AKS & Kubernetes Platform
A production-ready AKS platform, not a demo cluster
Between an AKS cluster that runs and a Kubernetes platform that dozens of teams rely on, there is security, automation, observability and an operating model. That is exactly what I bring.
Who is it for?
Platform and DevOps teams industrializing AKS for several product teams, hardening an existing cluster, or migrating workloads from VMs, OpenShift or another orchestrator.
What I deliver
- Cluster architecture: node pools, networking (Azure CNI, overlay), ingress / API gateway, private DNS, workload identities
- Hardening: Entra Workload Identity, Azure Policy for Kubernetes, Defender for Containers, signed images, secrets in Key Vault
- GitOps delivery (Argo CD / Flux), Helm, on-demand environments and promotion across environments
- Observability: Azure Monitor managed Prometheus, Grafana, central logging, SLOs and alerting
- Kubernetes FinOps: right-sizing, autoscaling (KEDA, cluster autoscaler), spot nodes, cost allocation per team
- Operating model: upgrades, maintenance, runbooks, on-call and handover to your teams
Method in 4 steps
- 1
Assessment
Inventory of workloads and consuming teams; network, security and compliance constraints; reasoned choice between AKS, Container Apps and App Service.
Deliverable: Scoping note and validated target
- 2
Architecture
Node pools, networking (Azure CNI or overlay), ingress via Gateway API, private DNS, Workload Identity, GitOps (Argo CD or Flux). Migration plan in batches.
Deliverable: Target architecture and migration plan
- 3
Industrialization
Clusters and components in Terraform or Bicep, Azure Policy for Kubernetes, Defender for Containers, managed Prometheus and Grafana, SLOs and alerting. First workloads migrated.
Deliverable: Production platform and first services migrated
- 4
Adoption
Onboarding of pilot teams, golden paths (Helm, template pipelines), upgrade and on-call runbooks, handover to the platform team.
Deliverable: Golden paths, runbooks and an autonomous platform team
Proof points
Multi-team platforms
AKS run as an internal product with isolation, quotas and chargeback per team
Enterprise AI in production
secure, governed AKS + Microsoft Foundry architecture delivered for a major media group
Talks & lessons learned
public conferences on AKS, agentgateway and cloud-native AI
Cost, timeline and deliverables of a typical engagement
Three formats, from the shortest to the most complete. Durations are orders of magnitude observed on my engagements; the exact scope and quote are set after the first 30-minute call, within 48 hours.
5 to 10 days
AKS cluster assessment
Configuration review (network, identity, security, scaling, cost), gaps against Microsoft and CNCF good practices, prioritised remediation plan.
3 to 6 weeks
AKS platform architecture
Architecture document: cluster topology, network and ingress, Workload Identity, GitOps, observability, upgrade policy, multi-team model and cost estimate.
2 to 4 months
Industrialisation and adoption
Clusters deployed with Terraform or Bicep, GitOps (Flux or Argo CD) in place, monitoring chain, runbooks, and application teams deploying on the platform by themselves.
Fixed price for the assessment and the architecture, capped time-and-materials for industrialisation. The daily rate and conditions (remote, on site, duration) are stated in the proposal. No licence resale and no managed services: you own the code and the tenant.
- Knowledge transfer included at every step (pair reviews, workshops, documentation)
- Code and pipelines delivered in your repository, under your licence
- Weekly progress review with decision makers
Frequently asked questions
AKS, Azure Container Apps or App Service?
AKS is justified when you have several teams, advanced networking or security needs, or workloads that require Kubernetes-level control. For simpler needs I will happily point you to Container Apps or App Service.
Can you assess an existing AKS cluster?
Yes. The assessment covers security (identities, network, policies, images), resilience, observability, cost and the operating model, with a prioritized remediation plan.
Do you also cover AI workloads on AKS?
Yes: model hosting, agent gateways (agentgateway), guardrails and FinOps for agentic AI are part of the platforms I delivered recently.
Discuss this with me
A first 30-minute call is free and without commitment.
Other services
Related articles
Hands-on Azure, AKS, FinOps and agentic AI write-ups published on blog.smartcloudarchitect.fr.
All articles on the blog· 11 min read
Garde-fous IA portables : NeMo Guardrails derrière agentgateway, en fail-closed· 9 min read
FinOps de l'IA agentique : mesurer jetons, coûts et outils par personne, équipe et modèle· 12 min read
Des MCP d'entreprise pour les agents : Azure MCP Server, Microsoft Learn et une couche tickets avec approbation humaine· 12 min read
« Agent Ready » : onboarder une équipe sur une plateforme agentique, sans ticket et avec des droits bornés