Key takeaway
Separate user and workload identities, apply least privilege with Kubernetes RBAC, isolate namespaces with network policies, and choose AKS log categories for investigation needs and cost.
A Kubernetes cluster has a control plane and nodes
The control plane accepts API requests, stores cluster state and schedules pods onto nodes. Kubelet and the container runtime on each node run workloads; the network data plane routes service traffic. Declarative manifests describe desired state, and controllers reconcile actual state toward it. This automation supports self-healing and scaling, but does not remove risks from exposed APIs, overprivileged service accounts, broad network access or outdated images.
Separate AKS platform operations from workload responsibility
AKS is a managed Kubernetes service on Azure. Microsoft manages control-plane components; responsibility for nodes, workloads, identity, networking, storage, data and selected security and monitoring settings depends on cluster mode and configuration. AKS Automatic can provide more preconfigured operational and monitoring defaults, while AKS Standard gives operators more configuration control. Do not assume the provider secures every layer; check current documentation for your mode, region, version and enabled features.
Manage user and pod identity separately
Map Kubernetes API user authentication to cluster RBAC permissions; avoid permanent cluster-admin grants and review roles regularly. In AKS, Microsoft Entra ID can connect user access to central identity policy; Kubernetes RBAC and Azure RBAC for Kubernetes authorization are distinct permission models, so identify which your cluster uses. For pod access to Azure services, prefer workload identity with a federated service-account token to avoid storing a long-lived application secret; protect the tokens too, and do not place application secrets in images or manifests. Keep break-glass access limited and audited.
Configure network policies and probes for their purpose
Restrict namespace and workload connections with default-deny ingress and egress policies, then allow required service flows; confirm your CNI supports network policies. Restrict API-server network access to trusted administrative paths and do not expose kubelet publicly. Failed liveness probes can trigger a container restart; readiness excludes an unready pod from new Kubernetes Service traffic but does not block all network access. Avoid tying a heavy dependency check to liveness, since restarting all pods together can amplify an outage. Configure a startup probe for slow initialization and readiness separately. Add image scanning, patching, a non-root user, minimal capabilities and resource limits to the workload pipeline.
Startup
Waits for initialization before liveness and readiness checks begin.
Liveness
Can trigger a restart when a container is irrecoverably stuck.
Readiness
Excludes an unready pod from new traffic routed by a Kubernetes Service.
Enable telemetry and control ingestion costs
Do not assess cluster health from a single dashboard. Platform metrics, workload logs, control-plane audit logs and application traces answer different questions. AKS control-plane resource logs are not stored until you route them with a diagnostic setting to Log Analytics or another destination. Availability of Container insights, Prometheus and Grafana can depend on AKS mode and configuration. Select audit categories for sensitive operations and consider the cost and privacy impact of high-volume get/list events. Correlate deployments, node restarts, autoscaling and application errors on a shared timeline.
Treat Mesos as a historical comparison
Kubernetes manages workloads through a declarative model, pods, service discovery and controllers. Apache Mesos was a general cluster resource manager: scheduler frameworks received CPU and memory offers from a master, while Marathon managed long-running services. Apache Mesos is now retired. For an existing Mesos environment, assign owners for versions, security updates, framework dependencies and migration planning. Base a new platform choice on active support and the team’s operational requirements.
Is Mesos a current peer alternative to Kubernetes?
No. The Apache project has retired; comparison is useful for architecture history and existing legacy environments.
Does AKS take over all cluster operations?
Microsoft manages the control plane. The team remains responsible for applications, data and access rules; check the selected AKS mode for the division of node, network and monitoring operations.