AKS vs App Service Decision

# Create an App Service Plan (Linux, Premium v3)
az appservice plan create \
  --name my-api-plan \
  --resource-group myRG \
  --is-linux \
  --sku P1v3

# Deploy a container from Azure Container Registry
az webapp create \
  --name my-api-app \
  --resource-group myRG \
  --plan my-api-plan \
  --container-image-name myacr.azurecr.io/my-api:v1.2.3

# Enable managed identity for ACR pull
az webapp identity assign --name my-api-app --resource-group myRG
az role assignment create \
  --assignee $(az webapp identity show --name my-api-app --resource-group myRG --query principalId -o tsv) \
  --role AcrPull \
  --scope $(az acr show --name myacr --query id -o tsv)

# Enable VNet integration for backend access
az webapp vnet-integration add \
  --name my-api-app \
  --resource-group myRG \
  --vnet myVNet \
  --subnet app-service-subnet

# Configure health check endpoint
az webapp config set \
  --name my-api-app \
  --resource-group myRG \
  --generic-configurations '{"healthCheckPath": "/health"}'

# Create auto-scale settings for an App Service Plan
az monitor autoscale create \
  --resource-group myRG \
  --resource my-api-plan \
  --resource-type Microsoft.Web/serverfarms \
  --name my-api-autoscale \
  --min-count 2 \
  --max-count 10 \
  --count 2

# Scale out when average CPU > 70% for 10 minutes
az monitor autoscale rule create \
  --resource-group myRG \
  --autoscale-name my-api-autoscale \
  --condition "CpuPercentage > 70 avg 10m" \
  --scale out 2

# Scale in when average CPU < 30% for 15 minutes
az monitor autoscale rule create \
  --resource-group myRG \
  --autoscale-name my-api-autoscale \
  --condition "CpuPercentage < 30 avg 15m" \
  --scale in 1

# Add a schedule-based rule for business hours
az monitor autoscale profile create \
  --resource-group myRG \
  --autoscale-name my-api-autoscale \
  --name business-hours \
  --min-count 4 \
  --max-count 10 \
  --count 4 \
  --recurrence week Mon Tue Wed Thu Fri \
  --start "08:00" --end "18:00" \
  --timezone "Eastern Standard Time"

# Create a staging slot
az webapp deployment slot create \
  --name my-api-app \
  --resource-group myRG \
  --slot staging

# Deploy new version to staging
az webapp config container set \
  --name my-api-app \
  --resource-group myRG \
  --slot staging \
  --container-image-name myacr.azurecr.io/my-api:v1.3.0

# Test the staging slot
curl https://my-api-app-staging.azurewebsites.net/health

# Route 10% of production traffic to staging (canary)
az webapp traffic-routing set \
  --name my-api-app \
  --resource-group myRG \
  --distribution staging=10

# After validation, swap staging to production
az webapp deployment slot swap \
  --name my-api-app \
  --resource-group myRG \
  --slot staging \
  --target-slot production

# If issues detected, swap back immediately
az webapp deployment slot swap \
  --name my-api-app \
  --resource-group myRG \
  --slot production \
  --target-slot staging

# Create an AKS cluster with production settings
az aks create \
  --name my-aks-cluster \
  --resource-group myRG \
  --location eastus2 \
  --node-count 3 \
  --node-vm-size Standard_D4s_v5 \
  --enable-managed-identity \
  --attach-acr myacr \
  --network-plugin azure \
  --network-policy calico \
  --vnet-subnet-id /subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/aks-subnet \
  --service-cidr 10.0.0.0/16 \
  --dns-service-ip 10.0.0.10 \
  --zones 1 2 3 \
  --tier standard \
  --enable-cluster-autoscaler \
  --min-count 3 \
  --max-count 10 \
  --enable-defender \
  --enable-workload-identity \
  --enable-oidc-issuer \
  --auto-upgrade-channel stable

# Add a spot node pool for batch/non-critical workloads
az aks nodepool add \
  --cluster-name my-aks-cluster \
  --resource-group myRG \
  --name spotnodes \
  --node-vm-size Standard_D4s_v5 \
  --priority Spot \
  --eviction-policy Delete \
  --spot-max-price -1 \
  --enable-cluster-autoscaler \
  --min-count 0 \
  --max-count 20 \
  --labels workload-type=batch \
  --node-taints "kubernetes.azure.com/scalesetpriority=spot:NoSchedule"

# Add a GPU node pool for ML inference
az aks nodepool add \
  --cluster-name my-aks-cluster \
  --resource-group myRG \
  --name gpunodes \
  --node-vm-size Standard_NC6s_v3 \
  --node-count 1 \
  --enable-cluster-autoscaler \
  --min-count 0 \
  --max-count 4 \
  --labels workload-type=gpu \
  --node-taints "nvidia.com/gpu=present:NoSchedule"

# Get credentials
az aks get-credentials --name my-aks-cluster --resource-group myRG

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-api
  namespace: production
  labels:
    app: my-api
    version: v1.2.3
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app: my-api
  template:
    metadata:
      labels:
        app: my-api
        version: v1.2.3
        azure.workload.identity/use: "true"
    spec:
      serviceAccountName: my-api-sa
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: my-api
      containers:
        - name: my-api
          image: myacr.azurecr.io/my-api:v1.2.3
          ports:
            - containerPort: 8080
              protocol: TCP
          resources:
            requests:
              cpu: 500m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 1Gi
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          startupProbe:
            httpGet:
              path: /healthz
              port: 8080
            failureThreshold: 30
            periodSeconds: 10
          env:
            - name: AZURE_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: my-api-secrets
                  key: client-id
---
apiVersion: v1
kind: Service
metadata:
  name: my-api
  namespace: production
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP
  selector:
    app: my-api
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-api
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-api
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

# Create a Container Apps Environment
az containerapp env create \
  --name my-env \
  --resource-group myRG \
  --location eastus2 \
  --infrastructure-subnet-resource-id /subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/aca-subnet \
  --internal-only false

# Deploy a container app with auto-scaling
az containerapp create \
  --name my-api \
  --resource-group myRG \
  --environment my-env \
  --image myacr.azurecr.io/my-api:v1.2.3 \
  --registry-server myacr.azurecr.io \
  --registry-identity system \
  --target-port 8080 \
  --ingress external \
  --cpu 1.0 \
  --memory 2.0Gi \
  --min-replicas 2 \
  --max-replicas 10 \
  --scale-rule-name http-scaling \
  --scale-rule-type http \
  --scale-rule-http-concurrency 100 \
  --env-vars "ENV=production"

# Deploy a second service with internal ingress (service-to-service)
az containerapp create \
  --name my-worker \
  --resource-group myRG \
  --environment my-env \
  --image myacr.azurecr.io/my-worker:v1.0.0 \
  --registry-server myacr.azurecr.io \
  --registry-identity system \
  --target-port 8080 \
  --ingress internal \
  --cpu 0.5 \
  --memory 1.0Gi \
  --min-replicas 0 \
  --max-replicas 30 \
  --scale-rule-name queue-scaling \
  --scale-rule-type azure-queue \
  --scale-rule-metadata "queueName=work-items" "queueLength=10" \
  --scale-rule-auth "connection=queue-connection-string" \
  --secrets "queue-connection-string=<connection-string>"

# Traffic splitting between revisions (canary deployment)
az containerapp ingress traffic set \
  --name my-api \
  --resource-group myRG \
  --revision-weight my-api--v1=90 my-api--v2=10

# Only allow traffic from the frontend namespace to the api namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow-frontend-only
  namespace: api
spec:
  podSelector:
    matchLabels:
      app: my-api
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: frontend
        - podSelector:
            matchLabels:
              app: web-frontend
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              name: database
      ports:
        - protocol: TCP
          port: 5432
    # Allow DNS resolution
    - to: []
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

name: Deploy to AKS
on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4

      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Build and push image
        run: |
          az acr login --name myacr
          docker build -t myacr.azurecr.io/my-api:${{ github.sha }} .
          docker push myacr.azurecr.io/my-api:${{ github.sha }}

      - name: Set AKS context
        uses: azure/aks-set-context@v4
        with:
          cluster-name: my-aks-cluster
          resource-group: myRG

      - name: Deploy with Helm
        run: |
          helm upgrade --install my-api ./charts/my-api \
            --namespace production \
            --create-namespace \
            --set image.repository=myacr.azurecr.io/my-api \
            --set image.tag=${{ github.sha }} \
            --set replicas=3 \
            --wait \
            --timeout 10m

      - name: Verify deployment
        run: |
          kubectl rollout status deployment/my-api -n production --timeout=300s
          kubectl get pods -n production -l app=my-api

# Enable Flux extension on AKS cluster
az k8s-extension create \
  --cluster-name my-aks-cluster \
  --resource-group myRG \
  --cluster-type managedClusters \
  --extension-type microsoft.flux \
  --name flux

# Create a Flux configuration pointing to your Git repo
az k8s-configuration flux create \
  --cluster-name my-aks-cluster \
  --resource-group myRG \
  --cluster-type managedClusters \
  --name my-app-config \
  --namespace flux-system \
  --scope cluster \
  --url https://github.com/myorg/k8s-manifests \
  --branch main \
  --kustomization name=production path=./clusters/production/my-api prune=true

# Enable CSI Secrets Store driver
az aks enable-addons \
  --addons azure-keyvault-secrets-provider \
  --name my-aks-cluster \
  --resource-group myRG

# Create a user-assigned managed identity for the workload
az identity create \
  --name my-api-identity \
  --resource-group myRG

# Grant the identity access to Key Vault
az role assignment create \
  --assignee $(az identity show --name my-api-identity -g myRG --query clientId -o tsv) \
  --role "Key Vault Secrets User" \
  --scope $(az keyvault show --name myapp-prod-kv --query id -o tsv)

# Create federated credential for Workload Identity
az identity federated-credential create \
  --name my-api-fed-cred \
  --identity-name my-api-identity \
  --resource-group myRG \
  --issuer $(az aks show --name my-aks-cluster -g myRG --query oidcIssuerProfile.issuerUrl -o tsv) \
  --subject system:serviceaccount:production:my-api-sa \
  --audiences api://AzureADTokenExchange

# Create the Kubernetes service account
kubectl create namespace production
kubectl apply -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-api-sa
  namespace: production
  annotations:
    azure.workload.identity/client-id: $(az identity show --name my-api-identity -g myRG --query clientId -o tsv)
  labels:
    azure.workload.identity/use: "true"
EOF

# Enable Container Insights
az aks enable-addons \
  --addons monitoring \
  --name my-aks-cluster \
  --resource-group myRG \
  --workspace-resource-id /subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myLogAnalytics

# Enable Azure Managed Prometheus
az aks update \
  --name my-aks-cluster \
  --resource-group myRG \
  --enable-azure-monitor-metrics \
  --azure-monitor-workspace-resource-id /subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.Monitor/accounts/myPrometheus

# Create an Azure Managed Grafana instance
az grafana create \
  --name my-grafana \
  --resource-group myRG \
  --location eastus2

# Link Grafana to Prometheus data source
az grafana data-source create \
  --name my-grafana \
  --resource-group myRG \
  --definition '{
    "name": "Azure Managed Prometheus",
    "type": "prometheus",
    "access": "proxy",
    "url": "https://myprometheus.eastus2.prometheus.monitor.azure.com"
  }'

# KQL query: Find pods with high restart counts
# AzureMetrics
# | where MetricName == "kube_pod_container_status_restarts_total"
# | where Average > 5
# | project TimeGenerated, PodName=split(DimensionValue, "/")[1], Restarts=Average
# | order by Restarts desc

// Migrating a Kubernetes deployment to Container Apps with Bicep
param location string = resourceGroup().location
param acrName string = 'myacr'
param imageName string = 'my-api'
param imageTag string = 'v1.2.3'

resource env 'Microsoft.App/managedEnvironments@2024-03-01' = {
  name: 'my-env'
  location: location
  properties: {
    vnetConfiguration: {
      infrastructureSubnetId: '/subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/aca-subnet'
    }
    zoneRedundant: true
  }
}

resource app 'Microsoft.App/containerApps@2024-03-01' = {
  name: 'my-api'
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    managedEnvironmentId: env.id
    configuration: {
      activeRevisionsMode: 'Multiple'
      ingress: {
        external: true
        targetPort: 8080
        transport: 'http'
        traffic: [
          {
            revisionName: 'my-api--v1'
            weight: 90
          }
          {
            latestRevision: true
            weight: 10
          }
        ]
      }
      registries: [
        {
          server: '${acrName}.azurecr.io'
          identity: 'system'
        }
      ]
      secrets: [
        {
          name: 'db-connection'
          keyVaultUrl: 'https://myapp-prod-kv.vault.azure.net/secrets/db-connection-string'
          identity: 'system'
        }
      ]
    }
    template: {
      containers: [
        {
          name: 'my-api'
          image: '${acrName}.azurecr.io/${imageName}:${imageTag}'
          resources: {
            cpu: json('1.0')
            memory: '2Gi'
          }
          probes: [
            {
              type: 'Liveness'
              httpGet: {
                path: '/healthz'
                port: 8080
              }
              periodSeconds: 20
            }
            {
              type: 'Readiness'
              httpGet: {
                path: '/ready'
                port: 8080
              }
              periodSeconds: 10
            }
          ]
          env: [
            {
              name: 'DB_CONNECTION'
              secretRef: 'db-connection'
            }
          ]
        }
      ]
      scale: {
        minReplicas: 2
        maxReplicas: 10
        rules: [
          {
            name: 'http-scaling'
            http: {
              metadata: {
                concurrentRequests: '100'
              }
            }
          }
        ]
      }
    }
  }
}

# Check available Kubernetes upgrades
az aks get-upgrades --name my-aks-cluster --resource-group myRG --output table

# Upgrade control plane to a new version
az aks upgrade \
  --name my-aks-cluster \
  --resource-group myRG \
  --kubernetes-version 1.29.2 \
  --control-plane-only

# Upgrade node pools separately (rolling update)
az aks nodepool upgrade \
  --cluster-name my-aks-cluster \
  --resource-group myRG \
  --name nodepool1 \
  --kubernetes-version 1.29.2 \
  --max-surge 33%

# Check node pool health
kubectl get nodes -o wide
kubectl top nodes

# Find pods with high resource usage
kubectl top pods --all-namespaces --sort-by=cpu | head -20

# Check for failed pods across all namespaces
kubectl get pods --all-namespaces --field-selector=status.phase=Failed

# View recent events (useful for debugging)
kubectl get events --all-namespaces --sort-by='.lastTimestamp' | tail -30

# Drain a node for maintenance
kubectl drain node-name --ignore-daemonsets --delete-emptydir-data