From 9cf253ac96394f631479205b42dd72cc1aadbe3f Mon Sep 17 00:00:00 2001 From: Garinlu Date: Mon, 14 Sep 2026 16:48:09 +0200 Subject: [PATCH 1/4] docs(azure): decide AKS Automatic over Standard + NAP MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Automatic already defaults to Cilium and only locks the system node pool, not workload nodes — the CNI conflict that ruled out EKS Auto Mode doesn't exist here. The measured cost is a permanent +17.5% per vCPU-hour on top of a flat control-plane delta, weighed against SLA and day-2 ops the factory would otherwise own. Co-Authored-By: Claude Sonnet 5 --- docs/azure/cluster-mode.md | 117 +++++++++++++++++++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 docs/azure/cluster-mode.md diff --git a/docs/azure/cluster-mode.md b/docs/azure/cluster-mode.md new file mode 100644 index 0000000..a783225 --- /dev/null +++ b/docs/azure/cluster-mode.md @@ -0,0 +1,117 @@ +# AKS cluster mode: Automatic vs Standard + Node Auto-Provisioning + +**AKS Automatic.** Node provisioning, cluster and node-image upgrades, and +baseline security posture are handled by the platform; the factory does not +operate them. + +Need Windows node pools, an IPv6 cluster, a pinned upgrade cadence, or policy +in warning-only mode? Socle is not the right foundation for that cluster. + +## What Automatic actually bundles + +- Locked: the system node pool — hosted outside the subscription, no + `exec`/debug/SSH, no create/update/delete on its resources. +- Locked: node auto-provisioning (NAP) for every workload node — the same + open-source engine Standard uses when NAP is turned on there, preconfigured + here instead of opt-in. +- Locked: cluster auto-upgrade on the stable channel, one minor version + behind the latest supported (N-1); node OS images upgrade the same way. +- Locked: Azure Policy deployment safeguards and baseline Pod Security + Standards, in enforce mode — not warning. +- Locked: Azure RBAC for Kubernetes authorization, workload identity, the + OIDC issuer, image cleaner, API server VNet integration. +- Default, not locked: Azure CNI Overlay powered by Cilium as the VNet's + dataplane. +- Not available at all: Windows node pools, IPv6 clusters — NAP provisions + every node here, and NAP supports neither. + +## The two options + +| | Automatic | Standard + NAP | +| --- | --- | --- | +| Node provisioning | NAP, preconfigured | NAP, opt-in — same engine | +| System components (CoreDNS, etc.) | Hosted by Microsoft, outside the subscription, no access | Hosted and operated by the factory | +| VNet dataplane | Azure CNI Overlay + Cilium, the default | Kubenet is Standard's own default — Cilium is a choice the factory makes | +| Cluster upgrade | Forced, stable channel, N-1 | Manual, or a channel the factory picks | +| Node OS image upgrade | Forced | Manual, or a channel the factory picks | +| Policy enforcement | Azure Policy + Pod Security Standards, enforce mode, forced | Optional — enforce or warning, factory's choice | +| Pod readiness SLA | 99.9% of qualifying operations complete in under 5 minutes, financially backed | None | +| Control plane SLA | 99.95% with availability zones / 99.9% without | Same, on the Standard tier | +| Workload identity, OIDC issuer, image cleaner | Preconfigured | Optional, the factory wires them | +| Windows node pools, IPv6 | Not available | Available, without NAP | + +## Cost + +- Reference estate: one prod environment 24/7, two UAT environments at 12h + per working day. Two nodes per environment (one Standard_D4s_v5, one + Standard_D8s_v5 — 12 vCPU / 48 GiB total), one cluster per environment. +- France Central list price, September 2026. 730-hour month; a UAT + environment is 261 hours (12h × ~21.75 working days). + +| Meter | Rate | +| --- | --- | +| Node Standard_D4s_v5 (4 vCPU / 16 GiB) | $0.224/h | +| Node Standard_D8s_v5 (8 vCPU / 32 GiB) | $0.448/h | +| Control plane, Standard tier | $0.10/h per cluster | +| Control plane, Automatic | $0.16/h per cluster | +| Automatic surcharge, General Purpose class | $0.009801/vCPU/h | + +| Estate of three environments | Standard + NAP | Automatic | +| --- | --- | --- | +| Nodes (identical price either way) | $841.34 | $841.34 | +| Control plane (3 clusters × 730h) | $219.00 | $350.40 | +| Per-vCPU surcharge | — | $147.25 | +| **Total per month** | **$1,060.34** | **$1,338.99** | + +- The control plane delta is flat per cluster — $0.06/h more than Standard, + regardless of node count. It shrinks in relative terms as a fleet grows. +- The per-vCPU surcharge does not: it is a fixed +17.5% on every vCPU-hour of + compute (General Purpose class; $0.009801 ÷ $0.056 of the node's own + per-vCPU rate), for as long as the cluster runs. It does not amortize. +- Node price itself is identical in both modes. + +## Why, beyond cost + +- **CNI.** Azure CNI Overlay powered by Cilium is Automatic's own default + dataplane. There is no incompatible network stack to route around. +- **What's actually locked.** Only the system node pool is inaccessible. + Workload nodes — where everything the catalog runs — keep normal AKS node + behavior: OS choice, SSH, the usual access. +- **Day-2 load.** Cluster upgrades, node image patching, and the policy + baseline run without a factory pipeline tracking every new AKS release. +- **Long-term support stays reachable.** Enabling LTS is a tier change + (`az aks update --tier premium --k8s-support-plan AKSLongTermSupport`), + documented as a configuration-only operation independent of cluster SKU — + nothing in Microsoft's tier or LTS documentation restricts it to Base-SKU + clusters. An Automatic cluster reaches Premium/LTS the same way a Standard + one does. + +## What you give up + +- A pinned Kubernetes or node-image version: upgrades follow the stable + channel automatically, on Microsoft's calendar, not a version the factory + chose and validated first. +- Policy posture flexibility: Azure Policy and Pod Security Standards run in + enforce mode, with no warning-only step to roll out a stricter policy + gradually. +- Visibility into the system node pool: no logs beyond what AKS surfaces, no + exec, no debug. +- Windows node pools and IPv6 clusters, as long as every node goes through + NAP. +- A surcharge that never amortizes: +17.5% on every vCPU-hour, permanently, + not a fee that shrinks in relative terms as the estate grows. + +## Sources + +Read September 2026, France Central pricing. + +[AKS Automatic overview][automatic] · [managed system node pools][system-pools] · +[node auto-provisioning][nap] · [pricing tiers][tiers] · +[long-term support][lts] · [Azure Retail Prices API][retail-prices]. + +[automatic]: https://learn.microsoft.com/en-us/azure/aks/intro-aks-automatic +[system-pools]: https://learn.microsoft.com/en-us/azure/aks/automatic/aks-automatic-managed-system-node-pools-about +[nap]: https://learn.microsoft.com/en-us/azure/aks/node-auto-provisioning +[tiers]: https://learn.microsoft.com/en-us/azure/aks/free-standard-pricing-tiers +[lts]: https://learn.microsoft.com/en-us/azure/aks/long-term-support +[retail-prices]: https://learn.microsoft.com/en-us/rest/api/cost-management/retail-prices/azure-retail-prices From 6e59b55a1af90cda41abdc79f437dc553c5b13b1 Mon Sep 17 00:00:00 2001 From: Garinlu Date: Tue, 15 Sep 2026 09:50:03 +0200 Subject: [PATCH 2/4] docs(azure): pick Standard + NAP over Automatic, spot pricing tips it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The per-vCPU surcharge isn't a percentage of what the node costs, it's a fixed dollar amount — so it barely registers against On-Demand (+17.5%) but nearly doubles Spot (+94.7%), since the same fixed tax lands on a much smaller base price. Against that, Automatic's own case narrows to a pod-readiness SLA and not having to pick an upgrade channel — not enough to keep paying a tax that erases most of the reason to use Spot in the first place. NAP itself is unaffected: same engine, opt-in and explicit on Standard instead of preconfigured. Co-Authored-By: Claude Sonnet 5 --- docs/azure/cluster-mode.md | 119 +++++++++++-------------------------- 1 file changed, 36 insertions(+), 83 deletions(-) diff --git a/docs/azure/cluster-mode.md b/docs/azure/cluster-mode.md index a783225..4b393f2 100644 --- a/docs/azure/cluster-mode.md +++ b/docs/azure/cluster-mode.md @@ -1,117 +1,70 @@ # AKS cluster mode: Automatic vs Standard + Node Auto-Provisioning -**AKS Automatic.** Node provisioning, cluster and node-image upgrades, and -baseline security posture are handled by the platform; the factory does not -operate them. - -Need Windows node pools, an IPv6 cluster, a pinned upgrade cadence, or policy -in warning-only mode? Socle is not the right foundation for that cluster. - -## What Automatic actually bundles - -- Locked: the system node pool — hosted outside the subscription, no - `exec`/debug/SSH, no create/update/delete on its resources. -- Locked: node auto-provisioning (NAP) for every workload node — the same - open-source engine Standard uses when NAP is turned on there, preconfigured - here instead of opt-in. -- Locked: cluster auto-upgrade on the stable channel, one minor version - behind the latest supported (N-1); node OS images upgrade the same way. -- Locked: Azure Policy deployment safeguards and baseline Pod Security - Standards, in enforce mode — not warning. -- Locked: Azure RBAC for Kubernetes authorization, workload identity, the - OIDC issuer, image cleaner, API server VNet integration. -- Default, not locked: Azure CNI Overlay powered by Cilium as the VNet's - dataplane. -- Not available at all: Windows node pools, IPv6 clusters — NAP provisions - every node here, and NAP supports neither. +**AKS Standard + Node Auto-Provisioning.** NAP runs the same engine +Automatic would have preconfigured; the upgrade channel, node-image +patching, and policy enforcement stay the factory's to set. + +Need Windows node pools or an IPv6 cluster? NAP supports neither, on any +tier — Socle is not the right foundation for that cluster. + +## What this bundles + +- NAP provisions and scales workload nodes — the same open-source engine + Automatic uses, opt-in and explicit here instead of preconfigured. +- Upgrade channel, node OS image upgrade, and policy enforcement are the + factory's to configure — nothing locked. +- NAP's own limits apply regardless of tier: no Windows node pools, no IPv6 + clusters. ## The two options -| | Automatic | Standard + NAP | +| | Standard + NAP | Automatic | | --- | --- | --- | -| Node provisioning | NAP, preconfigured | NAP, opt-in — same engine | -| System components (CoreDNS, etc.) | Hosted by Microsoft, outside the subscription, no access | Hosted and operated by the factory | -| VNet dataplane | Azure CNI Overlay + Cilium, the default | Kubenet is Standard's own default — Cilium is a choice the factory makes | -| Cluster upgrade | Forced, stable channel, N-1 | Manual, or a channel the factory picks | -| Node OS image upgrade | Forced | Manual, or a channel the factory picks | -| Policy enforcement | Azure Policy + Pod Security Standards, enforce mode, forced | Optional — enforce or warning, factory's choice | -| Pod readiness SLA | 99.9% of qualifying operations complete in under 5 minutes, financially backed | None | -| Control plane SLA | 99.95% with availability zones / 99.9% without | Same, on the Standard tier | -| Workload identity, OIDC issuer, image cleaner | Preconfigured | Optional, the factory wires them | -| Windows node pools, IPv6 | Not available | Available, without NAP | +| Per-vCPU surcharge | None | +17.5% on On-Demand, +94.7% on Spot | +| Pod readiness SLA | None | 99.9% of qualifying operations in under 5 minutes | +| Upgrade channel, policy enforcement | Factory's choice | Forced | +| System components | Factory-operated | Microsoft-operated, no access | ## Cost - Reference estate: one prod environment 24/7, two UAT environments at 12h per working day. Two nodes per environment (one Standard_D4s_v5, one Standard_D8s_v5 — 12 vCPU / 48 GiB total), one cluster per environment. -- France Central list price, September 2026. 730-hour month; a UAT - environment is 261 hours (12h × ~21.75 working days). - -| Meter | Rate | -| --- | --- | -| Node Standard_D4s_v5 (4 vCPU / 16 GiB) | $0.224/h | -| Node Standard_D8s_v5 (8 vCPU / 32 GiB) | $0.448/h | -| Control plane, Standard tier | $0.10/h per cluster | -| Control plane, Automatic | $0.16/h per cluster | -| Automatic surcharge, General Purpose class | $0.009801/vCPU/h | +- France Central list price, September 2026. | Estate of three environments | Standard + NAP | Automatic | | --- | --- | --- | | Nodes (identical price either way) | $841.34 | $841.34 | -| Control plane (3 clusters × 730h) | $219.00 | $350.40 | +| Control plane | $219.00 | $350.40 | | Per-vCPU surcharge | — | $147.25 | | **Total per month** | **$1,060.34** | **$1,338.99** | -- The control plane delta is flat per cluster — $0.06/h more than Standard, - regardless of node count. It shrinks in relative terms as a fleet grows. -- The per-vCPU surcharge does not: it is a fixed +17.5% on every vCPU-hour of - compute (General Purpose class; $0.009801 ÷ $0.056 of the node's own - per-vCPU rate), for as long as the cluster runs. It does not amortize. -- Node price itself is identical in both modes. +The surcharge is a fixed $/vCPU/h, not a percentage of what the node +actually costs — so it hits hardest exactly where compute is cheapest. On +On-Demand it's +17.5%. On Spot, the same fixed amount is **+94.7%**, +because the underlying VM price it's added to is so much lower. ## Why, beyond cost -- **CNI.** Azure CNI Overlay powered by Cilium is Automatic's own default - dataplane. There is no incompatible network stack to route around. -- **What's actually locked.** Only the system node pool is inaccessible. - Workload nodes — where everything the catalog runs — keep normal AKS node - behavior: OS choice, SSH, the usual access. -- **Day-2 load.** Cluster upgrades, node image patching, and the policy - baseline run without a factory pipeline tracking every new AKS release. -- **Long-term support stays reachable.** Enabling LTS is a tier change - (`az aks update --tier premium --k8s-support-plan AKSLongTermSupport`), - documented as a configuration-only operation independent of cluster SKU — - nothing in Microsoft's tier or LTS documentation restricts it to Base-SKU - clusters. An Automatic cluster reaches Premium/LTS the same way a Standard - one does. +Automatic's entire case against this option is a pod-readiness SLA and not +having to pick an upgrade channel or a policy mode. Against a surcharge +that erases most of the point of using Spot at all, that's not enough — +Automatic charges a permanent tax for conveniences this narrow. ## What you give up -- A pinned Kubernetes or node-image version: upgrades follow the stable - channel automatically, on Microsoft's calendar, not a version the factory - chose and validated first. -- Policy posture flexibility: Azure Policy and Pod Security Standards run in - enforce mode, with no warning-only step to roll out a stricter policy - gradually. -- Visibility into the system node pool: no logs beyond what AKS surfaces, no - exec, no debug. -- Windows node pools and IPv6 clusters, as long as every node goes through - NAP. -- A surcharge that never amortizes: +17.5% on every vCPU-hour, permanently, - not a fee that shrinks in relative terms as the estate grows. +- The pod-readiness SLA (99.9% of qualifying operations in under 5 + minutes) — Automatic-only, financially backed. +- A hands-off upgrade channel and policy baseline: the factory now picks + and maintains both instead of inheriting Microsoft's default. ## Sources Read September 2026, France Central pricing. -[AKS Automatic overview][automatic] · [managed system node pools][system-pools] · -[node auto-provisioning][nap] · [pricing tiers][tiers] · -[long-term support][lts] · [Azure Retail Prices API][retail-prices]. +[AKS Automatic overview][automatic] · [node auto-provisioning][nap] · +[Azure Retail Prices API][retail-prices]. [automatic]: https://learn.microsoft.com/en-us/azure/aks/intro-aks-automatic -[system-pools]: https://learn.microsoft.com/en-us/azure/aks/automatic/aks-automatic-managed-system-node-pools-about [nap]: https://learn.microsoft.com/en-us/azure/aks/node-auto-provisioning -[tiers]: https://learn.microsoft.com/en-us/azure/aks/free-standard-pricing-tiers -[lts]: https://learn.microsoft.com/en-us/azure/aks/long-term-support [retail-prices]: https://learn.microsoft.com/en-us/rest/api/cost-management/retail-prices/azure-retail-prices From 9a468085ab3356de5e73257380c7d7249ee0a987 Mon Sep 17 00:00:00 2001 From: Garinlu Date: Tue, 15 Sep 2026 10:02:39 +0200 Subject: [PATCH 3/4] docs(azure): fix an overstated claim about Spot's own discount MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Automatic's tax doesn't erase Spot's savings on compute — that discount stays intact. What's actually true: the tax itself is fixed, so it doesn't shrink with Spot the way the compute price does, and ends up costing nearly as much as the Spot VM it's added to. Co-Authored-By: Claude Sonnet 5 --- docs/azure/cluster-mode.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/docs/azure/cluster-mode.md b/docs/azure/cluster-mode.md index 4b393f2..db82783 100644 --- a/docs/azure/cluster-mode.md +++ b/docs/azure/cluster-mode.md @@ -46,10 +46,11 @@ because the underlying VM price it's added to is so much lower. ## Why, beyond cost -Automatic's entire case against this option is a pod-readiness SLA and not -having to pick an upgrade channel or a policy mode. Against a surcharge -that erases most of the point of using Spot at all, that's not enough — -Automatic charges a permanent tax for conveniences this narrow. +Automatic's own tax doesn't scale down with Spot — it stays a fixed +$/vCPU/h, so on Spot it costs nearly as much as the compute itself. +Spot's own discount is untouched; the tax on top of it isn't. Against +that, and against a pod-readiness SLA and not having to pick an upgrade +channel or a policy mode, Automatic isn't worth its permanent cost. ## What you give up From 8e7c6ec29b8f74302ff8a1a3d4ba6d3fc7248c6a Mon Sep 17 00:00:00 2001 From: Garinlu Date: Wed, 16 Sep 2026 10:32:04 +0200 Subject: [PATCH 4/4] docs(azure): note NAP carries no Azure charge over self-hosting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A reviewer question surfaced this as worth stating explicitly rather than leaving implicit: verified against the retail price list that the per-category compute surcharge only exists under the Automatic product, not Standard — so NAP costs the same as running Karpenter self-hosted, it just removes the operational burden. Co-Authored-By: Claude Sonnet 5 --- docs/azure/cluster-mode.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/azure/cluster-mode.md b/docs/azure/cluster-mode.md index db82783..076b3e3 100644 --- a/docs/azure/cluster-mode.md +++ b/docs/azure/cluster-mode.md @@ -11,6 +11,11 @@ tier — Socle is not the right foundation for that cluster. - NAP provisions and scales workload nodes — the same open-source engine Automatic uses, opt-in and explicit here instead of preconfigured. +- No separate Azure charge for NAP itself: the retail price list carries a + per-category compute meter only under the Automatic product — Standard + has none. Node price is identical to running Karpenter self-hosted; NAP's + advantage is skipping the operational cost of running that controller, + not a lower bill. - Upgrade channel, node OS image upgrade, and policy enforcement are the factory's to configure — nothing locked. - NAP's own limits apply regardless of tier: no Windows node pools, no IPv6