Azure · AKS

What the socle builds

Two applies, no one-apply root yet. opentofu/azure builds a resource group, a VNet with a NAT gateway, and a private AKS Standard cluster with Node Auto-Provisioning, no CNI, Entra Workload ID and a two-node system pool. opentofu/bootstrap with cloud = "azure" then installs Cilium (BYO CNI) and Flux, and Flux renders the catalog. The shared Gateways run on Cilium.

Start with Prerequisites, then the Azure quickstart. What is decided for you is in Foundations.

Cost

Per cluster. US dollars, France Central list prices, September 2026, before tax.

Line	Per month
Control plane, Standard tier ($0.10/hour)	$73.00
NAT gateway ($0.045/hour, plus $0.045/GB)	$32.85
API server private endpoint ($0.01/hour, plus $0.01/GB)	$7.30
Nodes	the VM price; NAP adds no meter

Under the hood

• Reference estate (one prod 24/7, two UAT 12 hours per working day, one Standard_D4s_v5 and one Standard_D8s_v5 each): control plane and nodes $1,060.34 a month, against $1,338.99 on AKS Automatic.
• Not counted: the two system nodes (2 × Standard_D2s_v5), and the Container Insights and Managed Prometheus ingestion the module still turns on, billed per GB.

Status

• Built: the foundations and the bootstrap’s azure branch, both tofu tested with mocked providers. The plan against floci-az fails on its self-signed certificate; not a required check.
• Never applied on a real subscription: BYO CNI with NAP, the private cluster and Cilium on AKS are unproven. Convergence is proven on AWS (floci) only.
• Not offered yet: Velero, a Crossplane Azure provider, kube.keda.services (limits).