Azure Kubernetes Service

What AKS actually is

Azure Kubernetes Service is Microsoft's managed Kubernetes offering: you get a Kubernetes control plane that Microsoft runs, patches, and upgrades, and you supply the worker nodes as Azure virtual machines. It went generally available in 2018 after a preview period, and it is now one of the two default choices for enterprises that want Kubernetes without operating etcd themselves. We file it under managed Kubernetes, and it is a strong entry there — but it is important to be clear about what you are buying. AKS is not a portable, self-contained product; it is the Kubernetes layer on top of Azure, and every meaningful part of it reaches into the wider Azure platform.

The integration is the pitch. Cluster operations (upgrades, patching, scaling) are automated, node pools can be sized and scaled independently, and the cluster sits inside Azure's identity, networking, monitoring, and compliance framework. Entra ID (formerly Azure AD) backs RBAC, Container Registry handles images, Azure Monitor handles telemetry, and DevOps pipelines from Azure DevOps or GitHub Actions plug in directly. AKS Automatic, generally available since September 2025, goes further and hands you a pre-configured production cluster with node provisioning, scaling, upgrades, and networking set up out of the box. There is also a hybrid path through Azure Arc for clusters outside Azure.

Our editorial view: AKS is the right answer for a specific question — "we run Azure, we want production Kubernetes, who runs the control plane?" If your question is "we want Kubernetes anywhere," the honest answer is a CNCF-conformant distribution you can move, not AKS. The container orchestration itself is upstream Kubernetes, and that portability holds at the YAML level. Everything around it — identity, storage classes, load balancers, ingress, policy — is Azure-flavored, and moving off Azure means re-plumbing all of it.

Pricing: what you really pay

AKS pricing splits in two: the control plane, which has published tier prices, and the underlying compute, which is ordinary Azure VM spend. The Free tier charges nothing for cluster management — you pay only for the resources you consume — but it comes with no SLA and Microsoft states plainly that Free clusters are not meant to run at scale (their guidance is under 10 nodes, and the hard limit is 1,000). For production, the Standard tier runs $73 per cluster per month and includes the financially backed uptime SLA and up to 5,000 nodes. The Premium tier, which adds long-term Kubernetes support, is $438 per cluster per month. AKS Automatic's hosted component is listed at $116.80 per cluster per month. Those control-plane numbers are small next to the compute bill: node VMs are billed per second, with pay-as-you-go, savings plans, reservations, and Spot all available as usual on Azure.

What we tell teams to watch: the total cost of an AKS cluster is dominated by node VMs, disks, load balancers, public IPs, log ingestion, and egress — not the control plane. A modest three-node cluster with monitoring can plausibly cost more in Log Analytics data than in compute. This is where AKS budgets drift, and where the meter-by-meter style of Azure pricing catches people out. Model it in the Azure pricing calculator before you commit, and put a budget alert on the subscription from day one.

On the good side, the free tier is genuinely useful. For development clusters, CI environments, and learning Kubernetes, zero control-plane cost with per-second node billing is one of the better deals among the big three. We would not run production on it — the absence of an SLA is not a formality — but for experimentation the economics are hard to argue with. Compare that with the managed Kubernetes pricing on our benchmarks page: most smaller providers bundle the control plane into the node price, which is simpler to forecast even when the raw numbers are similar.

Performance & infrastructure

AKS runs on Azure's global footprint — Microsoft currently reports 80+ regions and 500+ datacenters — and clusters can use Availability Zones, which is what the SLA is keyed to. The Standard tier guarantees 99.95% monthly uptime for the Kubernetes API server in clusters using Availability Zones, and 99.9% for clusters that do not, with service credits backing it. Node availability is a separate matter covered by the VM SLA. That split matters in practice: the control plane guarantee says nothing about your application's availability, which is your architecture's job.

Feature-wise, AKS covers what production teams ask for: multiple node pools (including GPU node pools for inference and rendering workloads), virtual machine scale sets underneath, autoscaling, Azure CNI or kubenet networking, network policy, private clusters, Windows node support, and a Kubernetes version cadence tracking upstream with a 12-month support window. Free and Standard tiers track community support windows; Premium extends that with long-term support releases maintained for two years, which matters for teams in regulated or slow-moving environments. Platform-level DDoS protection is automatic and free for every Azure public IP, with paid IP and Network Protection tiers available when you need adaptive tuning, attack analytics, and an availability SLA on the protection itself.

We have not benchmarked AKS control-plane latency or node performance, and we will not pretend otherwise — our dated hands-on numbers on benchmarks cover plain VMs, not managed Kubernetes layers. What we can say is that node performance is whatever Azure VM SKU you pick, so the honest way to predict it is to evaluate the VM SKU itself and treat the AKS layer as operational convenience rather than a performance variable.

Where it falls short

Vendor lock-in is the headline concern, and our own database pitch says it plainly: Azure identity, Azure networking, Azure storage, Azure monitoring. Kubernetes workloads are portable in theory; in practice, ingress objects, key-vault references, managed identities, and disk storage classes do not follow you to another cloud without work. If portability is a real requirement for you (not a checkbox), budget for abstraction from day one or choose a more neutral platform.

Cost transparency is the second. The control-plane price is published and reasonable; the real bill is a stack of Azure meters — compute per second, managed disks, load balancer rules, public IPs, Log Analytics ingestion and retention, container registry, and egress. Teams consistently underestimate the observability line. This is the same pattern we flag on other hyperscale services: low-friction entry, hard-to-forecast steady state.

Third, operational surface area. AKS is easier than running Kubernetes yourself, but "managed control plane" is not "managed platform." Node image upgrades, pod disruption budgets, cluster autoscaler tuning, and network design are still your problem unless you step up to AKS Automatic — and AKS Automatic costs more and makes more decisions for you. Teams new to Kubernetes regularly discover that they have adopted a distributed systems operations job regardless.

Fourth, version churn. Standard support follows the community's sliding three-minor-version window; clusters that lag get unsupported quickly, and upgrades are your recurring chore. The Premium tier's long-term support exists precisely because enterprises kept asking for slower movement, at $438 per cluster per month. That is an honest fix, but it is also a hint about the treadmill.

Who should pick this

Our pick for organizations already standardized on Azure that need production Kubernetes with a financially backed SLA, Entra ID integration, and enterprise compliance coverage. If your data platform, identity, and CI already live in Azure, AKS is the path of least resistance and generally the right call; fighting for portability you will never use is its own cost.

Also a good fit for enterprises with hybrid plans: AKS on Azure plus Arc-managed clusters elsewhere gives one control story across environments, and the long-term support tier suits teams with slow certification cycles.

We would not pick it for teams that are cloud-agnostic by conviction or requirement — look at plain upstream Kubernetes on neutral infrastructure, or at least run a serious abstraction layer. And we would not point small teams or hobbyists at it unless the goal is learning Azure specifically: for small clusters there are simpler, cheaper managed Kubernetes options, and for a couple of containers, a platform with less ceremony serves better. The zero-cost Free tier is tempting; just never put a workload you care about on a cluster with no SLA.

Key takeaways

• Managed upstream Kubernetes on Azure: Microsoft runs the control plane (patching, upgrades), you run the node pools as VMs. GA since 2018; AKS Automatic (GA September 2025) adds fully managed node operations.
• Pricing is two-part: control plane tiers (Free, $73/month Standard, $438/month Premium) plus per-second VM and Azure service spend, which dominates the bill.
• SLA is real only on paid tiers: 99.95% API-server uptime with Availability Zones (99.9% without), financially backed; Free tier carries no SLA.
• Strong Azure-native integration (Entra ID RBAC, Monitor, DevOps, Arc hybrid) is the main reason to choose it — and the main source of lock-in.
• Platform DDoS protection is free and automatic for Azure public IPs; paid protection tiers add analytics and SLA.
• Our pick for Azure-standardized enterprises; for portable or budget-sensitive workloads, evaluate neutral alternatives first.

Sources

• https://azure.microsoft.com/en-us/pricing/details/kubernetes-service/
• https://azure.microsoft.com/en-us/products/kubernetes-service
• https://azure.microsoft.com/en-us/blog/azure-kubernetes-service-aks-ga-new-regions-new-features-new-productivity/
• https://azure.microsoft.com/en-us/support/legal/sla/kubernetes-service/
• https://azure.microsoft.com/en-us/explore/global-infrastructure
• https://azure.microsoft.com/en-us/products/ddos-protection
• https://learn.microsoft.com/en-us/azure/aks/gpu-cluster