Azure · AKS
What the socle builds
Section titled “What the socle builds”Two applies, no one-apply root yet.
opentofu/azure builds a resource group, a
VNet with a NAT gateway, and a private AKS Standard cluster with Node
Auto-Provisioning, no CNI, Entra Workload ID and a two-node system pool.
opentofu/bootstrap with
cloud = "azure" then installs Cilium (BYO CNI) and Flux, and Flux renders
the catalog. The shared Gateways run on Cilium.
Start with Prerequisites, then the Azure quickstart. What is decided for you is in Foundations.
Per cluster. US dollars, France Central list prices, September 2026, before tax.
| Line | Per month |
|---|---|
| Control plane, Standard tier ($0.10/hour) | $73.00 |
| NAT gateway ($0.045/hour, plus $0.045/GB) | $32.85 |
| API server private endpoint ($0.01/hour, plus $0.01/GB) | $7.30 |
| Nodes | the VM price; NAP adds no meter |
Under the hood
- Reference estate (one prod 24/7, two UAT 12 hours per working day, one Standard_D4s_v5 and one Standard_D8s_v5 each): control plane and nodes $1,060.34 a month, against $1,338.99 on AKS Automatic.
- Not counted: the two
systemnodes (2 × Standard_D2s_v5), and the Container Insights and Managed Prometheus ingestion the module still turns on, billed per GB.
Status
Section titled “Status”- Built: the foundations and the bootstrap’s
azurebranch, bothtofu tested with mocked providers. The plan against floci-az fails on its self-signed certificate; not a required check. - Never applied on a real subscription: BYO CNI with NAP, the private cluster and Cilium on AKS are unproven. Convergence is proven on AWS (floci) only.
- Not offered yet: Velero, a Crossplane Azure provider,
kube.keda.services(limits).