In lesson W1.2 the Kladde ran in a local cluster, without an identity and without a secret. Now it gets a real one: an AKS cluster in Automatic mode in the
germanywestcentral region, with an identity, a Key Vault, a registry and a Service Bus namespace. At the end of this lesson the web app reads its
Booking--LinkKey from the Key Vault without a key sitting in the repository, in the cluster or in an environment variable. After that you
tear everything down again.
What costs money: an AKS cluster as long as nodes are running, even without load (W1.1); on top of that the tier of cluster management, outbound traffic through the managed NAT gateway, log and metric data, the registry, the Key Vault and the Service Bus namespace. This lesson names no figures; the current state comes from the pricing calculator. That is why the budget alarm comes before the cluster and the teardown at the end of every exercise.
K3 (Bicep, managed identity, Key Vault, registry) and W1.2 (the manifests under k8s/) are assumed. Nothing of that is repeated; where it helps,
there is a reference such as "Lesson 3.3.1".
What AKS Automatic takes off your hands, and what it does not
The documentation of AKS Automatic names what is set up out of the box. Six things count for this lesson:
| Preconfigured (always on, cannot be changed) | Consequence for you |
|---|---|
| Azure RBAC for Kubernetes as sign-in and authorization | You grant access with Azure roles, not with local accounts (section "Access: Entra ID and Azure RBAC for Kubernetes") |
| Workload Identity with Microsoft Entra Workload ID and the OIDC issuer | Pods sign in to Azure without a secret (section "Workload Identity: the pod as an Azure identity") |
| Deployment Safeguards and Pod Security Standards (Baseline) in Enforce mode | Manifests must meet the rules from W1.2 |
| Managed system node pools and automatic node provisioning | You do not create node pools; what you request determines the nodes |
| Automatic upgrades through the stable channel (minor version N-1) and the channel for node images | Versions do not run away on their own, but you plan them (section "Upgrades, versions and pod disruption budgets") |
The managed resource group of the nodes (MC_…) is locked |
Changes there are not possible, and it is deleted along with the cluster |
And what stays with you? The manifests, the identities and their roles, the registry and its images, the Key Vault, the entrance (W1.5), the scaling of your application (W1.6) and the costs. AKS Automatic takes the operation of the cluster off your hands, not the operation of your application.