Azure AKS

Azure Kubernetes Service platform managed with Terraform (infrastructure) and Helm (workloads). Provisions an AKS cluster with PostgreSQL, Azure Container Registry, and Key Vault in West Europe.

Architecture Overview

Layer	Tool	Purpose
Provider	—	Azure West Europe region
Network	Terraform	VNet with dedicated subnets
Resources	Terraform	AKS, PostgreSQL, ACR, Key Vault
Namespace	Helm	Traefik ingress controller
Deployment	—	Production instance

---

Configuration

Validation rules, remote repository reference, and integration requirements for the platform.

apiVersion: strata.huybrechts.xyz/v1
kind: configuration
meta:
  name: azure_aks_config
  annotations:
    description: Azure AKS platform — Terraform + Helm on Azure Kubernetes Service
  labels:
    version: "1.0.0"
  tags: [azure, aks, configuration]
spec:
  layering:
    - name: environment
      description: "Deployment environment (dev, staging, prd)"
      required: true

  deployment:
    additional_properties: false
    properties:
      environment:
        pattern: "^(dev|staging|prd)$"
        required: true
        description: "Target environment"

  zones:
    - name: eu_west
      description: "Western Europe (Netherlands, UK, France)"
      regions:
        - westeurope
        - uksouth
        - francecentral
    - name: us_east
      description: "US East (Virginia, New York)"
      regions:
        - eastus
        - eastus2

  remotes:
    - name: azure_aks
      type: gitops
      repository: git@github.com:your-org/azure-aks-config.git
      reference: main
      source_path: .
      deploy_path: .

  integrations:
    - name: git
      type: git
      capabilities: [repository]
      required: true
      validation:
        command: git --version
        min_version: "2.30.0"
      authentication:
        method: cli

    - name: terraform
      type: terraform
      capabilities: [infrastructure]
      required: true
      validation:
        command: terraform --version
        min_version: "1.6.0"
      authentication:
        method: cli

    - name: azure_cli
      type: azure_cli
      capabilities: [infrastructure]
      required: true
      validation:
        command: az --version
      authentication:
        method: cli

    - name: kubectl
      type: kubectl
      capabilities: [container]
      required: true
      validation:
        command: kubectl version --client
      authentication:
        method: cli

    - name: helm
      type: helm
      capabilities: [container]
      required: true
      validation:
        command: helm version
        min_version: "3.12.0"
      authentication:
        method: cli

    - name: infracost
      type: infracost
      capabilities: [cost]
      required: false
      validation:
        command: infracost --version
        min_version: "0.10.0"
      authentication:
        method: cli

---

Workspace

Infrastructure blueprint — wires providers, provisioners, topology, resources, and namespaces together.

apiVersion: strata.huybrechts.xyz/v1
kind: workspace
meta:
  name: azure_aks_platform
  annotations:
    description: Azure AKS platform workspace — Terraform provisions, Helm deploys
  labels:
    version: "1.0.0"
  tags: [azure, aks, workspace]
spec:
  providers:
    - name: azure_westeurope
      file: "@azure_aks/stack/azure-provider-westeurope.yaml"

  provisioners:
    - name: terraform
      provisioner: terraform
      source:
        repository: azure_aks
        source_path: terraform

    - name: helm
      provisioner: helm
      source:
        repository: azure_aks
        source_path: charts

  topology:
    - name: aks_cluster
      provider: azure_westeurope
      provisioner: terraform
      type: kubernetes
      components:
        - resource: aks_cluster
        - resource: postgres
        - resource: acr
        - resource: keyvault
      namespaces:
        - namespace: platform

  resources:
    - name: aks_cluster
      file: "@azure_aks/stack/azure-res-aks.yaml"
      description: Azure Kubernetes Service cluster
    - name: postgres
      file: "@azure_aks/stack/azure-res-postgres.yaml"
      description: Azure Database for PostgreSQL Flexible Server
    - name: acr
      file: "@azure_aks/stack/azure-res-acr.yaml"
      description: Azure Container Registry
    - name: keyvault
      file: "@azure_aks/stack/azure-res-keyvault.yaml"
      description: Azure Key Vault for secrets management

  namespaces:
    - name: platform
      file: "@azure_aks/stack/azure-ns-platform.yaml"

---

Provider

apiVersion: strata.huybrechts.xyz/v1
kind: provider
meta:
  name: azure_westeurope
  annotations:
    description: Azure West Europe region
  labels:
    version: "1.0.0"
  tags: [azure, provider, westeurope]
spec:
  properties:
    type: azure
    region: westeurope

---

Network

VNet with dedicated subnets for AKS nodes, PostgreSQL, and private endpoints.

apiVersion: strata.huybrechts.xyz/v1
kind: network
meta:
  name: azure_net_platform
  annotations:
    description: Azure Virtual Network for the AKS platform
  labels:
    version: "1.0.0"
  tags: [azure, network, vnet]
spec:
  networks:
    - name: vnet_platform
      description: Platform VNet for AKS and supporting services
      address_space:
        - value: "10.0.0.0/16"
      subnets:
        - name: snet_aks
          cidr:
            value: "10.0.0.0/20"
          description: AKS node pool subnet
        - name: snet_postgres
          cidr:
            value: "10.0.16.0/24"
          description: PostgreSQL delegated subnet
        - name: snet_endpoints
          cidr:
            value: "10.0.17.0/24"
          description: Private endpoints (ACR, Key Vault)

---

Resources

AKS Cluster

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: azure_aks_cluster
  annotations:
    description: Azure Kubernetes Service cluster
  labels:
    version: "1.0.0"
  tags: [azure, aks, resource, kubernetes]
spec:
  properties:
    provider_type: azure
    resource_type: aks_cluster
    category: compute
    subcategory: kubernetes
  configuration:
    kubernetes_version: "1.30"
    node_pool_vm_size: Standard_D4s_v5
    node_pool_count: 3
    node_pool_min: 2
    node_pool_max: 5
    network_plugin: azure
    network_policy: calico

PostgreSQL Flexible Server

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: azure_postgres
  annotations:
    description: Azure Database for PostgreSQL — Flexible Server
  labels:
    version: "1.0.0"
  tags: [azure, resource, postgresql, database]
spec:
  properties:
    provider_type: azure
    resource_type: postgresql_flexible
    category: database
    subcategory: relational
  configuration:
    sku_name: GP_Standard_D2s_v3
    storage_mb: 32768
    postgresql_version: "16"
    geo_redundant_backup: true
    high_availability:
      mode: ZoneRedundant

Azure Container Registry

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: azure_acr
  annotations:
    description: Azure Container Registry for storing container images
  labels:
    version: "1.0.0"
  tags: [azure, resource, acr, registry]
spec:
  properties:
    provider_type: azure
    resource_type: container_registry
    category: container
    subcategory: registry
  configuration:
    sku: Premium
    admin_enabled: false
    geo_replication:
      - westeurope
      - uksouth

Key Vault

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: azure_keyvault
  annotations:
    description: Azure Key Vault for secrets and certificate management
  labels:
    version: "1.0.0"
  tags: [azure, resource, keyvault, secrets]
spec:
  properties:
    provider_type: azure
    resource_type: key_vault
    category: security
    subcategory: secrets
  configuration:
    sku: premium
    soft_delete_retention_days: 90
    purge_protection: true
    enable_rbac_authorization: true

---

Namespace

Application namespace grouping the platform’s Helm modules.

apiVersion: strata.huybrechts.xyz/v1
kind: namespace
meta:
  name: azure_aks_ns_platform
  annotations:
    description: Platform namespace — ingress, monitoring, and shared services
  labels:
    version: "1.0.0"
  tags: [azure, aks, namespace, platform]
spec:
  modules:
    - name: traefik
      file: "@azure_aks/stack/azure-mod-traefik.yaml"

---

Module

Traefik Ingress Controller

apiVersion: strata.huybrechts.xyz/v1
kind: module
meta:
  name: azure_aks_mod_traefik
  annotations:
    description: Traefik ingress controller deployed via Helm on AKS
  labels:
    version: "1.0.0"
  tags: [azure, aks, module, traefik, ingress]
spec:
  type: helm
  source:
    chart_repository: https://helm.traefik.io/traefik
    chart_name: traefik
    chart_version: "28.0.0"
  kubernetes_namespace: traefik
  services:
    - name: traefik
      configuration:
        ingressClass:
          enabled: true
          isDefaultClass: true
        service:
          type: LoadBalancer
          annotations:
            service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: /ping

---

Environment

Production environment variables and secrets (sensitive values are resolved from the environment at runtime).

apiVersion: strata.huybrechts.xyz/v1
kind: environment
meta:
  name: azure_aks_env_prd
  annotations:
    description: Production environment for Azure AKS platform
  labels:
    version: "1.0.0"
  tags: [azure, aks, production, environment]
spec:
  variables:
    - key: WORKSPACE
      store: constant
      value: azure_aks
    - key: ENVIRONMENT
      store: constant
      value: prd
    - key: AZURE_SUBSCRIPTION_ID
      store: environment
      value: AZURE_SUBSCRIPTION_ID
    - key: AZURE_RESOURCE_GROUP
      store: constant
      value: rg-aks-prd-westeurope
    - key: AZURE_LOCATION
      store: constant
      value: westeurope
    - key: AKS_CLUSTER_NAME
      store: constant
      value: aks-platform-prd
    - key: ACR_NAME
      store: constant
      value: acrplatformprd
    - key: KEYVAULT_NAME
      store: constant
      value: kv-platform-prd
    - key: POSTGRES_SERVER_NAME
      store: constant
      value: psql-platform-prd

  secrets:
    - key: ARM_CLIENT_ID
      store: environment
      value: ARM_CLIENT_ID
    - key: ARM_CLIENT_SECRET
      store: environment
      value: ARM_CLIENT_SECRET
    - key: ARM_TENANT_ID
      store: environment
      value: ARM_TENANT_ID

---

Deployment

The concrete production deployment instance — binds workspace, environment, and stages.

apiVersion: strata.huybrechts.xyz/v1
kind: deployment
meta:
  name: azure_aks_deploy_prd
  annotations:
    description: Production deployment for Azure AKS platform
  labels:
    version: "1.0.0"
  tags: [azure, aks, production, deployment]
spec:
  layers:
    environment: prd

  properties:
    environment: prd

  workspace:
    name: azure_aks_platform
    description: Azure AKS Platform Workspace
    file: "@azure_aks/stack/azure-ws-platform.yaml"

  environments:
    - "@azure_aks/environments/azure-aks-env-prd.yaml"

  stages:
    - name: infrastructure
      provisioner: terraform
      scope: all
      on_failure: stop

    - name: platform
      provisioner: helm
      scope: all
      depends_on: [infrastructure]
      on_failure: stop