Hub-spoke network topology for AKS production in East US 2, with Azure Firewall Premium and VPN Gateway securing the hub, while a dedicated spoke VNet hosts the AKS cluster across system and user node pools. Internet traffic flows through a public IP to Application Gateway v2 with WAF, then to an nginx Ingress Controller that routes to ClusterIP/LoadBalancer services backed by a 3-pod ReplicaSet managed by HPA. Workload identity integrates with Azure AD, Key Vault CSI injects secrets, NetworkPolicy enforces pod-to-pod communication, and Azure Monitor with Log Analytics provides observability across the cluster. Fork this diagram to customize subnets, node pool sizes, or add additional spokes for multi-region failover.