Skip to main content

​
Architecture Diagram

​
Resources by Type

​
Compute Resources

ResourceCountPurpose
AKS Cluster1Kubernetes orchestration
System Node Pool1System pods (fixed 3 nodes)
User Node Pool1Application workloads
GPU Node Pool0-1AI/ML workloads (optional)
Cassandra Pool0-1Temporal database (optional)
Total VMs: 6-24 (3 system + 3-10 user + 0-5 GPU + 0-6 Cassandra)

​
Network Resources

ResourceCountPurpose
Virtual Network1Network boundary
Subnets4-5Network segmentation
NSGs4-5Traffic control
Route Tables3-4Traffic routing
Private DNS Zones7Internal name resolution
Private Endpoints7Secure PaaS access
Bastion Host0-1Secure VM access
Public IPs0-1Bastion endpoint

​
Data & Storage Resources

ResourceCountPurpose
PostgreSQL Server1Relational database
Redis Cache1Distributed cache
Storage Account1Blob/File storage
AI Search Service0–1Full-text search (optional)
OpenAI Service0–1LLM models (optional)

​
Security Resources

ResourceCountPurpose
Key Vault1Secrets management
Managed Identity1-2Service authentication
RBAC Role Assignments10+Access control

​
Monitoring Resources

ResourceCountPurpose
Log Analytics Workspace1Centralized logging
Data Collection Rule1AKS metrics
Diagnostic Settings7+Resource logging
Datadog Connection0-1External monitoring

​
Network Architecture

​
Address Space Planning

VNet: 10.0.0.0/16 (65,536 IPs)
├── AKS Subnet: 10.0.1.0/24 (256 IPs)
├── Bastion Subnet: 10.0.2.0/26 (64 IPs)
├── Database Subnet: 10.0.3.0/24 (256 IPs)
└── Private Endpoints: 10.0.4.0/25 (128 IPs)

Pod CIDR: 10.244.0.0/16 (65,536 IPs)
Service CIDR: 10.243.0.0/16 (65,536 IPs)

​
Traffic Flow

Egress (Internet): 
Pods/VMs → NAT Gateway → Public IP → Internet
(Stateful, return traffic allowed)
Ingress (Internal): 
Service IP → Load Balancer → Pod IP (via CNI)
Database Access: 
AKS Pods → Private Endpoint → Private Link → PostgreSQL
(DNS: server.postgres.database.azure.com)
External Service Access: 
AKS Pods → API Gateway / Load Balancer → OpenAI / AI Search
(Via Private Endpoints)

​
AKS Configuration Deep Dive

​
API Server Access

Type: Private cluster (recommended) Endpoint: Internal only Access Method: Bastion host or VPN DNS: k8s..azmk8s.io (private)

​
Network Policies

Engine: Azure Network Policy Scope: Pod-to-pod communication Default: Allow all (unrestricted) Configuration: Define in Kubernetes manifests

​
Container Registry

Integration: Azure Container Registry (optional) Authentication: Managed identity or pull secrets Pulling: Private endpoint (optional)

​
Monitoring & Observability

Azure Monitor Agent: Deployed in kube-system Metrics: CPU, Memory, Disk, Network Logs: Container stdout/stderr, Kubernetes events Dashboards: Pre-built in Log Analytics