AKS Production - Hub-Spoke East US 2
About This Architecture
Hub-spoke network topology for AKS production in East US 2, with Azure Firewall Premium and VPN Gateway securing the hub, while a dedicated spoke VNet hosts the AKS cluster across system and user node pools. Internet traffic flows through a public IP to Application Gateway v2 with WAF, then to an nginx Ingress Controller that routes to ClusterIP/LoadBalancer services backed by a 3-pod ReplicaSet managed by HPA. Workload identity integrates with Azure AD, Key Vault CSI injects secrets, NetworkPolicy enforces pod-to-pod communication, and Azure Monitor with Log Analytics provides observability across the cluster. Fork this diagram to customize subnets, node pool sizes, or add additional spokes for multi-region failover.
People also ask
How do I design a production AKS cluster with hub-spoke networking, Azure Firewall, and WAF protection?
This diagram shows a hub-spoke topology where the hub VNet (10.0.0.0/16) hosts Azure Firewall Premium and VPN Gateway, while the spoke VNet (10.1.0.0/16) contains AKS with segregated subnets for DMZ ingress, system pods, and user workloads. Traffic flows from the internet through a public IP to Application Gateway v2 with WAF policy, then to the nginx Ingress Controller, with workload identity lin
- Domain:
- Kubernetes
- Audience:
- Azure Kubernetes Service (AKS) architects and DevOps engineers designing production-grade, secure multi-tier Kubernetes
Generated by Diagrams.so — AI architecture diagram generator with native Draw.io output. Fork this diagram, remix it, or download as .drawio, PNG, or SVG.
