, "security": 1 }, { "text": "Assess customer-managed encryption keys and their lifecycle", "description": "AKS encrypts data at rest using platform protection. If customer-managed keys are required, assess supported KMS options and Key Vault availability, permissions, purge protection, rotation, and recovery. The newer KMS data-encryption experience is documented as preview; do not treat it as a production default.\n\nDistinguish legacy etcd KMS from the newer KMS data-encryption configuration. Check Kubernetes version, regional availability, and support status before enabling either; loss of a required key can make encrypted secrets unrecoverable.", "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", "subcategory": "secrets", "category": "Governance and Security", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/kms-data-encryption-concepts", "cost": -1, "security": 1 }, { "text": "Enforce risk-based image admission controls", "description": "Scan images in CI and continuously in the registry. Enforce approved registries, digest-based releases, and risk policy through supported admission controls. Verify the support status and actual enforcement of any vulnerability-aware integration, define time-bound exceptions with owners, and do not assume that registry scanning alone blocks deployment.", "guid": "1f95a465-c682-405b-84b4-966c3a619c12", "subcategory": "security", "category": "Governance and Security", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction" }, { "text": "Integrate Key Vault using the Secrets Store CSI driver", "description": "Use the AKS Azure Key Vault provider with Microsoft Entra Workload ID. Enable rotation where required and test that applications reload mounted secrets. Environment variables do not automatically refresh; synchronizing to a Kubernetes Secret creates an additional stored copy.", "guid": "fc1e68dd-ac89-4851-8e53-8fbac3461d26", "subcategory": "security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver" }, { "text": "Monitor cloud security posture with Microsoft Defender for Cloud", "description": "Review Defender for Cloud recommendations and assign remediation owners. Connect security posture to Azure Policy and your incident workflow; distinguish posture assessment from the paid Defender for Containers runtime protection plan.", "guid": "23fda718-b80b-44c8-b2e4-d46580ab6651", "subcategory": "security", "category": "Governance and Security", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management" }, { "text": "Clean unused cached images without confusing cleanup with remediation", "description": "Evaluate AKS Image Cleaner for unused images on nodes. It does not patch images or remove vulnerable containers that are currently running: rebuild the image and redeploy affected workloads to remediate those risks.", "guid": "ca62d835-69cc-476d-bd8e-ea8fa58fab9c", "subcategory": "security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/image-cleaner" }, { "text": "Enable Microsoft Defender for Containers", "description": "Microsoft Defender for Containers provides protections for your Kubernetes clusters wherever they're running (AKS and on-premises)", "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", "subcategory": "security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction", "cost": -1, "security": 1 }, { "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", "description": "Azure Policy integrates with the Azure Kubernetes Service (AKS) to apply at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.", "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", "subcategory": "operations", "category": "Governance and Security", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes", "simple": -1, "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", "security": 1 }, { "text": "Separate system and application node pools", "description": "In AKS Standard, dedicate appropriately sized Linux system pools to critical cluster components and run applications on user pools. Use the CriticalAddonsOnly taint where appropriate and provide production redundancy. System pools are not the managed control plane.", "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", "subcategory": "compliance", "category": "Governance and Security", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/use-system-pools", "simple": -1, "cost": -1, "security": 1 }, { "text": "Migrate legacy service principals and rotate remaining credentials", "description": "Migrate cluster infrastructure to managed identities. Where a legacy service principal remains, rotate credentials before expiry under an audited policy and test the change; a fixed quarterly interval alone does not manage credential risk.", "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", "subcategory": "secrets", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/update-credentials", "security": 1 }, { "text": "Use a private registry for your images, such as ACR", "description": "Azure Container Registry allows you to build, store, and manage container images and artifacts in a private registry", "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", "subcategory": "compliance", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/container-registry/", "simple": -1, "security": 1 }, { "text": "Continuously assess cluster security configuration", "description": "Run supported CIS-aligned configuration assessments and review drift in RBAC, network exposure, admission policy, and workload permissions. Record accepted risks and remediation dates rather than treating an assessment score as proof of compliance.", "guid": "cc639637-a652-42ac-89e8-06965388e9de", "subcategory": "compliance", "category": "Governance and Security", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-security", "cost": -1, "security": 1 }, { "text": "Evaluate confidential computing for specific threat models", "description": "Evaluate the supported AKS confidential-computing options against your workload and compliance needs. Distinguish application enclaves from confidential virtual machines and confidential containers; verify SKU, region, attestation, OS, and feature support rather than assuming every container automatically runs inside an enclave.", "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", "subcategory": "compliance", "category": "Governance and Security", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-overview", "cost": -1, "security": 1 }, { "text": "Define app separation requirements (namespace/nodepool/cluster)", "description": "Plan for multi-tenant clusters and separation of resources and use logical or physical isolation in your AKS clusters", "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", "subcategory": "compliance", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-isolation", "security": 1 }, { "text": "Evaluate Dedicated Hosts only for explicit isolation requirements", "description": "Use Azure Dedicated Hosts when dedicated physical capacity is required and supported for the node configuration. Plan host capacity, failure domains, maintenance, and additional cost; this does not remove application-level security responsibilities.", "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", "subcategory": "compliance", "category": "Governance and Security", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/use-azure-dedicated-hosts", "cost": 1 }, { "text": "Enforce Pod Security Standards and least-privilege containers", "description": "Apply Pod Security Admission or equivalent Azure Policy controls. Progress from audit to enforcement; for Linux workloads prefer restricted settings, non-root users, seccomp RuntimeDefault, dropped capabilities, read-only filesystems, and no privilege escalation. Document narrowly scoped exceptions.", "guid": "8173f672-d08a-40ae-a310-90d76eb7c9cb", "subcategory": "cluster_security", "category": "Governance and Security", "severity": "High", "link": "https://kubernetes.io/docs/concepts/security/pod-security-standards/" }, { "text": "Protect node metadata and minimize node identity permissions", "description": "Minimize node managed-identity permissions and use federated workload identities. AKS IMDS restriction is documented as preview, applies to non-host-network pods, and requires assessment of support terms and compatibility. Do not assume a generic NetworkPolicy blocks all metadata or host-network access.", "guid": "11149d5d-0e1a-40f4-ae35-b921e261230e", "subcategory": "cluster_security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/imds-restriction" }, { "text": "Use logical isolation for mutually trusted tenants", "description": "Combine namespaces, scoped RBAC, resource quotas, admission policy, and network policies for trusted tenants. A namespace alone is not a security boundary and does not isolate cluster-scoped resources or a shared kernel.", "guid": "49be78dc-6ff0-4b2c-94ef-e74002e18866", "subcategory": "multi-tenancy", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-isolation" }, { "text": "Use separate clusters for incompatible trust boundaries", "description": "Choose separate clusters or subscriptions where tenants are untrusted, compliance demands stronger isolation, or lifecycle and blast-radius requirements differ. Balance operational cost against the risk of a shared control plane and nodes.", "guid": "3b77c0ee-3f84-4a86-bb46-c6dc3070168c", "subcategory": "Other", "category": "Resource Organization and Cost Governance", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-isolation" }, { "text": "Use Azure tags in Azure Kubernetes Service (AKS)", "description": "With Azure Kubernetes Service (AKS), you can set Azure tags on an AKS cluster and its related resources by using Azure Resource Manager, through the Azure CLI.", "guid": "574bd2fe-f58b-4199-b334-f7eff3ef90c8", "subcategory": "operations", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/Azure/aks/use-tags" }, { "text": "Choose Azure CNI Overlay or Pod Subnet deliberately", "description": "Prefer Azure CNI Overlay for efficient address use, or Azure CNI Pod Subnet when directly routable pod addresses are required. Validate OS and policy-engine compatibility. Kubenet is a legacy model retiring on 31 March 2028; do not select it for new deployments.", "guid": "a0f61565-9de5-458f-a372-49c831112dbd", "subcategory": "network", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-network-cni-overview", "simple": 1 }, { "text": "Plan node and pod address capacity including upgrade surge", "description": "Size address space for the actual network model, maximum nodes, maxPods, scale-out, and concurrent surge upgrades. Overlay separates pod and node address space; flat networking consumes VNet pod addresses. Include private endpoints, load balancers, peering, and future growth.", "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", "subcategory": "network", "category": "Network Topology and Connectivity", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-network-ip-address-planning", "scale": 1 }, { "text": "Choose supported L7 ingress and plan Gateway API migration", "description": "Use a supported ingress or Gateway API implementation for HTTP routing, TLS, and policy. Upstream Ingress NGINX maintenance ended in March 2026; AKS application routing NGINX critical-security-patch support runs through November 2026. Evaluate application routing Gateway API, Application Gateway for Containers, or Istio ingress against feature and support requirements.", "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", "subcategory": "network", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-network-ingress", "scale": 1, "simple": -1 }, { "text": "Protect internet-facing HTTP applications with an appropriate WAF", "description": "Choose a supported WAF architecture, such as Azure Front Door Premium or Application Gateway WAF, when required by the threat model. Tune managed rules, restrict origin access, validate TLS and health probes, and test that the origin cannot bypass the WAF.", "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", "subcategory": "network", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/web-application-firewall/overview", "simple": -1, "cost": -1, "security": 2 }, { "text": "Restrict ingress hostnames and Gateway API delegation", "description": "Constrain approved hostnames, cross-namespace references, and who can attach routes to shared gateways. Use admission controls and Gateway API allowedRoutes/ReferenceGrant rules as appropriate; test that tenants cannot claim another application hostname.", "guid": "e5684a8b-f072-43d2-83b2-234ad48f57c7", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Low", "link": "https://gateway-api.sigs.k8s.io/docs/concepts/security/" }, { "text": "Expose only the load balancers that need public access", "description": "Use internal load balancers for private services and public endpoints only for intentional internet-facing applications. An internal load balancer still needs authentication, network controls, DNS, and a tested access path.", "guid": "c0179fd4-470b-43c8-b7bb-80307051bc96", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/internal-lb" }, { "text": "Enforce pod network policy using a supported engine", "description": "Apply and test ingress and egress policies with explicit DNS and dependency allowances. Azure CNI Powered by Cilium is recommended for supported Linux configurations; validate Windows support separately. A configured policy engine without effective policies does not isolate workloads.", "guid": "0751f099-e6f4-4250-b405-d2b26c707432", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/use-network-policies", "security": 1 }, { "text": "Configure default network policies in each namespace", "description": "Start by creating a deny all policy in each namespace and then add specific policies.", "guid": "0bc4e0c6-97fd-411a-9eb4-1a1f85f9cdf0", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://github.com/ahmetb/kubernetes-network-policy-recipes" }, { "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it (egress lockdown)", "description": "Use Azure Firewall to secure and control all egress traffic going outside of the cluster.", "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/limit-egress-traffic", "simple": -2, "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", "security": 2 }, { "text": "Don't expose your container registry on Internet", "description": "When possible, use private link to only allow private network to reach your registry.", "guid": "e38f1680-8ddc-4c93-bf09-6b932a4935ca", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-endpoints" }, { "text": "Test workload access to metadata and host-network services", "description": "Explicitly test access to 169.254.169.254 and host-network workloads from ordinary application pods. Network policy behavior depends on the data plane and host-network semantics. AKS IMDS restriction is documented as preview and does not restrict host-network pods; assess support terms before adoption and minimize node identity permissions.", "guid": "4fb072a7-0303-46d8-9ecf-d8aa4d69ff83", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/imds-restriction" }, { "text": "Use private clusters if your requirements mandate it", "description": "In a private cluster, the control plane or API server has internal IP addresses and is not exposed to Internet\n\nPlan private DNS and an approved network path for administrators and deployment runners, such as a connected management host, VPN, or ExpressRoute. Azure Bastion provides access to a management VM rather than acting as a direct Kubernetes API proxy. Review command invoke permissions separately because that management-plane path can reach a private cluster without direct client network connectivity.", "guid": "29fb411c-20a8-4c39-84df-aaa4227eaeb2", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/private-clusters" }, { "text": "Choose global routing based on protocol and failover requirements", "description": "Use Azure Front Door for global HTTP(S) edge routing and WAF integration, or Traffic Manager for DNS-based routing of supported endpoints. Configure health checks, TLS, DNS TTLs, origin restrictions, and failover tests; neither service automatically replicates application state.", "guid": "5d0bb60d-b8e0-4031-9c5b-1f0a735f771f", "subcategory": "network", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/reliability-multi-region-deployment-models" }, { "text": "Set maxPods explicitly for the chosen networking model", "description": "Check the default and supported maximum pod density for the actual OS, network model, VM size, and provisioning method. Do not assume a universal default of 30. Account for DaemonSets, system reservations, IP capacity, and storage attachment limits.", "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", "subcategory": "IPAM", "category": "Network Topology and Connectivity", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-network-ip-address-planning", "scale": 1, "simple": -1 }, { "text": "If using a public API endpoint, restrict the IP addresses that can access it", "description": "To improve the security of your clusters and minimize the risk of attacks, we recommend limiting the IP address ranges that can access the API server.", "guid": "d783a3e8-264f-4dac-870f-569791d1837e", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges" }, { "text": "Choose and monitor an explicit outbound connectivity design", "description": "Choose a supported outboundType such as NAT gateway, load balancer, or user-defined routing based on throughput and inspection requirements. Size SNAT capacity and allow AKS dependencies. NAT Gateway is not a firewall; private clusters still need an explicit egress plan.", "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", "subcategory": "scalability", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/egress-outboundtype", "scale": 1, "simple": -1 }, { "text": "Evaluate Pod Subnet allocation when flat pod routing is needed", "description": "For VNet-routable pod IPs, evaluate Azure CNI Pod Subnet dynamic or static block allocation against supported features and scale limits. Plan separate node and pod subnet capacity; use Overlay when direct pod reachability is not required.", "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", "subcategory": "scalability", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-network-azure-cni-pod-subnet", "scale": 1, "simple": -1 }, { "text": "Use private endpoints or service endpoints where appropriate", "description": "For PaaS dependencies, select private endpoints or supported service endpoints based on service capability and trust boundaries. Configure private DNS and public-access restrictions explicitly; a private AKS API endpoint does not make workload dependencies private.", "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/private-link/private-link-overview", "simple": -1, "security": 1 }, { "text": "Adopt a service mesh only for explicit application requirements", "description": "Evaluate a supported mesh, such as the AKS Istio add-on, when service identity, mutual TLS, traffic policy, or detailed telemetry justify its operational cost. Validate supported revisions, upgrades, resource overhead, and failure behavior; a mesh is not a prerequisite for every microservice application.", "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/servicemesh-about", "simple": -2, "security": 1 }, { "text": "Use a bring-your-own CNI only with clear support ownership", "description": "Use bring-your-own CNI only when its capabilities are necessary and the team can operate and support it. Review AKS support boundaries, Kubernetes and OS compatibility, IPAM, policy enforcement, upgrades, and recovery; Azure does not operate a third-party CNI on your behalf.", "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", "subcategory": "operations", "category": "Network Topology and Connectivity", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/use-byo-cni", "simple": -2, "security": 1 }, { "text": "Use per-node-pool subnets when the network design requires them", "description": "Evaluate separate node-pool subnets for address-space organization, routing, or security requirements. Validate support for the selected Azure CNI mode and subnet delegation, private DNS, and policy behavior; subnet separation alone is not tenant isolation.", "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/create-node-pools", "simple": -2, "security": 1 }, { "text": "Reserve nonoverlapping service, pod, node, and connected-network ranges", "description": "Validate service, pod, node-subnet, peered-VNet, VPN, and on-premises address ranges before deployment. Apply the rules of the selected network model, including Overlay routing and masquerading behavior, and test reachability to all dependencies. Address conflicts can make destinations unreachable.", "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6c", "subcategory": "security", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/configure-azure-cni", "simple": -2, "security": 1 }, { "text": "Validate DNS resolution and private-zone ownership", "description": "Test cluster DNS, upstream DNS, private endpoints, and cross-network name resolution from pods and deployment runners. Monitor DNS latency and failures, scale CoreDNS when needed, and evaluate LocalDNS only against current feature availability and workload requirements.", "guid": "4dc325aa-f8a9-49a1-a6a5-896edbeb746c", "subcategory": "networking", "category": "Network Topology and Connectivity", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/dns-concepts" }, { "text": "Evaluate Azure CNI Powered by Cilium for Linux data planes", "description": "Use the supported managed Cilium data plane for compatible Linux workloads. Validate NetworkPolicy behavior and migration constraints; advanced L7, FQDN, and observability features can require Advanced Container Networking Services and additional cost.", "guid": "e0ab94dd-554a-40d2-a60d-7500cbc5e4aa", "subcategory": "networking", "category": "Network Topology and Connectivity", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/azure-cni-powered-by-cilium" }, { "text": "Manage TLS certificate issuance and renewal", "description": "Inventory external and internal certificates, automate issuance and renewal through a supported integration, and alert before expiry. Validate trust chains, TLS policy, secret rotation, and application reload behavior without relying on manual certificate replacement.", "guid": "f84777e4-a928-472d-a839-fdc64d4cc6c8", "subcategory": "networking", "category": "Network Topology and Connectivity", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/app-routing" }, { "text": "Choose storage by durability, access mode, and performance", "description": "Choose Azure Disk, Azure Files, object storage, or an external data service based on latency, throughput, IOPS, concurrent access, consistency, backup, and recovery requirements. Validate the selected CSI driver and storage tier under realistic load.", "guid": "4c20c4bd-a7e3-449f-9597-4939a3aeafe7", "subcategory": "storage", "category": "Storage", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-storage" }, { "text": "Size the nodes for storage needs", "description": "Each node size supports a maximum number of disks. Different node sizes also provide different amounts of local storage and network bandwidth. Plan for your application demands to deploy the appropriate size of nodes.\n\nDifferent types and sizes of nodes are available. Each node (underlying VM) size provides a different amount of core resources such as CPU and memory. These VM sizes have a maximum number of disks that can be attached. Storage performance also varies between VM sizes for the maximum local and attached disk IOPS (input/output operations per second). If your applications require Azure Disks as their storage solution, plan for and choose an appropriate node VM size. The amount of CPU and memory isn't the only factor when you choose a VM size. The storage capabilities are also important.", "guid": "18707174-fa23-4935-b463-8f9982629b35", "subcategory": "storage", "category": "Storage", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-storage" }, { "text": "Use CSI storage classes with deliberate reclaim policies", "description": "Use supported CSI drivers and dynamic provisioning where appropriate. Set access modes, expansion, binding mode, encryption, and Delete versus Retain reclaim policy deliberately; deleting a PVC can delete the underlying volume under a Delete policy.", "guid": "77bda7ce-1fcf-4735-bd3d-1b3a83a9e484", "subcategory": "storage", "category": "Storage", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/csi-storage-drivers" }, { "text": "Back up persistent application data with a supported solution", "description": "Use Azure Backup for AKS or another supported, workload-aware backup solution. Confirm supported volume types, access modes, region, retention, and restore paths. Azure Site Recovery is not a general AKS cluster backup solution; snapshots alone may not be application-consistent.", "guid": "13d493b9-2cdc-4632-b188-6882b81da0ed", "subcategory": "storage", "category": "Storage", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/backup/azure-kubernetes-service-cluster-backup-concept" }, { "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", "description": "Where possible, don't store service state inside the container. Instead, use an Azure platform as a service (PaaS) that supports multiregion replication.\n\nService state refers to the in-memory or on-disk data that a service requires to function. State includes the data structures and member variables that the service reads and writes. Depending on how the service is architected, the state might also include files or other resources that are stored on the disk. For example, the state might include the files a database uses to store data and transaction logs.", "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", "subcategory": "storage", "category": "Storage", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/reliability-multi-region-deployment-models", "simple": -1, "ha": 1 }, { "text": "Use ephemeral OS disks only for disposable node state", "description": "Evaluate ephemeral OS disks for supported VM sizes and node-image requirements. Local OS-disk data is disposable across reimage or node replacement; keep durable workload data on persistent storage or external services and validate capacity for images and logs.", "guid": "24367b33-6971-45b1-952b-eee0b9b588de", "subcategory": "storage", "category": "Storage", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-storage", "scale": 1, "cost": -1 }, { "text": "For hyper performance storage option use Ultra Disks on AKS", "description": "Azure ultra disks offer high throughput, high IOPS, and consistent low latency disk storage for your stateful applications.\n\nOne major benefit of ultra disks is the ability to dynamically change the performance of the SSD along with your workloads without the need to restart your agent nodes. Ultra disks are suited for data-intensive workloads.", "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", "subcategory": "storage", "category": "Storage", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/use-ultra-disks", "scale": 1, "cost": -1 }, { "text": "Align persistent volumes with availability-zone placement", "description": "Use WaitForFirstConsumer where appropriate so volume provisioning follows scheduling constraints. LRS disks are zonal; evaluate supported ZRS disks for cross-zone attachment requirements. Test failover and attach times, because a replicated disk alone does not guarantee application availability.", "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", "subcategory": "storage", "category": "Storage", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/create-volume-azure-disk", "simple": -1, "ha": 1 }, { "text": "Plan managed OS disk capacity and performance", "description": "Size managed OS disks and node storage for image layers, writable layers, temporary files, and logs. Monitor disk pressure and log rotation. Larger disk size alone is not a universal performance fix; validate the selected disk tier and VM I/O limits.", "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32", "subcategory": "storage", "category": "Storage", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/reliability/availability-zones-service-support", "cost": -1, "scale": 1 }, { "text": "Migrate deprecated in-tree storage drivers to CSI", "description": "Inventory PVs, StorageClasses, and automation for in-tree Azure Disk and Azure File provisioners. Use supported CSI drivers, test snapshots and restores, and review migration behavior before a Kubernetes upgrade.", "guid": "44ecd675-d50c-4c7f-a635-6c50ddbc344e", "subcategory": "storage", "category": "Storage", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/csi-storage-drivers" }, { "text": "Evaluate virtual nodes only for compatible burst workloads", "description": "Virtual nodes use Azure Container Instances and have different networking, identity, storage, OS, and feature constraints from regular AKS nodes. Verify the current support matrix, cold-start behavior, regional quota, and cost before adopting this burst path.", "guid": "c88681ab-bb2b-46d1-9ea6-72564b75429a", "subcategory": "operations", "category": "Resource Organization and Cost Governance", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-scale" }, { "text": "Size nodes against measured workload and failure capacity", "description": "Choose node sizes and counts using CPU, memory, pod density, network throughput, storage limits, and failure-domain needs. Reserve capacity for system components and upgrades, and benchmark cost and latency rather than optimizing only VM price.", "guid": "7f8b07c5-882b-45ba-9ec9-bcc29b4721ff", "subcategory": "resources", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://learnkube.com/kubernetes-node-size" }, { "text": "Evaluate Arm64 with workload and add-on compatibility tests", "description": "Benchmark supported Arm64 VM sizes for price/performance. Publish multi-architecture images and verify every sidecar, DaemonSet, driver, and security agent supports the target architecture before scheduling workloads there.", "guid": "2a5f0cab-92b2-46dc-81a6-d358f7fd062a", "subcategory": "operations", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/use-arm64-vms" }, { "text": "Enforce resource quotas for namespaces", "description": "Plan and apply resource quotas at the namespace level. If pods don't define resource requests and limits, reject the deployment. Monitor resource usage and adjust quotas as needed.\n\nResource requests and limits are placed in the pod specification. These limits are used by the Kubernetes scheduler at deployment time to find an available node in the cluster. But developers can forget them and thus impact other applications by over-consuming resources of the cluster", "guid": "769ef669-1a48-435a-a942-223ece80b123", "subcategory": "resiliency", "category": "Resource Organization and Cost Governance", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-scheduler", "simple": -1, "ha": 1 }, { "text": "Namespaces should have LimitRange", "description": "A LimitRange is a policy to constrain resource allocations (to Pods or Containers) in a namespace. It's useful to ensure that pods don't forget to declare request limits", "guid": "b74ea93b-598d-48e0-bb26-762b015602e1", "subcategory": "resiliency", "category": "Resource Organization and Cost Governance", "severity": "Low", "link": "https://kubernetes.io/docs/concepts/policy/limit-range/" }, { "text": "Set measured resource requests and deliberate limits", "description": "Set CPU and memory requests based on observed demand; requests drive scheduling and autoscaling. Set memory limits to bound risk and choose CPU limits deliberately because throttling can increase latency. Limits do not prevent memory leaks, and containers exceeding memory limits can be OOM-killed.", "guid": "4868aa30-95a9-49fd-867e-57e70cb0d1d5", "subcategory": "resiliency", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" }, { "text": "Define disruption budgets that permit safe maintenance", "description": "Use policy/v1 PodDisruptionBudgets for replicated workloads and ensure replicas can satisfy them during drains and upgrades. PDBs constrain voluntary evictions, not node failures or every rollout; overly strict budgets can block upgrades and scale-down.", "guid": "3c763963-7a55-42d5-a15e-401955387e5c", "subcategory": "resiliency", "category": "Resource Organization and Cost Governance", "severity": "Low", "link": "https://kubernetes.io/docs/tasks/run-application/configure-pdb/", "ha": 1, "cost": -1 }, { "text": "Use supported tooling for workload cost allocation", "description": "Use AKS cost analysis, OpenCost, or an appropriately operated cost-allocation tool to attribute spend to teams and workloads. Account for shared capacity, storage, networking, and monitoring costs; validate labels and allocation assumptions.", "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", "subcategory": "cost", "category": "Resource Organization and Cost Governance", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/cost-analysis", "cost": 1 }, { "text": "When required use multi-instance partitioning GPU on AKS Clusters", "description": "Nvidia's A100 GPU can be divided in up to seven independent instances. Each instance has their own memory and Stream Multiprocessor (SM).", "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", "subcategory": "cost", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/gpu-multi-instance", "cost": 1 }, { "text": "If running a Dev/Test cluster use NodePool Start/Stop", "description": "Your AKS workloads may not need to run continuously, for example a development cluster that has node pools running specific workloads.", "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", "subcategory": "cost", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/start-stop-nodepools", "cost": 1 }, { "text": "Use node pool snapshots for configuration reuse, not data backup", "description": "Node pool snapshots capture supported node pool configuration for reuse. They do not back up application data, Kubernetes resources, or an entire cluster; ensure the referenced Kubernetes version and image remain supported.", "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", "subcategory": "cost", "category": "Resource Organization and Cost Governance", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/node-pool-snapshot", "cost": 1 }, { "text": "Ensure your subscription has enough quota to scale out your nodepools", "description": "Azure VMs/nodes have quotas per subscription. Ensure that you have planned for these quota and proactively prepare to request for more if needed", "guid": "081a5417-4158-433e-a3ad-3c2de733165c", "subcategory": "scalability", "category": "Resource Organization and Cost Governance", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits", "cost": 1 }, { "text": "Use scale down mode to delete/deallocate nodes", "description": "Scale-down Mode allows you to decide whether you would like to delete or deallocate the nodes in your Azure Kubernetes Service (AKS) cluster upon scaling down.", "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", "subcategory": "cost", "category": "Resource Organization and Cost Governance", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/scale-down-mode", "cost": 1 }, { "text": "Choose cluster autoscaler or node auto-provisioning intentionally", "description": "Evaluate node auto-provisioning for supported workloads and regions, or configure the cluster autoscaler for explicit node pools. Respect coexistence restrictions, quota, disruption settings, consolidation behavior, and capacity limits; do not enable competing node scalers blindly.", "guid": "2a9ed86e-ae0d-4d2a-a9c0-00c67234a90d", "subcategory": "resource_management", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/node-auto-provisioning" }, { "text": "Coordinate HPA, VPA, and KEDA scaling signals", "description": "Set realistic requests, min/max replicas, stabilization windows, and metric availability. Avoid competing controllers for the same resource signal. Use VPA recommendations or supported update modes deliberately and load-test burst and scale-to-zero behavior.", "guid": "5023e67c-81ec-45d2-a79c-04b4248b980b", "subcategory": "resource_management", "category": "Resource Organization and Cost Governance", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/keda-about" }, { "text": "Use proximity placement only for measured latency requirements", "description": "Benchmark before using proximity placement groups. Review compatibility with availability zones, capacity, and node-pool constraints; tighter placement can reduce placement flexibility and resilience. Do not trade away failure-domain separation without a documented reason.", "guid": "17bd8ae4-8ee7-472d-bca5-c7e3cc9b6d82", "subcategory": "operations", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/reduce-latency-ppg" }, { "text": "Govern cluster extensions and managed add-ons", "description": "Inventory installed extensions and add-ons, their supported Kubernetes versions, permissions, upgrade policies, costs, and operational owners. Remove unused components and validate lifecycle compatibility before upgrades.", "guid": "4cd9bd7a-fe6f-427b-b5dd-9ab2f50aa663", "subcategory": "operations", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/cluster-extensions", "ha": 1, "cost": -1 }, { "text": "Choose a governed node resource group name at creation", "description": "Set a node resource group name if required by naming policy, and document AKS ownership. Its name is not a security control; protect access and avoid manually modifying AKS-managed infrastructure.", "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", "subcategory": "operations", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/node-resource-group-lockdown", "simple": 1, "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant" }, { "text": "Use approved private paths for node troubleshooting", "description": "Keep node SSH/RDP endpoints off the public internet. Use supported AKS debug access or approved private management connectivity with time-bound permissions, audit logs, and incident ownership. Do not expose nodes merely to make troubleshooting easier.", "guid": "28538587-2c1f-4390-b571-384649732c16", "subcategory": "security", "category": "Operations", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-network" }, { "text": "Run supported diagnostics and configuration checks", "description": "Use AKS diagnostics, Azure Monitor, and maintained troubleshooting tools. Validate tool provenance and permissions before execution. Use policy and manifest validation to detect missing requests and limits; do not install an unmaintained scanner as a production prerequisite.", "guid": "4dd8b544-5b8b-443d-8e76-cea80d9dec30", "subcategory": "operations", "category": "Operations", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/aks-diagnostics" }, { "text": "Enable cluster autoscaling", "description": "To keep up with application demands in Azure Kubernetes Service (AKS), you may need to adjust the number of nodes that run your workloads. The cluster autoscaler component can watch for pods in your cluster that can't be scheduled because of resource constraints.\n\nYou can enable autoscaling module per node pool but only create one mutual autoscale profile", "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", "subcategory": "resources", "category": "Operations", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/cluster-autoscaler", "ha": 1, "cost": -1 }, { "text": "Use GitOps to deploy workloads in your cluster", "description": "GitOps works by using Git as a single source of truth for declarative infrastructure and applications\n\nOn Azure you can for instance use Azure Arc for Kubernetes but also directly GitOps addon for AKS", "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", "subcategory": "operations", "category": "Operations", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/tutorial-use-gitops-flux2" }, { "text": "Implement CI/CD to deploy workloads in your cluster", "description": "Instead of GitOps (or in addition) you can use CI/CD to deploy workloads/tools in your cluster", "guid": "cd943950-e336-4906-a719-d2128c8d78e4", "subcategory": "operations", "category": "Operations", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/automated-deployments" }, { "text": "Improve efficiency with K8S Tools", "description": "The Kubernetes ecosystem is strengthened by many tools that make operating it easier. Here's a few", "guid": "fd926057-60e1-4d6c-afc2-0f03b5ab3763", "subcategory": "operations", "category": "Operations", "severity": "Medium", "link": "https://github.com/MuhammedKalkan/OpenLens" }, { "text": "Don't use the default namespace", "description": "It's recommended to keep all applications in a namespace other than default", "guid": "13bb9e32-6f48-4747-9531-0147f20f4b03", "subcategory": "operations", "category": "Operations", "severity": "Medium", "link": "https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/" }, { "text": "Apply different types of labels to all resources", "description": "A common set of labels allows tools to work interoperably, describing objects in a common manner that all tools can understand. For instance, resources should have technical, business and security labels.", "guid": "13bb9e32-6f48-4747-9531-0147f20f4b04", "subcategory": "multi-tenancy", "category": "Operations", "severity": "Low", "link": "https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/" }, { "text": "Fine tune your node configuration", "description": "Customizing your node configuration allows you to configure or tune your operating system (OS) settings, node pools or the kubelet parameters to match the needs of the workloads.\n\nWhen you create an AKS cluster or add a node pool to your cluster, you can customize a subset of commonly used OS and kubelet settings.", "guid": "831c2872-c693-4b39-a887-a561bada49bc", "subcategory": "Other", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/custom-node-configuration", "cost": -1, "ha": 1, "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant" }, { "text": "Restrict command invoke on private clusters", "description": "AKS command invoke runs through the Azure management API and can reach a private cluster without direct network connectivity. Restrict its Azure RBAC actions, audit use, and disable it when policy requires all administration through approved private paths.", "guid": "d7672c26-7602-4482-85a4-14527fbe855c", "subcategory": "compliance", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/access-private-cluster" }, { "text": "Consider an appropriate node size, not too large or too small", "description": "Optimizing node size can lead to lots of benefits including cost optimization, optimized performance and proper resource allocation", "guid": "495e0503-5fbd-4ba7-8c33-2551b1676d1e", "subcategory": "cost", "category": "Operations", "severity": "High", "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", "cost": 1 }, { "text": "Regularly check Azure Advisor for recommendations on your cluster", "description": "Azure advisor can enhance environment monitoring and can help improve the operations of your cluster by reducing costs, etc", "guid": "337453a3-cc63-4963-9a65-22ac19e80696", "subcategory": "compliance", "category": "Operations", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/advisor/advisor-get-started", "simple": -1, "ha": 1 }, { "text": "Write manifests following good practices using dedicated tools", "description": "There are various tools that can make creating k8s manifest files much easier and can help with operational efficiency", "guid": "b78f2dec-d75e-44c3-937a-7509fd7a54f1", "subcategory": "operations", "category": "Operations", "severity": "Low", "link": "https://helm.sh/docs/chart_best_practices/" }, { "text": "Monitor cluster certificates and verify supported rotation", "description": "Understand AKS-managed certificate rotation and monitor cluster health and certificate expiry. Use the documented certificate rotation procedure when necessary and assess its disruption. Workload ingress certificates need a separate renewal process.", "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", "subcategory": "security", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/certificate-rotation", "simple": 1 }, { "text": "Test operational constraints before using virtual nodes", "description": "If using ACI-backed virtual nodes, validate monitoring, security policy, service connectivity, storage, scheduling, and application recovery end to end. Do not assume virtual nodes are equivalent to ordinary VM-backed node pools.", "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", "subcategory": "scalability", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/virtual-nodes", "scale": 1, "simple": -1, "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant" }, { "text": "Consider spot node pools for non time-sensitive workloads", "description": "Spot nodepools can help with cost management", "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", "subcategory": "cost", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/spot-node-pool" }, { "text": "Consider subscribing to EventGrid Events for AKS automation", "description": "AKS emits certain events that enable it to subscribe to EventGrid which can be used for automation", "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", "subcategory": "monitoring", "category": "Operations", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/event-grid/event-schema-aks", "cost": 1 }, { "text": "Protect the AKS-managed node resource group", "description": "Manage nodes through supported AKS APIs and infrastructure as code, not by manually editing VM scale sets, load balancers, or networking in the node resource group. Evaluate node resource group lockdown and restrict unnecessary write access.", "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", "subcategory": "monitoring", "category": "Operations", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/node-resource-group-lockdown", "security": 1 }, { "text": "Prepare a least-privilege incident troubleshooting workflow", "description": "Document diagnostics, ephemeral debug containers, log access, escalation contacts, and time-bound privileged access. Use approved images and audit actions; do not permanently install privileged debugging toolboxes across production nodes.", "guid": "f1d2d2f4-53a2-5f1b-9d1a-3a907b6844a5", "subcategory": "monitoring", "category": "Operations", "severity": "High", "link": "https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/", "security": 1 }, { "text": "Test upgrade surge, drain timeouts, and rollback procedures", "description": "Before upgrading, validate regional VM quota, subnet IP space, maxSurge, PDBs, drain timeout, soak time, and deprecated APIs. Rehearse workload rollback or cluster replacement; Kubernetes control-plane downgrades are not a supported rollback strategy.", "guid": "65578c52-d01d-4017-adc5-f940d5a6659e", "subcategory": "operations", "category": "Operations", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/upgrade-options" }, { "text": "Use supported declarative APIs and validate infrastructure drift", "description": "Pin supported resource-provider API versions and provider/module versions. Review plan or what-if output, apply changes through code review, and detect drift. Use deployment identities scoped to the environment rather than persistent cluster-admin credentials.", "guid": "40e1aeb1-9b5a-41ac-a9e3-1a457fe9bd74", "subcategory": "operations", "category": "Operations", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/devops/pipelines/architectures/devops-pipelines-baseline-architecture?view=azure-devops" }, { "text": "Use a supported and workload-compatible node operating system", "description": "Select a supported Ubuntu or Azure Linux release after testing drivers, agents, and application dependencies. Azure Linux 2.0 support ended on 30 November 2025 and its node images were removed starting 31 March 2026; migrate to Azure Linux 3.0 or another supported OS.", "guid": "d34f49c0-e964-4465-9211-520479338b13", "subcategory": "operations", "category": "Lifecycle and Support", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/azure-linux/aks-support-cycle" }, { "text": "Keep Kubernetes within its supported lifecycle", "description": "Track the AKS release calendar and the versions available in each deployment region with az aks get-versions. Standard support follows the supported minor-version window; eligible LTS versions require the Premium tier. Platform support is reduced support, not a substitute for an upgrade plan.", "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", "subcategory": "security", "category": "Lifecycle and Support", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/supported-kubernetes-versions", "simple": -1, "security": 1 }, { "text": "Configure node OS upgrades separately from Kubernetes upgrades", "description": "Choose a supported node OS upgrade channel, such as NodeImage, and test it with a dedicated maintenance window. Node OS upgrades and cluster version upgrades are separate controls. Track image rollout availability, disruption budgets, surge capacity, and completion.", "guid": "945889a8-a9e9-4059-b1aa-0a0df2b8a82c", "subcategory": "security", "category": "Lifecycle and Support", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/auto-upgrade-node-os-image" }, { "text": "Configure automatic Kubernetes upgrades and maintenance windows", "description": "Select a supported cluster auto-upgrade channel and planned maintenance windows with enough duration. Validate application compatibility in lower environments first. Maintenance windows are not an absolute guarantee that every emergency platform action is deferred.", "guid": "01deb8ed-b6f5-40bb-8d0b-d0ee2d933f51", "subcategory": "operations", "category": "Lifecycle and Support", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/auto-upgrade-cluster" }, { "text": "Evaluate Premium tier and LTS against the actual release calendar", "description": "Use AKS Premium tier with the AKSLongTermSupport plan for eligible versions when extended support is required. Check the published support end date and OS/add-on compatibility; LTS does not extend an independently retired node OS or remove the need for patches and upgrades.", "guid": "96516e10-4664-421a-992d-1271c29743ea", "subcategory": "operations", "category": "Lifecycle and Support", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/long-term-support", "simple": 1, "cost": -1 }, { "text": "Replace retired pod-managed identity with Workload ID", "description": "The open-source pod-managed identity project was deprecated in 2022 and archived in 2023; AKS managed add-on patch support ended in September 2025. Migrate applications and SDKs to Microsoft Entra Workload ID, test token refresh, then remove obsolete identity bindings and components.", "guid": "8369d531-bbb9-4c6d-ab7d-4e123df60b7b", "subcategory": "lifecycle", "category": "Lifecycle and Support", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/workload-identity-migrate-from-pod-identity" }, { "text": "Upgrade retired Basic Load Balancer and Availability Sets", "description": "AKS support for Basic Load Balancer and Availability Sets ended on 30 September 2025. Follow the documented migration paths to Standard Load Balancer and supported node-pool infrastructure; validate public IPs, DNS, routes, downtime, and recovery.", "guid": "a4e83003-a65d-4b13-a791-55fedd67477b", "subcategory": "lifecycle", "category": "Lifecycle and Support", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/upgrade-basic-load-balancer-on-aks" }, { "text": "Migrate kubenet before its retirement", "description": "AKS kubenet retirement is scheduled for 31 March 2028. Inventory affected clusters, validate the supported migration path to Azure CNI Overlay, and rehearse changes to pod addressing, network policies, routes, and external dependencies.", "guid": "a61d6c4d-e634-4e13-afaa-aa3e04c706f1", "subcategory": "lifecycle", "category": "Lifecycle and Support", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/concepts-network-legacy-cni" }, { "text": "Complete the Ingress NGINX migration before support ends", "description": "Upstream Ingress NGINX maintenance ended in March 2026, and AKS application routing NGINX critical-security-patch support runs through November 2026. Test a supported Gateway API replacement in parallel, translate annotations and policy, validate TLS and traffic behavior, and plan DNS cutover and rollback.", "guid": "8bd95d4e-46d5-4424-a7fe-c43f2ab7933f", "subcategory": "lifecycle", "category": "Lifecycle and Support", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/app-routing-nginx-to-gateway-api-migration" }, { "text": "Track release notes and future platform-initiated upgrades", "description": "Subscribe to AKS releases, retirement notices, Service Health, and the regional release tracker. Microsoft documents platform-initiated upgrades beginning 1 June 2027 after the unsupported-version grace period; these do not follow your maintenance window. Keep clusters supported rather than relying on that safeguard.", "guid": "d9565666-bd2a-481d-ac65-2aec1281e628", "subcategory": "lifecycle", "category": "Lifecycle and Support", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/supported-kubernetes-versions" }, { "text": "Collect and govern workload logs", "description": "Enable Container insights or a supported log platform with an explicit data collection rule. Define namespace filters, sensitive-data handling, retention, access control, and a cost budget. Confirm that logs are queryable during node and application failure.", "guid": "90640e42-ce36-4c2a-b20a-bee9c572df6c", "subcategory": "monitoring", "category": "Observability", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-monitoring-overview" }, { "text": "Collect Prometheus metrics with a supported monitoring stack", "description": "Use Azure Monitor managed service for Prometheus or an operated Prometheus deployment. Configure scraping, recording and alerting rules, cardinality limits, retention, and Grafana dashboards. Container log collection is separate from Prometheus metric ingestion.", "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", "subcategory": "monitoring", "category": "Observability", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/prometheus-metrics-overview", "simple": -1, "ha": 1 }, { "text": "Define a distributed tracing strategy", "description": "Choose propagation standards, instrumentation ownership, sampling, retention, and sensitive-data controls for distributed traces. Verify that representative requests can be correlated across services and dependencies before relying on tracing in an incident.", "guid": "8d33b2b2-e043-4c61-aa5d-319a8eb6c382", "subcategory": "monitoring", "category": "Observability", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview" }, { "text": "Monitor CPU and memory utilization of the nodes", "description": "With Container insights, you can use the performance charts and health status to monitor the workload of Kubernetes clusters hosted on AKS", "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", "subcategory": "monitoring", "category": "Observability", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-analyze", "simple": -1, "ha": 1 }, { "text": "Enable control-plane diagnostic and audit logs", "description": "Configure AKS diagnostic settings for the required control-plane and audit categories. Choose audit versus audit-admin deliberately, route logs to an approved destination, and validate access, retention, query availability, and collection costs.", "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", "subcategory": "monitoring", "category": "Observability", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/monitor-aks-reference", "ha": 1, "cost": -1 }, { "text": "Query workload logs through a governed log platform", "description": "Provide documented queries and dashboards for application failures, restarts, and dependency issues. Use supported Container insights or another operated platform, define retention and access controls, and verify diagnostic data is available during an incident.", "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", "subcategory": "monitoring", "category": "Observability", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-monitoring-overview" }, { "text": "Use ContainerLogV2 and supported Azure Monitor agents", "description": "Migrate legacy ContainerLog collection and the retired Log Analytics agent to supported Container insights collection using Azure Monitor Agent and ContainerLogV2. Validate queries, alerts, data collection rules, multiline logging, retention, and ingestion costs.", "guid": "62f89719-db42-4cd0-824f-82ac7d62d9ac", "subcategory": "monitoring", "category": "Observability", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-logs-schema" }, { "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", "description": "Alerts can provide early warnings of issues, etc in your cluster", "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", "subcategory": "monitoring", "category": "Observability", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-metric-alerts", "simple": -1, "ha": 1 }, { "text": "Monitor outbound SNAT capacity and connection failures", "description": "Monitor SNAT utilization, dropped connections, and outbound failure rates for the actual egress path. Tune connection reuse, idle timeouts, outbound IPs, and NAT gateway capacity; SNAT monitoring is primarily an availability and capacity control, not a replacement for egress filtering.", "guid": "95951d87-1a2f-4a45-833c-2fc62d23c44d", "subcategory": "monitoring", "category": "Observability", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard" }, { "text": "Subscribe to resource health notifications for your AKS cluster", "description": "Learn how to troubleshoot resource health issues", "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", "subcategory": "monitoring", "category": "Observability", "severity": "High", "link": "https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/welcome-azure-kubernetes", "ha": 1 }, { "text": "Define SLIs, SLOs, and actionable error-budget alerts", "description": "Measure user-visible availability and latency, set service objectives, and page on actionable symptoms or error-budget burn. Include pending pods, failed scheduling, persistent-volume attachment, DNS, certificate expiry, and failed upgrades in platform alerts.", "guid": "b58b7f4b-c234-4e67-a3f8-687fcf593a8e", "subcategory": "observability", "category": "Observability", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/monitor-aks" }, { "text": "Test incident response and diagnostic-data retention", "description": "Maintain dashboards, runbooks, escalation paths, audit-log access, and diagnostic retention for the investigation window. Run an incident exercise and verify alerts reach an accountable responder. Protect logs from leaking secrets and excessive collection costs.", "guid": "2f3a41e0-12d4-4493-aa07-448b7cdcc79a", "subcategory": "observability", "category": "Observability", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/monitor-aks" }, { "text": "Correlate OpenTelemetry traces with workload metrics and logs", "description": "Instrument application request paths with OpenTelemetry or a supported Application Insights integration. Preserve correlation IDs, control sampling and cardinality, and validate that dependency failures can be traced across service boundaries without exposing sensitive data.", "guid": "1ede9e95-2888-478b-aee8-2188572848eb", "subcategory": "observability", "category": "Observability", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview" }, { "text": "Define non-functional requirements such as SLAs, RTO (Recovery Time Objective) and RPO (Recovery Point Objective)", "description": "Before going to production, it is very important to decide the target of availability and recovery time you are looking for. This will help you to decide the right backup strategy but also the architecture of your solution.", "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06", "subcategory": "resiliency", "category": "BC and DR", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-business-continuity-disaster-recovery", "ha": 1 }, { "text": "Rehearse recovery into a clean, isolated environment", "description": "Regularly rebuild the platform from infrastructure as code in an isolated recovery environment. Restore application configuration and data, measure RTO/RPO, and test dependencies and access. Never delete production merely to conduct a recovery rehearsal.", "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61", "subcategory": "resiliency", "category": "BC and DR", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/reliability-multi-region-deployment-models", "ha": 1 }, { "text": "Distribute production workloads across availability zones", "description": "Use supported zonal node pools and topology spread constraints to separate replicas across nodes and zones. Validate sufficient surviving capacity, zonal storage behavior, load balancing, and failure recovery; availability zones are separate datacenter failure domains within a region.", "guid": "578a219a-46be-4b54-9350-24922634292b", "subcategory": "resiliency", "category": "BC and DR", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/reliability-availability-zones-configure", "ha": 1 }, { "text": "Design multiregion recovery around business requirements", "description": "Choose active-active or active-passive regions based on RTO/RPO, data residency, latency, dependencies, and available capacity. Regions need not be an Azure region pair; validate service support, replication, quota, and independence explicitly.", "guid": "4e907690-4780-492f-9632-03bcc80b7a80", "subcategory": "resiliency", "category": "BC and DR", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/reliability-multi-region-deployment-models" }, { "text": "Test global traffic failover and failback", "description": "Select Front Door or Traffic Manager according to protocol and routing needs. Test health probes, DNS caching, TLS, session behavior, regional dependencies, and failback. Routing changes do not recover or synchronize application data.", "guid": "170265f4-bb46-4a39-9af7-f317284797b1", "subcategory": "resiliency", "category": "BC and DR", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/reliability-multi-region-deployment-models", "ha": 1 }, { "text": "Create a storage migration plan", "description": "Your applications might use Azure Storage for their data. Because your applications are spread across multiple AKS clusters in different regions, you need to keep the storage synchronized", "guid": "8c6703c5-42e9-46ef-93f1-7f6232af25fc", "subcategory": "resiliency", "category": "BC and DR", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/reliability-multi-region-deployment-models" }, { "text": "Select an AKS tier with the required control-plane SLA", "description": "Use Standard or Premium tier for the financially backed Kubernetes API-server uptime SLA. Microsoft documents 99.95% with availability zones and 99.9% without; Free tier has no financially backed SLA. These are control-plane commitments, not an end-to-end application SLA; verify current contractual terms.", "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", "subcategory": "resiliency", "category": "BC and DR", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/free-standard-pricing-tiers", "ha": 2, "cost": -2 }, { "text": "Spread replicas across nodes and zones", "description": "Use topology spread constraints or appropriate anti-affinity to keep replicas in separate failure domains. Balance strict scheduling rules against available recovery capacity, and test both node loss and zone loss under representative load.", "guid": "1eea4888-8c2a-40b2-a40b-cacdc5f55497", "subcategory": "resiliency", "category": "BC and DR", "severity": "Low", "link": "https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/" }, { "text": "If using a private registry (ACR), configure region replication to store images in multiple regions", "description": "Companies that want a local presence, or a hot backup, choose to run services from multiple Azure regions.\n\nAs a best practice, placing a container registry in each region where images are run allows network-close operations, enabling fast, reliable image layer transfers. Geo-replication enables an Azure container registry to function as a single registry, serving multiple regions with multi-master regional registries.", "guid": "b0803aed-1ca6-4330-816c-92677c6e9935", "subcategory": "resiliency", "category": "BC and DR", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-geo-replication" }, { "text": "Configure your registry to use zone redundancy", "description": "Use Azure availability zones to create a resilient and high availability Azure container registry within an Azure region.", "guid": "a4cefd60-f24f-4907-9723-b927300b4c42", "subcategory": "resiliency", "category": "BC and DR", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/container-registry/zone-redundancy" }, { "text": "Move Container Registry to a dedicated resource group", "description": "Because container registries are resources that are used across multiple container hosts, a registry should reside in its own resource group.\n\nAlthough you might experiment with a specific host type, such as Azure Container Instances, you’ll likely want to delete the container instance when you’re done. However, you might also want to keep the collection of images you pushed to Azure Container Registry. By placing your registry in its own resource group, you minimize the risk of accidentally deleting the collection of images in the registry when you delete the container instance resource group.", "guid": "7b0bb400-deb6-4914-82da-2e914c9aaa72", "subcategory": "Other", "category": "BC and DR", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-best-practices" }, { "text": "Evaluate ACR soft delete against support and retention requirements", "description": "Where supported, evaluate ACR soft delete to recover accidentally deleted artifacts within the configured retention period. Check current feature status, limitations, and costs; soft delete does not replace immutable release retention, replication, or tested disaster recovery.", "guid": "49919955-fd6c-40f5-9c5c-5a7273c7a935", "subcategory": "Other", "category": "BC and DR", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-soft-delete-policy" }, { "text": "Back up supported cluster resources and persistent volumes", "description": "Configure Azure Backup for AKS or a supported alternative with explicit scope, retention, and recovery objectives. Check the current support matrix for Azure Disk/Azure Files, snapshot versus vaulted backup, regions, and cross-region restore. Back up external databases separately.\n\nPerform full restore drills, including identities, CRDs, secrets, application dependencies, and data consistency. A successful backup job does not prove that the application can be recovered.", "guid": "7e970492-1bed-4541-98f6-be550b17caa6", "subcategory": "resiliency", "category": "BC and DR", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/backup/azure-kubernetes-service-cluster-backup-concept", "ha": 1, "cost": -1 }, { "text": "Exercise failure scenarios under representative load", "description": "Rehearse pod, node, zone, DNS, registry, egress, and dependency failures in a controlled environment. Use fault injection only with explicit scope and safety controls, verify service objectives, and track remediation actions from each exercise.", "guid": "23592e5e-4f9d-434a-afd3-6691b26c0d98", "subcategory": "bc_dr", "category": "BC and DR", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/well-architected/reliability/reliability-test" }, { "text": "Match Windows base images to a supported node OS", "description": "Validate the supported Windows host/container compatibility matrix. Windows Server 2019 node-pool support ended on 1 March 2026 and images are scheduled for removal on 1 April 2027. Migrate to a supported LTSC release such as Windows Server 2022 or 2025 after compatibility testing.", "guid": "4d3e8a06-b724-43a3-b9b9-328a08325c61", "subcategory": "windows", "category": "Windows", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/windows-vs-linux-containers" }, { "text": "Test graceful shutdown and recovery on Windows", "description": "Test SIGTERM-equivalent Windows shutdown behavior, preStop hooks, terminationGracePeriodSeconds, and actual application cleanup on supported Windows images. Avoid blanket claims that graceful termination is unavailable; design for abrupt failure and verify behavior during upgrades.", "guid": "fce3ccf3-5f62-4ad6-b945-845362777529", "subcategory": "windows", "category": "Windows", "severity": "Medium", "link": "https://kubernetes.io/docs/concepts/windows/intro/" }, { "text": "Restrict Windows HostProcess and administrative privileges", "description": "Run applications as a non-administrative identity where supported. Windows does not use Linux privileged-container semantics, but HostProcess containers can access the host and require tightly restricted admission, identities, and namespaces.", "guid": "bd773172-40dc-4502-b284-137c70d77bc9", "subcategory": "windows", "category": "Windows", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/use-windows-hpc" }, { "text": "Set and monitor Windows memory requests and limits", "description": "Size Windows nodes and container memory using measured working sets and system reservations. Validate eviction and OOM behavior for the actual Windows/runtime version, alert on pressure, and test recovery rather than assuming Linux memory-management behavior.", "guid": "dea429d5-2c10-480c-85a1-9d9d0c4afc3d", "subcategory": "windows", "category": "Windows", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/windows-vs-linux-containers" }, { "text": "Choose a supported Azure CNI model for Windows", "description": "Use a Windows-supported Azure CNI configuration, including Overlay where supported for the selected versions. Kubenet and the Linux Cilium data plane are not Windows networking options. Validate policy-engine and IPAM support before provisioning.", "guid": "3922e5b0-fa6b-4020-a92e-2e0d76338e95", "subcategory": "windows", "category": "Windows", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/azure-cni-overlay" }, { "text": "Keep windows containers patch level in sync with host patch level", "description": "Windows Server nodes in AKS must be upgraded to get the latest patch fixes and updates. Windows Updates are not enabled on nodes in AKS. AKS releases new node pool images as soon as patches are available, it is the customers responsibility to upgrade node pools to stay current on patches and hotfix.", "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", "subcategory": "windows", "category": "Windows", "severity": "High", "link": "https://learn.microsoft.com/en-us/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2" }, { "text": "Validate network policy enforcement on Windows", "description": "Do not assume Linux and Windows share the same network policy capabilities. Azure NPM on Windows is unsupported from 30 September 2026; select a supported alternative such as Calico after validating the exact OS, network model, and version matrix.", "guid": "74e42965-8bbd-46fb-b027-ccad9c3933a4", "subcategory": "windows", "category": "Windows", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/use-network-policies" }, { "text": "Enable Group Managed Service Accounts (GMSA) for your Windows Server nodes", "description": "Group Managed Service Accounts (GMSA) is a managed domain account for multiple servers that provides automatic password management, simplified service principal name (SPN) management and the ability to delegate the management to other administrators.", "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", "subcategory": "identity", "category": "Windows", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/use-group-managed-service-accounts", "simple": -1, "security": 1 }, { "text": "If required for AKS Windows workloads, HostProcess containers can be used", "description": "HostProcess / Privileged containers extend the Windows container model to enable a wider range of Kubernetes cluster management scenarios.", "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", "subcategory": "application", "category": "Windows", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/use-windows-hpc", "cost": 1 }, { "text": "Taint Windows nodes", "description": "Adding taints, tolerations and node selectors will help avoid having pods scheduled in the wrong OS node pool", "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", "subcategory": "compliance", "category": "Windows", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/windows-best-practices", "simple": -1, "ha": 1 }, { "text": "Migrate Windows Azure NPM policy before relying on enforcement", "description": "Inventory Windows pools using Azure Network Policy Manager, whose AKS Windows support ended on 30 September 2026. Follow supported migration guidance and test positive and negative connectivity cases with the replacement engine.", "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", "subcategory": "security", "category": "Windows", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/use-network-policies", "security": 1, "simple": -1 }, { "text": "Validate accelerated networking for Windows node SKUs", "description": "Select a supported Windows VM size and verify accelerated networking availability and actual enablement. Benchmark throughput and latency, and include driver and node-image compatibility in upgrade testing.", "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", "subcategory": "operations", "category": "Windows", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/virtual-network/accelerated-networking-overview", "scale": 1, "simple": -1 }, { "text": "Track Windows LTSC and Annual Channel retirement dates", "description": "Windows Server Annual Channel preview support ended on 15 May 2026, with image removal scheduled for 15 May 2027. Windows Server 2022 AKS support is scheduled to end on 30 June 2028, with image removal on 30 June 2029. Plan LTSC migration against current version and OS support matrices.", "guid": "ed48a9ab-a180-4832-ac04-cc6eddd360a2", "subcategory": "windows", "category": "Windows", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/windows-vs-linux-containers" }, { "text": "Implement liveness probes that detect unrecoverable local failure", "description": "Use a liveness probe only when restarting the container can resolve a failure. Avoid coupling liveness to a shared downstream dependency, which can trigger restart storms during an outage. Test thresholds under load.", "guid": "2e9ed573-38b2-4856-a7f9-676d9ab604e1", "subcategory": "application", "category": "Application Deployment", "severity": "High", "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/" }, { "text": "Protect slow startup with a startup probe", "description": "Configure a startup probe with a failure budget covering the measured worst-case startup. Liveness and readiness probes do not run until the startup probe succeeds; test image pulls and cold initialization separately.", "guid": "a066989c-9dce-4712-bce3-4eef36f8c0c2", "subcategory": "application", "category": "Application Deployment", "severity": "Medium", "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/" }, { "text": "Implement a proper Readiness probe", "description": "Sometimes, applications are temporarily unable to serve traffic. For example, an application might need to load large data or configuration files during startup, or depend on external services after startup. In such cases, you don't want to kill the application, but you don't want to send it requests either. Kubernetes provides readiness probes to detect and mitigate these situations. A pod with containers reporting that they are not ready does not receive traffic through Kubernetes Services.", "guid": "de1b6b38-4fa9-4f6e-ab92-d824346dd20c", "subcategory": "application", "category": "Application Deployment", "severity": "Medium", "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/" }, { "text": "Implement graceful termination and connection draining", "description": "Handle termination signals, configure terminationGracePeriodSeconds, and use preStop only where needed. Allow in-flight requests to drain and test rolling updates and node drains. Hooks are not guaranteed during every failure, so persist critical state safely.", "guid": "dc4828a3-fc4f-4ac5-8844-122b8482dbb1", "subcategory": "application", "category": "Application Deployment", "severity": "Low", "link": "https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/" }, { "text": "Run enough replicas for the availability target", "description": "Use multiple replicas for services that require high availability, and spread them across nodes and zones. Test that the remaining replicas can serve peak demand during failure or maintenance; replica count alone does not establish resilience.", "guid": "4f1f88f9-98a3-48f5-a37f-4d9c9aecbb11", "subcategory": "application", "category": "Application Deployment", "severity": "Medium", "link": "https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/" }, { "text": "Apply tags/labels to all resources", "description": "Ensure that your components are tagged, it could be business, security or technical tags and these tags will help to assess or apply relevant policies.", "guid": "7b613b26-df38-49a8-94bf-c5301a91d558", "subcategory": "application", "category": "Application Deployment", "severity": "Medium", "link": "https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/" }, { "text": "Autoscale applications using measured demand", "description": "Configure HPA or KEDA with appropriate metrics, requests, replica bounds, and stabilization windows. Test metric outages, burst traffic, dependency limits, and scale-down; ensure node scaling and regional capacity can satisfy demand.", "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", "subcategory": "resiliency", "category": "Application Deployment", "severity": "Low", "link": "https://kubernetes.io/docs/concepts/workloads/autoscaling/horizontal-pod-autoscale/", "scale": 1, "simple": -1 }, { "text": "Keep secrets out of images and use a managed secret store", "description": "Store application secrets in Key Vault and retrieve them with a supported integration and least-privilege identity. AKS provides encryption at rest, but Kubernetes Secrets are still accessible to authorized API clients and are not an external vault. Never commit secrets to source or bake them into images.", "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", "subcategory": "security", "category": "Application Deployment", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver", "simple": -1, "security": 1 }, { "text": "Use Microsoft Entra Workload ID for application access", "description": "Enable the OIDC issuer and Workload ID, then federate a dedicated Kubernetes service account to a least-privilege managed identity. Use supported SDKs and the required workload identity label. Replace the retired pod-managed identity add-on; do not give applications node identity permissions.", "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", "subcategory": "identity", "category": "Application Deployment", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview", "simple": -1, "security": 1 }, { "text": "Use namespaces with explicit access and policy boundaries", "description": "Use dedicated namespaces for workloads and apply scoped RBAC, quotas, and network/admission policy. Avoid deploying applications into default or system namespaces. Namespaces provide logical separation, not a complete security boundary.", "guid": "0b56d03c-5fc8-42b1-943b-9e4b4d0f3de8", "subcategory": "security", "category": "Application Deployment", "severity": "Medium", "link": "https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/" }, { "text": "Set up requests and limits on your containers", "description": "When Containers have resource requests specified, the scheduler can make better decisions about which nodes to place Pods on. And when Containers have their limits specified, contention for resources on a node can be handled in a specified manner.", "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", "subcategory": "resources", "category": "Application Deployment", "severity": "High", "link": "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", "simple": -1, "ha": 1 }, { "text": "Declare an explicit workload security context", "description": "Use platform-appropriate least-privilege settings. For Linux, prefer non-root, RuntimeDefault seccomp, dropped capabilities, no privilege escalation, and a read-only root filesystem. Disable automatic service account token mounting where the workload does not need it; validate projected tokens required by Workload ID.", "guid": "20861805-be15-48f5-b40b-5ae203ddbb67", "subcategory": "security", "category": "Application Deployment", "severity": "Medium", "link": "https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" }, { "text": "Ensure your manifests respect good practices", "description": "Best practices inside the cluster start with the configuration of your manifests. Ensure that they respect good practices", "guid": "5388e9de-d167-4dd1-a2b0-ac241b999a64", "subcategory": "resources", "category": "Application Deployment", "severity": "Medium", "link": "https://kubernetes.io/docs/concepts/security/application-security-checklist/", "simple": 1 }, { "text": "Lint Dockerfiles and enforce an image-build baseline", "description": "Validate base-image provenance, pinned versions, non-root execution where supported, build secrets, dependency installation, and unnecessary packages. Use maintained linters and policy checks without exposing build credentials in layers or logs.", "guid": "b5222fdc-72b7-4b5f-baae-ab48a69b1d36", "subcategory": "security", "category": "Application Deployment", "severity": "High", "link": "https://snyk.io/blog/10-docker-image-security-best-practices/" }, { "text": "Scan container images during the build", "description": "Scan OS packages and application dependencies during image builds with maintained tools. Retain reports linked to immutable digests, define remediation targets, and rescan deployed versions as new vulnerabilities are disclosed.", "guid": "54cbc938-394e-480a-823a-51c2bcd3c66b", "subcategory": "security", "category": "Application Deployment", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-azure" }, { "text": "Enforce image vulnerability thresholds and exception expiry", "description": "Define policy using exploitability, exposure, severity, and available fixes. Block unacceptable risk, record owners and expiry for exceptions, and rescan continuously. An unfixed critical vulnerability is not automatically acceptable simply because the vendor has not published a fix.", "guid": "1a67a172-c4ca-4383-8934-a71277cb927e", "subcategory": "security", "category": "Application Deployment", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-azure" }, { "text": "Validate container build and runtime policy", "description": "Validate approved base images, non-root execution where supported, exposed services, secret handling, and required labels. Apply rules based on the threat model; opening port 80 alone is not proof of noncompliance.", "guid": "01ede997-e0bf-454a-bd1f-114be06a9874", "subcategory": "security", "category": "Application Deployment", "severity": "High", "link": "https://kubernetes.io/docs/concepts/security/application-security-checklist/" }, { "text": "Assess application modernization before containerization", "description": "Validate runtime support, licensing, state, external dependencies, health probes, and operational ownership before moving an application to AKS. Choose supported migration tooling based on the workload rather than assuming a point-and-containerize conversion produces a production-ready service.", "guid": "c1c05f94-4b74-4231-9d36-aa7a56fb775e", "subcategory": "application", "category": "Application Deployment", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/architecture/guide/choose-azure-container-service" }, { "text": "Apply the right deployment type to your application", "description": "There are a variety of techniques to deploy new applications to production so choosing the right strategy is an important decision that needs to be made to leverage the impact of change on the consumer.", "guid": "3abc7c0e-44c7-40fc-afce-aa4ddbf3dd81", "subcategory": "application", "category": "Application Deployment", "severity": "Low", "link": "https://blog.container-solutions.com/deployment-strategies" }, { "text": "Use workload controllers instead of standalone pods", "description": "Manage long-running applications through Deployments or StatefulSets, and finite work through Jobs or CronJobs. A standalone pod is not recreated after node loss by a workload controller; test replacement and application recovery.", "guid": "980e9f76-e20a-426a-9c01-cbae1b63c5e8", "subcategory": "resiliency", "category": "Application Deployment", "severity": "Low", "link": "https://kubernetes.io/docs/concepts/workloads/controllers/" }, { "text": "Set image pull policy and deploy immutable image digests", "description": "Use immutable digests for reproducible deployments and choose imagePullPolicy deliberately. Always checks registry resolution but can reuse cached layers; IfNotPresent reuses cached images. Do not rely on mutable latest tags, and test registry failure behavior.", "guid": "d457598a-047b-4fd7-88e5-9c61dea67f6a", "subcategory": "application", "category": "Application Deployment", "severity": "Low", "link": "https://kubernetes.io/docs/concepts/containers/images/" }, { "text": "Provision Azure resources with reviewed infrastructure as code", "description": "Use Bicep, ARM templates, or Terraform modules with pinned versions, environment-specific configuration, least-privilege deployment identities, and reviewed changes. Keep state protected, detect drift, and rehearse rebuilding the platform.", "guid": "3acbe04b-be20-49d3-afda-47778424d116", "subcategory": "IaC", "category": "Application Deployment", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/devops/pipelines/architectures/devops-pipelines-baseline-architecture?view=azure-devops", "simple": -1, "ha": 1 }, { "text": "Use canary or blue/green deployments", "description": "This will help ensure your workloads remain online during cluster upgrades.", "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b", "subcategory": "application", "category": "Application Deployment", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/architecture/guide/aks/blue-green-deployment-for-aks", "cost": 1 }, { "text": "Evaluate Dapr only when its application capabilities are needed", "description": "Dapr can provide service invocation, pub/sub, state management, and other distributed application APIs. Adopt it when those capabilities justify additional sidecars, control-plane components, security configuration, and lifecycle management; it is not an upgrade-availability mechanism.", "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", "subcategory": "application", "category": "Application Deployment", "severity": "Low", "link": "https://docs.dapr.io/", "simple": 1 }, { "text": "Validate deprecated Kubernetes APIs before every upgrade", "description": "Check release notes, API-server warnings, manifests, CRDs, Helm charts, operators, and admission webhooks for APIs removed in the target version. Upgrade dependencies first and test conversion and rollback paths in a representative environment.", "guid": "e10aad61-3625-4cec-a5e5-697e16ec4164", "subcategory": "application", "category": "Application Deployment", "severity": "High", "link": "https://kubernetes.io/docs/reference/using-api/deprecation-guide/" }, { "text": "Secure CI/CD with federation and scoped deployment permissions", "description": "Use OIDC federation from the CI platform to Azure, protect release environments, pin reviewed actions and build dependencies, and scope deployment identities to the required namespaces and resources. Keep production credentials and kubeconfig files out of logs and artifacts.", "guid": "9a59a8b9-a4d2-4a79-aaca-38343ee351ee", "subcategory": "application", "category": "Application Deployment", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/devops/pipelines/architectures/devops-pipelines-baseline-architecture?view=azure-devops" }, { "text": "Scan the container image against vulnerabilities", "description": "Scan operating-system packages and application dependencies in container images during build and continuously after publication. Triage findings using exploitability and exposure, enforce remediation targets, and verify deployed image digests. A clean scan does not prove that an image is free of vulnerabilities.", "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", "subcategory": "security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-container-registries-introduction", "cost": -1, "security": 1 }, { "text": "Allow deploying containers only from known registries", "description": "One of the most common custom policies that you might want to consider is to restrict the images that can be deployed in your cluster. But it can also be addressed with a proper egress lockdown or using an admission controller", "guid": "8dcb9d27-a601-48e6-aeb8-e0469aaf8921", "subcategory": "security", "category": "Governance and Security", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes" }, { "text": "Detect and respond to container runtime threats", "description": "Enable supported runtime threat detection, such as Microsoft Defender for Containers, and route alerts into incident response. Validate required sensors and permissions, investigate suspicious process and network activity, and rehearse containment without assuming a sensor prevents every attack.", "guid": "a71e024f-ac46-4d0e-86d8-fad9a86c99af", "subcategory": "security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction" }, { "text": "Prevent promotion of images that violate current policy", "description": "Continuously rescan stored images and block release promotion or admission when they violate approved risk policy. Verify that quarantine tooling is supported and enforced by every pull path; a registry scan alone does not block deployment.", "guid": "c970cb26-a707-4bf2-9e40-5401fea3d55b", "subcategory": "security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-azure" }, { "text": "Scope registry roles to the required repositories and actions", "description": "Separate image push, pull, delete, signing, and administrative permissions. For ABAC-enabled registries, use supported repository roles and conditions rather than assuming AcrPull/AcrPush applies. Audit assignments and keep the registry admin user disabled.", "guid": "3f703579-9f4a-43c4-8c40-5a9e78015379", "subcategory": "security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-rbac-built-in-roles-overview" }, { "text": "Network Segmentation of Docker Registries", "description": "Limit access to a registry by assigning virtual network private IP addresses to the registry endpoints and using Azure Private Link. Network traffic between the clients on the virtual network and the registry's private endpoints traverses the virtual network and a private link on the Microsoft backbone network, eliminating exposure from the public internet. Private Link also enables enables private registry access from on-premises through Azure ExpressRoute private peering or a VPN gateway.", "guid": "6ae51d09-8142-4979-95ed-7ec3451de81c", "subcategory": "security", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-endpoints" }, { "text": "Use minimal, maintained base images", "description": "Choose supported, regularly patched minimal or distroless images compatible with the application. Do not use end-of-life Debian 10 examples. Removing a shell reduces attack surface but does not prevent exploitation; retain a controlled debug workflow.", "guid": "f57ba3a5-93ae-435f-9468-80ccd6a841b9", "subcategory": "security", "category": "Governance and Security", "severity": "Medium", "link": "https://github.com/GoogleContainerTools/distroless" }, { "text": "Refresh container when base image is updated", "description": "As you use base images for application images, use automation to build new images when the base image is updated. As those base images typically include security fixes, update any downstream application container images.", "guid": "22882284-a9c2-4e16-b3e3-2d4947cc24b8", "subcategory": "resources", "category": "Governance and Security", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-container-image-management" }, { "text": "Generate SBOMs and verify artifact provenance", "description": "Generate an SBOM for each release, retain build provenance, and sign immutable artifacts using supported OCI signing tools. Verify signatures and trusted identities during release or admission; signing without verification does not establish a supply-chain control.", "guid": "789abf8e-f640-4bb8-a98f-5a7583d1bc7c", "subcategory": "container", "category": "Governance and Security", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/container-registry/overview-sign-verify-artifacts" }, { "text": "Retain and replicate the artifacts required for recovery", "description": "Keep known-good image digests, Helm charts, manifests, and signatures available for the recovery window. Test pulls from the recovery region, registry private DNS, retention rules, and access identities; avoid deleting an image still referenced by production or rollback plans.", "guid": "e2f4cce0-f4a7-4311-a5a1-713c4cef2036", "subcategory": "container", "category": "Governance and Security", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-geo-replication" }, { "text": "Allocate costs to teams and workloads", "description": "Use AKS cost analysis where supported or a maintained allocation tool. Combine Azure tags and Kubernetes labels with ownership, budgets, and chargeback rules. Include idle capacity, monitoring ingestion, network egress, storage, licenses, and managed add-ons.", "guid": "0f396e1a-62b0-409e-a7d9-3e547ea4e64e", "subcategory": "cost", "category": "Cost and Sustainability", "severity": "High", "link": "https://learn.microsoft.com/en-us/azure/aks/cost-analysis" }, { "text": "Right-size from measured demand and unit economics", "description": "Review requests, limits, node utilization, autoscaler behavior, and cost per business transaction. Reduce waste without removing failure headroom, disrupting latency objectives, or creating unschedulable workloads.", "guid": "62079698-08c1-4468-ab68-48215fe759d3", "subcategory": "cost", "category": "Cost and Sustainability", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/best-practices-cost" }, { "text": "Use reservations and savings plans only for stable baseline demand", "description": "Model measured compute commitments against expected VM families, regions, and utilization. Use Spot capacity only for interruption-tolerant workloads with checkpointing and fallback; never rely on Spot for essential system components.", "guid": "ac484c18-4c23-49bc-a4b6-8a3f82fd630d", "subcategory": "cost", "category": "Cost and Sustainability", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/best-practices-cost" }, { "text": "Stop disposable environments and clean orphaned resources safely", "description": "Schedule nonproduction shutdown or scale-down when supported and acceptable. Review unused disks, public IPs, snapshots, images, and workspaces with owners and retention policies before deletion; never treat an unattached disk as automatically disposable.", "guid": "deaa4ade-79a6-444a-aa45-024dd3a73505", "subcategory": "cost", "category": "Cost and Sustainability", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/aks/start-stop-cluster" }, { "text": "Evaluate sustainability without compromising service objectives", "description": "Measure utilization and workload efficiency, evaluate compatible Arm64 compute, and select regions within latency and residency constraints. Consider the total operational footprint rather than assuming one VM architecture is always cheaper or lower-carbon.", "guid": "80f55ea3-2cf6-49ee-a74f-0513af1f846a", "subcategory": "cost", "category": "Cost and Sustainability", "severity": "Low", "link": "https://learn.microsoft.com/en-us/azure/well-architected/sustainability/overview" } ] }