AKS single-region multi-resource-group architecture separates networking, compute, and storage across dedicated resource groups for improved governance and cost tracking. Users route through Application Gateway and Load Balancer to an Ingress controller, which distributes traffic to Pods running in the production Namespace managed by Deployments with HorizontalPodAutoscaler scaling. The AKS cluster Control Plane orchestrates Node Pools backed by VM Scale Sets running Standard_D4s_v3 VMs, pulling container images from Azure Container Registry and mounting Premium SSD Managed Disks for persistent storage. Private Endpoints secure access to Blob Storage and Key Vault, while ConfigMaps and Network Security Groups enforce configuration and network policies. This multi-resource-group pattern enables teams to isolate blast radius, delegate permissions by function, and optimize billing across infrastructure layers. Fork this diagram on Diagrams.so to customize resource names, VM SKUs, subnet ranges, or add additional node pools for workload isolation. Consider adding Azure Policy assignments and role-based access control (RBAC) definitions for production hardening.