Microsoft CAF - Shared AKS Cluster

Question

Hello,

We currently have a Platform Landing Zone with follows Microsoft's Cloud Adoption Framework with Identity, Management & Connectivity Subscriptions.

We are looking to implement a Shared Azure Kubernetes Service (AKS) module for all of our applications to live on.

Each application will have their own Landing Zone subscriptions where their own resources will sit, Key Vault, Service Bus, Storage Accounts, Redis Cache etc etc, however, the applications themselves we would like them to sit on Shared AKS Cluster's.

Would it be acceptable to have these AKS Clusters in the Management Subscription, what is the recommended approach for this pattern?

Many Thanks,
J

Answer 1

Hi devopsfj,

Thank you for your response, the structure implementing a shared Azure Kubernetes Service (AKS) within the Microsoft Cloud Adoption Framework (CAF).

Management Subscription: For centralized governance, monitoring, and security. It should not host workloads but can manage cross-tenant resources like Azure Monitor and Azure Policy.

Connectivity Subscription: Houses networking resources such as VNets, VPN Gateways, Private Endpoints, and VNet Peering for secure communication between applications and shared services.

Identity Subscription: Manages Azure Active Directory (Azure AD), RBAC, and identity-related resources centrally for consistent access control across subscriptions.

Platform Subscription: Hosts shared platform services like Azure Kubernetes Service (AKS), Azure DevOps agents, and other shared resources used by multiple applications. This keeps shared infrastructure separate from application-specific resources.

Application Subscriptions (App 1, App 2, App 3,): Each application has its own subscription for application-specific resources (e.g., Key Vault, Service Bus, etc.), ensuring isolation and autonomy for each app.

The Platform Subscription is recommended for hosting shared services like the Azure Kubernetes Service (AKS) clusters.

Thank you.