Azure Stack Blog

7 MIN READ

How do AKS and AKS on Azure Stack HCI compare?

Microsoft

Nov 19, 2021

Hey! I’m Abhilasha, a PM on the AKS-HCI team. In this blog, I wanted to share some of the similarities and differences between AKS-HCI and AKS.

AKS on Azure and has been generally available for years. AKS on Azure Stack HCI is an on-premises implementation of AKS, it runs in customer environments on customer managed hardware. We basically want to achieve world peace and support running AKS everywhere outside of Azure.

Feature Set	AKS-HCI	AKS
Kubernetes Management Cluster (lifecycle operations)
Who manages the management cluster?	Split management – mostly managed by the service with some admin config (networking, required certs, etc).	Managed by AKS; hidden from your view
Where is the management cluster located?	In your datacenter. Currently, we support: Azure Stack HCI 21H2 Windows Server 2019 Datacenter Windows Server 2022 Datacenter	Azure cloud; hidden from your view
Well, who manages the hardware where this is running?	All physical hardware things – storage, network, servers, etc are managed by you	Storage, network, etc are created and managed for you when you create an AKS cluster; visible to you
How do you update the management cluster?	PS commands initiated by you (Update-Akshci) Windows Admin Center GUI initiated by you Note: Workload cluster update is covered in the below section.	Azure managed updates; hidden from customer view

Kubernetes Target Cluster (lifecycle operations)
Who manages the cluster?	Managed by you	Managed by you
Where is the cluster located?	In your datacenter alongside your AKS-HCI management cluster	Azure cloud
K8s cluster lifecycle management (create, scale, update and delete clusters)	PowerShell (PS) Windows Admin Center (WAC)	Az CLI Az PowerShell Azure Portal ARM templates Terraform Pulumi and many more!
Can you use kubectl and other open-source Kubernetes tools?	Yes! AKS-HCI is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution	Yes! AKS is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution
Workload cluster updates	K8s version upgrade through PowerShell or WAC. Initiated by you. node OS image update initiated by you; Updates in a target cluster happen at the cluster level – control plane nodes + node pools updated.	Azure CLI, Azure PS, Portal, ARM templates, GitHub Actions; OS image patch upgrade; Automatic upgrades; Planned maintenance windows;
Kubernetes versions	~same as AKS: 1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2 (as of 11/5/2021)	1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2, 1.22.1, 1.22.2 (as of 11/5/2021)
Can you start/stop K8s clusters to save costs?	Yes, by stopping the underlying failover cluster	Yes, by using Az CLI commands or Azure Portal

Node Pools
Do you support running Linux and Windows node pools in the same cluster?	Yes! Linux nodes: CBL-Mariner Windows nodes: Windows Server 2019 Datacenter	Yes! Linux nodes: Ubuntu 18.04 Windows nodes: Windows Server 2019 Datacenter
What’s your container runtime?	Linux nodes: containerd Windows nodes: Docker	Linux nodes: containerd Windows nodes: Docker (default), containerd (preview)
Can you scale node pools?	Yes! No auto-scaler yet	Yes! You can auto scale node pools in AKS Scale down a cluster without deleting the K8s nodes
What about virtual nodes?	No, we do not have support for virtual nodes yet	Yes! Virtual nodes are only supported with Linux pods and nodes. This is based on the open-source project Virtual Kubelet.
Can you upgrade a node pool?	We do not support upgrading individual node pools. All upgrades happen at the K8s cluster level.	You can perform node pool specific upgrades in an AKS cluster.

Networking
Who creates and manages the networks?	All networks (for both the management cluster and target K8s clusters) are created and managed by you	By default, Azure creates the virtual network and subnet for you. You can also choose an existing virtual network to create your AKS clusters
What type of network options are supported?	Support logical networks: DHCP networks with/without VLAN ID Static IP networks with/without VLAN ID We do not have SDN support yet	Support Azure virtual networks in 2 network models: Kubenet (default) – Networks created alongside AKS Azure-CNI – use existing virtual networks and configurations
Load balancer	HAProxy – runs in a separate VM in the target K8s cluster kubeVIP – runs as a K8s service in the control plane K8s node Load balancers are always given Static IP addresses to ensure application and K8s cluster availability	Azure load balancer – Basic SKU or Standard SKU Can also use internal load balancer By default, load balancer IP address is tied to load balancer ARM resource. You can also assign a static public IP address directly to your Kubernetes service
CNI/Network plugin	Flannel Calico (default) Note: Network policies are covered in the Security and Authentication section.	Azure CNI Calico Note: Network policies are covered in the Security and Authentication section.
Load balancers	Default load balancer for services is HA Proxy, however, you can also use your own cluster load balancer like MetalLB
Ingress controllers	You can add ingress controllers like Nginx, Traefik etc. using common Kubernetes guidance.	Default ingress control in Azure is the Azure load balancer. You can deploy additional ingress controls like Nginx.
Egress controls	Egress is controlled by Network policies, by default all outbound traffic from pods is blocked. You can deploy additional egress controls and policies.	Default setting is to not allow traffic from pod-to-pod. You can use Azure Policy and NSGs to control network flow or use Calico policies. You can also use Azure FW and Azure Security Groups.
Egress types	Load Balancer is the only built-in egress type in AKS-HCI	Azure load balancer, managed NAT gateway and user defined routes are the supported egress types
Customize CoreDNS	Allowed	Allowed

Storage
Where is the storage provisioned?	On-premises	Azure Storage. You can also deploy any custom storage class.
What types of persistent volumes are supported?	Read Write Once Read Write Many	Read Write Once Read Write Many
Do the storage drivers support Container Storage Interface (CSI)?	Yes	Yes
Is dynamic provisioning supported?	Yes	Yes
Is volume resizing supported?	Yes	Yes
Are volume snapshots supported?	No	Yes

Security and Authentication
How do you access your Kubernetes cluster?	Certificate based kubeconfig (default) AD based kubeconfig	Certificate based kubeconfig (default) AAD based kubeconfig
Azure Policy	Yes! Through Azure Arc enabled K8s (free for AKS-HCI customers)	Yes!
Azure Security	Yes! Through Azure Arc enabled K8s Azure Security Center Azure Defender	Yes! Azure Security Center Azure Defender
Network Policies	Yes! We support Calico network policies	Yes! We support Calico and Azure CNI network policies
Limit access to API server	Yes! By using VIP pools.	Yes! By using the “-api-server-authorized-ip-ranges” parameter and private clusters.
Cluster RBAC	Yes, with added setup (RBAC manager)	Yes! Azure RBAC, AAD
Certificate rotation and secrets encryption	Yes!	Yes!
Support for private cluster	Not supported yet	Yes! You can create private AKS clusters
Secrets store CSI driver	Yes!	Yes!
Support for disk encryption	Yes via bitlocker	Disks are encrypted on the storage side with platform managed keys and with support for customer provided keys. Hosts and locally attached disks can also be encrypted with encryption at host.
Support for node-to-node traffic encryption	Can be enabled via Calico Wireguard	Can be enabled via Calico Wireguard
Pod identity support	Not yet Windows containers - gMSA	Pod identity is in public preview Windows containers - gMSA

Monitoring and Logging
Support for Azure Monitor	Yes! Through Azure Arc enabled K8s	Yes!
Collect logs	Yes! Through PS (Get-AksHciLogs) and WAC. All logs – management cluster, control plane nodes, target K8s clusters are collected.	Yes! Through Azure Portal, Az CLI, etc
SSH into K8s nodes to troubleshoot	Yes! You can SSH into Linux and Windows nodes	Yes! You can SSH into Linux and Windows nodes. However, we recommend using cloud native logging tools like AKS periscope or inspector gadget.
On-premises logging and monitoring tools	Yes! You can connect to Prometheus & Grafana using AKS-HCI PS commands (Install-AksHciMonitoring) You can also setup EFK on your AKS-HCI clusters.	Not applicable. AKS is entirely based in Azure!

Develop and run applications
Azure App service	Yes! Through Azure Arc enabled K8s	Yes!
Azure Functions	Yes! Through Azure Arc enabled K8s	Yes!
Azure Logic Apps	Yes! Through Azure Arc enabled K8s	Yes!
Install applications using Helm	Yes!	Yes!
OpenFaas	Yes!	Yes!
Bridge to Kubernetes	Yes!	Yes!
Open Liberty/WebSphere Liberty	Yes!	Yes!
Run Spark jobs	Pending validation	Yes!
Use GPUs	In preview	Yes!
PostgreSQL	Pending validation	Yes!
MySQL	Pending validation	Yes!
Service Mesh	Yes! We support Open Service Mesh (OSM) through Azure Arc enabled Kubernetes.	Open Service Mesh Istio LinkerD Consul Connect

DevOps	Azure DevOps through Azure Arc enabled K8s. GitOps through Azure Arc enabled Kubernetes is free for AKS-HCI customers.	Ansible Jenkins Azure DevOps GitHub Actions Terraform

Product Pricing
Product pricing	Pricing based on number of workload cluster vCPUs. Management cluster, control plane nodes, load balancers are free.	Unlimited free clusters, pay for on-demand compute of the worker nodes.
Azure Support	AKS-HCI is supported out of the Windows Server support organization aligned with Arc for Kubernetes and Azure Stack HCI. You can open support requests through the Azure portal and other support channels like Premier Support.	AKS in Azure is supported through enterprise class support in the Azure team. You can open support requests in the Azure portal.
SLA	We do not offer SLAs since AKS-HCI runs in your environment.	Paid uptime SLA clusters for production with fixed cost on the API + worker node compute cost.

Updated Nov 23, 2021

Version 2.0

Azure Stack HCI

scooley

Microsoft

Joined May 24, 2017

View Profile

Azure Stack Blog

Follow this blog board to get notified when there's new activity

\n Feature Set \n	\n AKS-HCI \n	\n AKS \n
\n Kubernetes Management Cluster \n (lifecycle operations) \n
\n Who manages the management cluster? \n	\n Split management – mostly managed by the service with some admin config (networking, required certs, etc). \n	\n Managed by AKS; hidden from your view \n
\n Where is the management cluster located? \n	\n In your datacenter. Currently, we support: \n Azure Stack HCI 21H2 \n Windows Server 2019 Datacenter \n Windows Server 2022 Datacenter \n	\n Azure cloud; hidden from your view \n
\n Well, who manages the hardware where this is running? \n	\n All physical hardware things – storage, network, servers, etc are managed by you \n	\n Storage, network, etc are created and managed for you when you create an AKS cluster; visible to you \n
\n How do you update the management cluster? \n	\n PS commands initiated by you (Update-Akshci) \n Windows Admin Center GUI initiated by you \n Note: Workload cluster update is covered in the below section. \n	\n Azure managed updates; hidden from customer view \n
\n \n	\n \n	\n \n
\n Kubernetes Target Cluster \n (lifecycle operations) \n	\n \n	\n \n
\n Who manages the cluster? \n	\n Managed by you \n	\n Managed by you \n
\n Where is the cluster located? \n	\n In your datacenter alongside your AKS-HCI management cluster \n	\n Azure cloud \n
\n K8s cluster lifecycle management (create, scale, update and delete clusters) \n	\n PowerShell (PS) \n Windows Admin Center (WAC) \n	\n Az CLI \n Az PowerShell \n Azure Portal \n ARM templates \n Terraform \n Pulumi and many more! \n
\n Can you use kubectl and other open-source Kubernetes tools? \n	\n Yes! AKS-HCI is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution \n	\n Yes! AKS is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution \n
\n Workload cluster updates \n	\n K8s version upgrade through PowerShell or WAC. Initiated by you. \n node OS image update initiated by you; \n Updates in a target cluster happen at the cluster level – control plane nodes + node pools updated. \n	\n Azure CLI, Azure PS, Portal, ARM templates, GitHub Actions; \n OS image patch upgrade; \n Automatic upgrades; \n Planned maintenance windows; \n \n
\n Kubernetes versions \n	\n ~same as AKS: \n 1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2 (as of 11/5/2021) \n	\n 1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2, 1.22.1, 1.22.2 (as of 11/5/2021) \n
\n Can you start/stop K8s clusters to save costs? \n	\n Yes, by stopping the underlying failover cluster \n	\n Yes, by using Az CLI commands or Azure Portal \n
\n \n	\n \n	\n \n
\n Node Pools \n	\n \n	\n \n
\n Do you support running Linux and Windows node pools in the same cluster? \n	\n Yes! \n Linux nodes: CBL-Mariner \n Windows nodes: Windows Server 2019 Datacenter \n	\n Yes! \n Linux nodes: Ubuntu 18.04 \n Windows nodes: Windows Server 2019 Datacenter \n
\n What’s your container runtime? \n	\n Linux nodes: containerd \n Windows nodes: Docker \n	\n Linux nodes: containerd \n Windows nodes: Docker (default), containerd (preview) \n
\n Can you scale node pools? \n	\n Yes! \n No auto-scaler yet \n	\n Yes! \n You can auto scale node pools in AKS \n Scale down a cluster without deleting the K8s nodes \n \n
\n What about virtual nodes? \n	\n No, we do not have support for virtual nodes yet \n	\n Yes! Virtual nodes are only supported with Linux pods and nodes. This is based on the open-source project Virtual Kubelet. \n
\n Can you upgrade a node pool? \n	\n We do not support upgrading individual node pools. All upgrades happen at the K8s cluster level. \n	\n You can perform node pool specific upgrades in an AKS cluster. \n
\n \n	\n \n	\n \n
\n Networking \n	\n \n	\n \n
\n Who creates and manages the networks? \n	\n All networks (for both the management cluster and target K8s clusters) are created and managed by you \n	\n By default, Azure creates the virtual network and subnet for you. You can also choose an existing virtual network to create your AKS clusters \n
\n What type of network options are supported? \n	\n Support logical networks: \n DHCP networks with/without VLAN ID \n Static IP networks with/without VLAN ID \n We do not have SDN support yet \n \n	\n Support Azure virtual networks in 2 network models: \n Kubenet (default) – Networks created alongside AKS \n Azure-CNI – use existing virtual networks and configurations \n
\n Load balancer \n	\n HAProxy – runs in a separate VM in the target K8s cluster \n kubeVIP – runs as a K8s service in the control plane K8s node \n Load balancers are always given Static IP addresses to ensure application and K8s cluster availability \n	\n Azure load balancer – Basic SKU or Standard SKU \n Can also use internal load balancer \n By default, load balancer IP address is tied to load balancer ARM resource. You can also assign a static public IP address directly to your Kubernetes service \n
\n CNI/Network plugin \n	\n Flannel \n Calico (default) \n Note: Network policies are covered in the Security and Authentication section. \n	\n Azure CNI \n Calico \n Note: Network policies are covered in the Security and Authentication section. \n
\n Load balancers \n	\n Default load balancer for services is HA Proxy, however, you can also use your own cluster load balancer like MetalLB \n	\n \n
\n Ingress controllers \n	\n You can add ingress controllers like Nginx, Traefik etc. using common Kubernetes guidance. \n	\n Default ingress control in Azure is the Azure load balancer. You can deploy additional ingress controls like Nginx. \n
\n Egress controls \n	\n Egress is controlled by Network policies, by default all outbound traffic from pods is blocked. You can deploy additional egress controls and policies. \n	\n Default setting is to not allow traffic from pod-to-pod. You can use Azure Policy and NSGs to control network flow or use Calico policies. You can also use Azure FW and Azure Security Groups. \n
\n Egress types \n	\n Load Balancer is the only built-in egress type in AKS-HCI \n	\n Azure load balancer, managed NAT gateway and user defined routes are the supported egress types \n
\n Customize CoreDNS \n	\n Allowed \n	\n Allowed \n
\n \n	\n \n	\n \n
\n Storage \n	\n \n	\n \n
\n Where is the storage provisioned? \n	\n On-premises \n	\n Azure Storage. You can also deploy any custom storage class. \n
\n What types of persistent volumes are supported? \n	\n Read Write Once \n Read Write Many \n	\n Read Write Once \n Read Write Many \n
\n Do the storage drivers support Container Storage Interface (CSI)? \n	\n Yes \n	\n Yes \n
\n Is dynamic provisioning supported? \n	\n Yes \n	\n Yes \n
\n Is volume resizing supported? \n	\n Yes \n	\n Yes \n
\n Are volume snapshots supported? \n	\n No \n	\n Yes \n
\n \n	\n \n	\n \n
\n Security and Authentication \n	\n \n	\n \n
\n How do you access your Kubernetes cluster? \n	\n Certificate based kubeconfig (default) \n AD based kubeconfig \n	\n Certificate based kubeconfig (default) \n AAD based kubeconfig \n
\n Azure Policy \n	\n Yes! Through Azure Arc enabled K8s (free for AKS-HCI customers) \n	\n Yes! \n
\n Azure Security \n	\n Yes! Through Azure Arc enabled K8s Azure Security Center Azure Defender \n	\n Yes! \n Azure Security Center Azure Defender \n
\n Network Policies \n	\n Yes! We support Calico network policies \n	\n Yes! We support Calico and Azure CNI network policies \n
\n Limit access to API server \n	\n Yes! By using VIP pools. \n	\n Yes! By using the “-api-server-authorized-ip-ranges” parameter and private clusters. \n
\n Cluster RBAC \n	\n Yes, with added setup (RBAC manager) \n	\n Yes! Azure RBAC, AAD \n
\n Certificate rotation and secrets encryption \n	\n Yes! \n	\n Yes! \n
\n Support for private cluster \n	\n Not supported yet \n	\n Yes! You can create private AKS clusters \n
\n Secrets store CSI driver \n	\n Yes! \n	\n Yes! \n
\n Support for disk encryption \n	\n Yes via bitlocker \n	\n Disks are encrypted on the storage side with platform managed keys and with support for customer provided keys. \n Hosts and locally attached disks can also be encrypted with encryption at host. \n
\n Support for node-to-node traffic encryption \n	\n Can be enabled via Calico Wireguard \n	\n Can be enabled via Calico Wireguard \n
\n Pod identity support \n	\n Not yet \n Windows containers - gMSA \n	\n Pod identity is in public preview \n Windows containers - gMSA \n
\n \n	\n \n	\n \n
\n Monitoring and Logging \n	\n \n	\n \n
\n Support for Azure Monitor \n	\n Yes! Through Azure Arc enabled K8s \n	\n Yes! \n
\n Collect logs \n	\n Yes! Through PS (Get-AksHciLogs) and WAC. All logs – management cluster, control plane nodes, target K8s clusters are collected. \n	\n Yes! Through Azure Portal, Az CLI, etc \n
\n SSH into K8s nodes to troubleshoot \n	\n Yes! You can SSH into Linux and Windows nodes \n	\n Yes! You can SSH into Linux and Windows nodes. However, we recommend using cloud native logging tools like AKS periscope or inspector gadget. \n
\n On-premises logging and monitoring tools \n	\n Yes! You can connect to Prometheus & Grafana using AKS-HCI PS commands (Install-AksHciMonitoring) \n You can also setup EFK on your AKS-HCI clusters. \n	\n Not applicable. AKS is entirely based in Azure! \n
\n \n	\n \n	\n \n
\n Develop and run applications \n	\n \n	\n \n
\n Azure App service \n	\n Yes! Through Azure Arc enabled K8s \n	\n Yes! \n
\n Azure Functions \n	\n Yes! Through Azure Arc enabled K8s \n	\n Yes! \n
\n Azure Logic Apps \n	\n Yes! Through Azure Arc enabled K8s \n	\n Yes! \n
\n Install applications using Helm \n	\n Yes! \n	\n Yes! \n
\n OpenFaas \n	\n Yes! \n	\n Yes! \n
\n Bridge to Kubernetes \n	\n Yes! \n	\n Yes! \n
\n Open Liberty/WebSphere Liberty \n	\n Yes! \n	\n Yes! \n
\n Run Spark jobs \n	\n Pending validation \n	\n Yes! \n
\n Use GPUs \n	\n In preview \n	\n Yes! \n
\n PostgreSQL \n	\n Pending validation \n	\n Yes! \n
\n MySQL \n \n	\n Pending validation \n	\n Yes! \n
\n Service Mesh \n	\n Yes! We support Open Service Mesh (OSM) through Azure Arc enabled Kubernetes. \n	\n Open Service Mesh \n Istio \n LinkerD \n Consul Connect \n
\n \n	\n \n	\n \n
\n DevOps \n	\n Azure DevOps through Azure Arc enabled K8s. GitOps through Azure Arc enabled Kubernetes is free for AKS-HCI customers. \n	\n Ansible \n Jenkins \n Azure DevOps \n GitHub Actions \n Terraform \n
\n \n	\n \n	\n \n
\n Product Pricing \n	\n \n	\n \n
\n Product pricing \n	\n Pricing based on number of workload cluster vCPUs. Management cluster, control plane nodes, load balancers are free. \n	\n Unlimited free clusters, pay for on-demand compute of the worker nodes. \n \n
\n Azure Support \n	\n AKS-HCI is supported out of the Windows Server support organization aligned with Arc for Kubernetes and Azure Stack HCI. You can open support requests through the Azure portal and other support channels like Premier Support. \n	\n AKS in Azure is supported through enterprise class support in the Azure team. You can open support requests in the Azure portal. \n
\n SLA \n	\n We do not offer SLAs since AKS-HCI runs in your environment. \n	\n Paid uptime SLA clusters for production with fixed cost on the API + worker node compute cost. \n \n

Feature Set

AKS-HCI

AKS

Kubernetes Management Cluster

(lifecycle operations)

Who manages the management cluster?

Split management – mostly managed by the service with some admin config (networking, required certs, etc).

Managed by AKS; hidden from your view

Where is the management cluster located?

In your datacenter. Currently, we support:

Azure Stack HCI 21H2

Windows Server 2019 Datacenter

Windows Server 2022 Datacenter

Azure cloud; hidden from your view

Well, who manages the hardware where this is running?

All physical hardware things – storage, network, servers, etc are managed by you

Storage, network, etc are created and managed for you when you create an AKS cluster; visible to you

How do you update the management cluster?

PS commands initiated by you (Update-Akshci)

Windows Admin Center GUI initiated by you

Note: Workload cluster update is covered in the below section.

Azure managed updates; hidden from customer view

Kubernetes Target Cluster

(lifecycle operations)

Who manages the cluster?

Managed by you

Where is the cluster located?

In your datacenter alongside your AKS-HCI management cluster

Azure cloud

K8s cluster lifecycle management (create, scale, update and delete clusters)

PowerShell (PS)

Windows Admin Center (WAC)

Az CLI

Az PowerShell

Azure Portal

ARM templates

Terraform

Pulumi and many more!

Can you use kubectl and other open-source Kubernetes tools?

Yes! AKS-HCI is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution

Yes! AKS is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution

Workload cluster updates

K8s version upgrade through PowerShell or WAC. Initiated by you.

node OS image update initiated by you;

Updates in a target cluster happen at the cluster level – control plane nodes + node pools updated.

Azure CLI, Azure PS, Portal, ARM templates, GitHub Actions;

OS image patch upgrade;

Automatic upgrades;

Planned maintenance windows;

Kubernetes versions

~same as AKS:

1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2 (as of 11/5/2021)

1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2, 1.22.1, 1.22.2 (as of 11/5/2021)

Can you start/stop K8s clusters to save costs?

Yes, by stopping the underlying failover cluster

Yes, by using Az CLI commands or Azure Portal

Node Pools

Do you support running Linux and Windows node pools in the same cluster?

Yes!

Linux nodes: CBL-Mariner

Windows nodes: Windows Server 2019 Datacenter

Yes!

Linux nodes: Ubuntu 18.04

Windows nodes: Windows Server 2019 Datacenter

What’s your container runtime?

Linux nodes: containerd

Windows nodes: Docker

Linux nodes: containerd

Windows nodes: Docker (default), containerd (preview)

Can you scale node pools?

Yes!

No auto-scaler yet

Yes!

You can auto scale node pools in AKS

Scale down a cluster without deleting the K8s nodes

What about virtual nodes?

No, we do not have support for virtual nodes yet

Yes! Virtual nodes are only supported with Linux pods and nodes. This is based on the open-source project Virtual Kubelet.

Can you upgrade a node pool?

We do not support upgrading individual node pools. All upgrades happen at the K8s cluster level.

You can perform node pool specific upgrades in an AKS cluster.

Networking

Who creates and manages the networks?

All networks (for both the management cluster and target K8s clusters) are created and managed by you

By default, Azure creates the virtual network and subnet for you. You can also choose an existing virtual network to create your AKS clusters

What type of network options are supported?

Support logical networks:

DHCP networks with/without VLAN ID

Static IP networks with/without VLAN ID

We do not have SDN support yet

Support Azure virtual networks in 2 network models:

Kubenet (default) – Networks created alongside AKS

Azure-CNI – use existing virtual networks and configurations

Load balancer

HAProxy – runs in a separate VM in the target K8s cluster

kubeVIP – runs as a K8s service in the control plane K8s node

Load balancers are always given Static IP addresses to ensure application and K8s cluster availability

Azure load balancer – Basic SKU or Standard SKU

Can also use internal load balancer

By default, load balancer IP address is tied to load balancer ARM resource. You can also assign a static public IP address directly to your Kubernetes service

CNI/Network plugin

Flannel

Calico (default)

Note: Network policies are covered in the Security and Authentication section.

Azure CNI

Calico

Note: Network policies are covered in the Security and Authentication section.

Load balancers

Default load balancer for services is HA Proxy, however, you can also use your own cluster load balancer like MetalLB

Ingress controllers

You can add ingress controllers like Nginx, Traefik etc. using common Kubernetes guidance.

Default ingress control in Azure is the Azure load balancer. You can deploy additional ingress controls like Nginx.

Egress controls

Egress is controlled by Network policies, by default all outbound traffic from pods is blocked. You can deploy additional egress controls and policies.

Default setting is to not allow traffic from pod-to-pod. You can use Azure Policy and NSGs to control network flow or use Calico policies. You can also use Azure FW and Azure Security Groups.

Egress types

Load Balancer is the only built-in egress type in AKS-HCI

Azure load balancer, managed NAT gateway and user defined routes are the supported egress types

Customize CoreDNS

Allowed

Storage

Where is the storage provisioned?

On-premises

Azure Storage. You can also deploy any custom storage class.

What types of persistent volumes are supported?

Read Write Once

Read Write Many

Read Write Once

Read Write Many

Do the storage drivers support Container Storage Interface (CSI)?

Yes

Is dynamic provisioning supported?

Yes

Is volume resizing supported?

Yes

Are volume snapshots supported?

Yes

Security and Authentication

How do you access your Kubernetes cluster?

Certificate based kubeconfig (default)

AD based kubeconfig

Certificate based kubeconfig (default)

AAD based kubeconfig

Azure Policy

Yes! Through Azure Arc enabled K8s (free for AKS-HCI customers)

Yes!

Azure Security

Yes! Through Azure Arc enabled K8s
Azure Security Center
Azure Defender

Yes!

Azure Security Center
Azure Defender

Network Policies

Yes! We support Calico network policies

Yes! We support Calico and Azure CNI network policies

Limit access to API server

Yes! By using VIP pools.

Yes! By using the “-api-server-authorized-ip-ranges” parameter and private clusters.

Cluster RBAC

Yes, with added setup (RBAC manager)

Yes! Azure RBAC, AAD

Certificate rotation and secrets encryption

Yes!

Support for private cluster

Not supported yet

Yes! You can create private AKS clusters

Secrets store CSI driver

Yes!

Support for disk encryption

Yes via bitlocker

Disks are encrypted on the storage side with platform managed keys and with support for customer provided keys.

Hosts and locally attached disks can also be encrypted with encryption at host.

Support for node-to-node traffic encryption

Can be enabled via Calico Wireguard

Pod identity support

Not yet

Windows containers - gMSA

Pod identity is in public preview

Windows containers - gMSA

Monitoring and Logging

Support for Azure Monitor

Yes! Through Azure Arc enabled K8s

Yes!

Collect logs

Yes! Through PS (Get-AksHciLogs) and WAC. All logs – management cluster, control plane nodes, target K8s clusters are collected.

Yes! Through Azure Portal, Az CLI, etc

SSH into K8s nodes to troubleshoot

Yes! You can SSH into Linux and Windows nodes

Yes! You can SSH into Linux and Windows nodes. However, we recommend using cloud native logging tools like AKS periscope or inspector gadget.

On-premises logging and monitoring tools

Yes! You can connect to Prometheus & Grafana using AKS-HCI PS commands (Install-AksHciMonitoring)

You can also setup EFK on your AKS-HCI clusters.

Not applicable. AKS is entirely based in Azure!

Develop and run applications

Azure App service

Yes! Through Azure Arc enabled K8s

Yes!

Azure Functions

Yes! Through Azure Arc enabled K8s

Yes!

Azure Logic Apps

Yes! Through Azure Arc enabled K8s

Yes!

Install applications using Helm

Yes!

OpenFaas

Yes!

Bridge to Kubernetes

Yes!

Open Liberty/WebSphere Liberty

Yes!

Run Spark jobs

Pending validation

Yes!

Use GPUs

In preview

Yes!

PostgreSQL

Pending validation

Yes!

MySQL

Pending validation

Yes!

Service Mesh

Yes! We support Open Service Mesh (OSM) through Azure Arc enabled Kubernetes.

Open Service Mesh

Istio

LinkerD

Consul Connect

DevOps

Azure DevOps through Azure Arc enabled K8s. GitOps through Azure Arc enabled Kubernetes is free for AKS-HCI customers.

Terraform

Product Pricing

Product pricing

Pricing based on number of workload cluster vCPUs. Management cluster, control plane nodes, load balancers are free.

Unlimited free clusters, pay for on-demand compute of the worker nodes.

Azure Support

AKS-HCI is supported out of the Windows Server support organization aligned with Arc for Kubernetes and Azure Stack HCI. You can open support requests through the Azure portal and other support channels like Premier Support.

AKS in Azure is supported through enterprise class support in the Azure team. You can open support requests in the Azure portal.

SLA

We do not offer SLAs since AKS-HCI runs in your environment.

Paid uptime SLA clusters for production with fixed cost on the API + worker node compute cost.

\n Feature Set \n	\n AKS-HCI \n	\n AKS \n
\n Kubernetes Management Cluster \n (lifecycle operations) \n
\n Who manages the management cluster? \n	\n Split management – mostly managed by the service with some admin config (networking, required certs, etc). \n	\n Managed by AKS; hidden from your view \n
\n Where is the management cluster located? \n	\n In your datacenter. Currently, we support: \n Azure Stack HCI 21H2 \n Windows Server 2019 Datacenter \n Windows Server 2022 Datacenter \n	\n Azure cloud; hidden from your view \n
\n Well, who manages the hardware where this is running? \n	\n All physical hardware things – storage, network, servers, etc are managed by you \n	\n Storage, network, etc are created and managed for you when you create an AKS cluster; visible to you \n
\n How do you update the management cluster? \n	\n PS commands initiated by you (Update-Akshci) \n Windows Admin Center GUI initiated by you \n Note: Workload cluster update is covered in the below section. \n	\n Azure managed updates; hidden from customer view \n
\n \n	\n \n	\n \n
\n Kubernetes Target Cluster \n (lifecycle operations) \n	\n \n	\n \n
\n Who manages the cluster? \n	\n Managed by you \n	\n Managed by you \n
\n Where is the cluster located? \n	\n In your datacenter alongside your AKS-HCI management cluster \n	\n Azure cloud \n
\n K8s cluster lifecycle management (create, scale, update and delete clusters) \n	\n PowerShell (PS) \n Windows Admin Center (WAC) \n	\n Az CLI \n Az PowerShell \n Azure Portal \n ARM templates \n Terraform \n Pulumi and many more! \n
\n Can you use kubectl and other open-source Kubernetes tools? \n	\n Yes! AKS-HCI is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution \n	\n Yes! AKS is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution \n
\n Workload cluster updates \n	\n K8s version upgrade through PowerShell or WAC. Initiated by you. \n node OS image update initiated by you; \n Updates in a target cluster happen at the cluster level – control plane nodes + node pools updated. \n	\n Azure CLI, Azure PS, Portal, ARM templates, GitHub Actions; \n OS image patch upgrade; \n Automatic upgrades; \n Planned maintenance windows; \n \n
\n Kubernetes versions \n	\n ~same as AKS: \n 1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2 (as of 11/5/2021) \n	\n 1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2, 1.22.1, 1.22.2 (as of 11/5/2021) \n
\n Can you start/stop K8s clusters to save costs? \n	\n Yes, by stopping the underlying failover cluster \n	\n Yes, by using Az CLI commands or Azure Portal \n
\n \n	\n \n	\n \n
\n Node Pools \n	\n \n	\n \n
\n Do you support running Linux and Windows node pools in the same cluster? \n	\n Yes! \n Linux nodes: CBL-Mariner \n Windows nodes: Windows Server 2019 Datacenter \n	\n Yes! \n Linux nodes: Ubuntu 18.04 \n Windows nodes: Windows Server 2019 Datacenter \n
\n What’s your container runtime? \n	\n Linux nodes: containerd \n Windows nodes: Docker \n	\n Linux nodes: containerd \n Windows nodes: Docker (default), containerd (preview) \n
\n Can you scale node pools? \n	\n Yes! \n No auto-scaler yet \n	\n Yes! \n You can auto scale node pools in AKS \n Scale down a cluster without deleting the K8s nodes \n \n
\n What about virtual nodes? \n	\n No, we do not have support for virtual nodes yet \n	\n Yes! Virtual nodes are only supported with Linux pods and nodes. This is based on the open-source project Virtual Kubelet. \n
\n Can you upgrade a node pool? \n	\n We do not support upgrading individual node pools. All upgrades happen at the K8s cluster level. \n	\n You can perform node pool specific upgrades in an AKS cluster. \n
\n \n	\n \n	\n \n
\n Networking \n	\n \n	\n \n
\n Who creates and manages the networks? \n	\n All networks (for both the management cluster and target K8s clusters) are created and managed by you \n	\n By default, Azure creates the virtual network and subnet for you. You can also choose an existing virtual network to create your AKS clusters \n
\n What type of network options are supported? \n	\n Support logical networks: \n DHCP networks with/without VLAN ID \n Static IP networks with/without VLAN ID \n We do not have SDN support yet \n \n	\n Support Azure virtual networks in 2 network models: \n Kubenet (default) – Networks created alongside AKS \n Azure-CNI – use existing virtual networks and configurations \n
\n Load balancer \n	\n HAProxy – runs in a separate VM in the target K8s cluster \n kubeVIP – runs as a K8s service in the control plane K8s node \n Load balancers are always given Static IP addresses to ensure application and K8s cluster availability \n	\n Azure load balancer – Basic SKU or Standard SKU \n Can also use internal load balancer \n By default, load balancer IP address is tied to load balancer ARM resource. You can also assign a static public IP address directly to your Kubernetes service \n
\n CNI/Network plugin \n	\n Flannel \n Calico (default) \n Note: Network policies are covered in the Security and Authentication section. \n	\n Azure CNI \n Calico \n Note: Network policies are covered in the Security and Authentication section. \n
\n Load balancers \n	\n Default load balancer for services is HA Proxy, however, you can also use your own cluster load balancer like MetalLB \n	\n \n
\n Ingress controllers \n	\n You can add ingress controllers like Nginx, Traefik etc. using common Kubernetes guidance. \n	\n Default ingress control in Azure is the Azure load balancer. You can deploy additional ingress controls like Nginx. \n
\n Egress controls \n	\n Egress is controlled by Network policies, by default all outbound traffic from pods is blocked. You can deploy additional egress controls and policies. \n	\n Default setting is to not allow traffic from pod-to-pod. You can use Azure Policy and NSGs to control network flow or use Calico policies. You can also use Azure FW and Azure Security Groups. \n
\n Egress types \n	\n Load Balancer is the only built-in egress type in AKS-HCI \n	\n Azure load balancer, managed NAT gateway and user defined routes are the supported egress types \n
\n Customize CoreDNS \n	\n Allowed \n	\n Allowed \n
\n \n	\n \n	\n \n
\n Storage \n	\n \n	\n \n
\n Where is the storage provisioned? \n	\n On-premises \n	\n Azure Storage. You can also deploy any custom storage class. \n
\n What types of persistent volumes are supported? \n	\n Read Write Once \n Read Write Many \n	\n Read Write Once \n Read Write Many \n
\n Do the storage drivers support Container Storage Interface (CSI)? \n	\n Yes \n	\n Yes \n
\n Is dynamic provisioning supported? \n	\n Yes \n	\n Yes \n
\n Is volume resizing supported? \n	\n Yes \n	\n Yes \n
\n Are volume snapshots supported? \n	\n No \n	\n Yes \n
\n \n	\n \n	\n \n
\n Security and Authentication \n	\n \n	\n \n
\n How do you access your Kubernetes cluster? \n	\n Certificate based kubeconfig (default) \n AD based kubeconfig \n	\n Certificate based kubeconfig (default) \n AAD based kubeconfig \n
\n Azure Policy \n	\n Yes! Through Azure Arc enabled K8s (free for AKS-HCI customers) \n	\n Yes! \n
\n Azure Security \n	\n Yes! Through Azure Arc enabled K8s Azure Security Center Azure Defender \n	\n Yes! \n Azure Security Center Azure Defender \n
\n Network Policies \n	\n Yes! We support Calico network policies \n	\n Yes! We support Calico and Azure CNI network policies \n
\n Limit access to API server \n	\n Yes! By using VIP pools. \n	\n Yes! By using the “-api-server-authorized-ip-ranges” parameter and private clusters. \n
\n Cluster RBAC \n	\n Yes, with added setup (RBAC manager) \n	\n Yes! Azure RBAC, AAD \n
\n Certificate rotation and secrets encryption \n	\n Yes! \n	\n Yes! \n
\n Support for private cluster \n	\n Not supported yet \n	\n Yes! You can create private AKS clusters \n
\n Secrets store CSI driver \n	\n Yes! \n	\n Yes! \n
\n Support for disk encryption \n	\n Yes via bitlocker \n	\n Disks are encrypted on the storage side with platform managed keys and with support for customer provided keys. \n Hosts and locally attached disks can also be encrypted with encryption at host. \n
\n Support for node-to-node traffic encryption \n	\n Can be enabled via Calico Wireguard \n	\n Can be enabled via Calico Wireguard \n
\n Pod identity support \n	\n Not yet \n Windows containers - gMSA \n	\n Pod identity is in public preview \n Windows containers - gMSA \n
\n \n	\n \n	\n \n
\n Monitoring and Logging \n	\n \n	\n \n
\n Support for Azure Monitor \n	\n Yes! Through Azure Arc enabled K8s \n	\n Yes! \n
\n Collect logs \n	\n Yes! Through PS (Get-AksHciLogs) and WAC. All logs – management cluster, control plane nodes, target K8s clusters are collected. \n	\n Yes! Through Azure Portal, Az CLI, etc \n
\n SSH into K8s nodes to troubleshoot \n	\n Yes! You can SSH into Linux and Windows nodes \n	\n Yes! You can SSH into Linux and Windows nodes. However, we recommend using cloud native logging tools like AKS periscope or inspector gadget. \n
\n On-premises logging and monitoring tools \n	\n Yes! You can connect to Prometheus & Grafana using AKS-HCI PS commands (Install-AksHciMonitoring) \n You can also setup EFK on your AKS-HCI clusters. \n	\n Not applicable. AKS is entirely based in Azure! \n
\n \n	\n \n	\n \n
\n Develop and run applications \n	\n \n	\n \n
\n Azure App service \n	\n Yes! Through Azure Arc enabled K8s \n	\n Yes! \n
\n Azure Functions \n	\n Yes! Through Azure Arc enabled K8s \n	\n Yes! \n
\n Azure Logic Apps \n	\n Yes! Through Azure Arc enabled K8s \n	\n Yes! \n
\n Install applications using Helm \n	\n Yes! \n	\n Yes! \n
\n OpenFaas \n	\n Yes! \n	\n Yes! \n
\n Bridge to Kubernetes \n	\n Yes! \n	\n Yes! \n
\n Open Liberty/WebSphere Liberty \n	\n Yes! \n	\n Yes! \n
\n Run Spark jobs \n	\n Pending validation \n	\n Yes! \n
\n Use GPUs \n	\n In preview \n	\n Yes! \n
\n PostgreSQL \n	\n Pending validation \n	\n Yes! \n
\n MySQL \n \n	\n Pending validation \n	\n Yes! \n
\n Service Mesh \n	\n Yes! We support Open Service Mesh (OSM) through Azure Arc enabled Kubernetes. \n	\n Open Service Mesh \n Istio \n LinkerD \n Consul Connect \n
\n \n	\n \n	\n \n
\n DevOps \n	\n Azure DevOps through Azure Arc enabled K8s. GitOps through Azure Arc enabled Kubernetes is free for AKS-HCI customers. \n	\n Ansible \n Jenkins \n Azure DevOps \n GitHub Actions \n Terraform \n
\n \n	\n \n	\n \n
\n Product Pricing \n	\n \n	\n \n
\n Product pricing \n	\n Pricing based on number of workload cluster vCPUs. Management cluster, control plane nodes, load balancers are free. \n	\n Unlimited free clusters, pay for on-demand compute of the worker nodes. \n \n
\n Azure Support \n	\n AKS-HCI is supported out of the Windows Server support organization aligned with Arc for Kubernetes and Azure Stack HCI. You can open support requests through the Azure portal and other support channels like Premier Support. \n	\n AKS in Azure is supported through enterprise class support in the Azure team. You can open support requests in the Azure portal. \n
\n SLA \n	\n We do not offer SLAs since AKS-HCI runs in your environment. \n	\n Paid uptime SLA clusters for production with fixed cost on the API + worker node compute cost. \n \n

Feature Set

AKS-HCI

AKS

Kubernetes Management Cluster

(lifecycle operations)

Who manages the management cluster?

Split management – mostly managed by the service with some admin config (networking, required certs, etc).

Managed by AKS; hidden from your view

Where is the management cluster located?

In your datacenter. Currently, we support:

Azure Stack HCI 21H2

Windows Server 2019 Datacenter

Windows Server 2022 Datacenter

Azure cloud; hidden from your view

Well, who manages the hardware where this is running?

All physical hardware things – storage, network, servers, etc are managed by you

Storage, network, etc are created and managed for you when you create an AKS cluster; visible to you

How do you update the management cluster?

PS commands initiated by you (Update-Akshci)

Windows Admin Center GUI initiated by you

Note: Workload cluster update is covered in the below section.

Azure managed updates; hidden from customer view

Kubernetes Target Cluster

(lifecycle operations)

Who manages the cluster?

Managed by you

Where is the cluster located?

In your datacenter alongside your AKS-HCI management cluster

Azure cloud

K8s cluster lifecycle management (create, scale, update and delete clusters)

PowerShell (PS)

Windows Admin Center (WAC)

Az CLI

Az PowerShell

Azure Portal

ARM templates

Terraform

Pulumi and many more!

Can you use kubectl and other open-source Kubernetes tools?

Yes! AKS-HCI is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution

Yes! AKS is a Cloud Native Computing Foundation (CNCF) certified Kubernetes distribution

Workload cluster updates

K8s version upgrade through PowerShell or WAC. Initiated by you.

node OS image update initiated by you;

Updates in a target cluster happen at the cluster level – control plane nodes + node pools updated.

Azure CLI, Azure PS, Portal, ARM templates, GitHub Actions;

OS image patch upgrade;

Automatic upgrades;

Planned maintenance windows;

Kubernetes versions

~same as AKS:

1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2 (as of 11/5/2021)

1.19.11, 1.19.13, 1.20.7, 1.20.9 (default), 1.21.1, 1.21.2, 1.22.1, 1.22.2 (as of 11/5/2021)

Can you start/stop K8s clusters to save costs?

Yes, by stopping the underlying failover cluster

Yes, by using Az CLI commands or Azure Portal

Node Pools

Do you support running Linux and Windows node pools in the same cluster?

Yes!

Linux nodes: CBL-Mariner

Windows nodes: Windows Server 2019 Datacenter

Yes!

Linux nodes: Ubuntu 18.04

Windows nodes: Windows Server 2019 Datacenter

What’s your container runtime?

Linux nodes: containerd

Windows nodes: Docker

Linux nodes: containerd

Windows nodes: Docker (default), containerd (preview)

Can you scale node pools?

Yes!

No auto-scaler yet

Yes!

You can auto scale node pools in AKS

Scale down a cluster without deleting the K8s nodes

What about virtual nodes?

No, we do not have support for virtual nodes yet

Yes! Virtual nodes are only supported with Linux pods and nodes. This is based on the open-source project Virtual Kubelet.

Can you upgrade a node pool?

We do not support upgrading individual node pools. All upgrades happen at the K8s cluster level.

You can perform node pool specific upgrades in an AKS cluster.

Networking

Who creates and manages the networks?

All networks (for both the management cluster and target K8s clusters) are created and managed by you

By default, Azure creates the virtual network and subnet for you. You can also choose an existing virtual network to create your AKS clusters

What type of network options are supported?

Support logical networks:

DHCP networks with/without VLAN ID

Static IP networks with/without VLAN ID

We do not have SDN support yet

Support Azure virtual networks in 2 network models:

Kubenet (default) – Networks created alongside AKS

Azure-CNI – use existing virtual networks and configurations

Load balancer

HAProxy – runs in a separate VM in the target K8s cluster

kubeVIP – runs as a K8s service in the control plane K8s node

Load balancers are always given Static IP addresses to ensure application and K8s cluster availability

Azure load balancer – Basic SKU or Standard SKU

Can also use internal load balancer

By default, load balancer IP address is tied to load balancer ARM resource. You can also assign a static public IP address directly to your Kubernetes service

CNI/Network plugin

Flannel

Calico (default)

Note: Network policies are covered in the Security and Authentication section.

Azure CNI

Calico

Note: Network policies are covered in the Security and Authentication section.

Load balancers

Default load balancer for services is HA Proxy, however, you can also use your own cluster load balancer like MetalLB

Ingress controllers

You can add ingress controllers like Nginx, Traefik etc. using common Kubernetes guidance.

Default ingress control in Azure is the Azure load balancer. You can deploy additional ingress controls like Nginx.

Egress controls

Egress is controlled by Network policies, by default all outbound traffic from pods is blocked. You can deploy additional egress controls and policies.

Default setting is to not allow traffic from pod-to-pod. You can use Azure Policy and NSGs to control network flow or use Calico policies. You can also use Azure FW and Azure Security Groups.

Egress types

Load Balancer is the only built-in egress type in AKS-HCI

Azure load balancer, managed NAT gateway and user defined routes are the supported egress types

Customize CoreDNS

Allowed

Storage

Where is the storage provisioned?

On-premises

Azure Storage. You can also deploy any custom storage class.

What types of persistent volumes are supported?

Read Write Once

Read Write Many

Read Write Once

Read Write Many

Do the storage drivers support Container Storage Interface (CSI)?

Yes

Is dynamic provisioning supported?

Yes

Is volume resizing supported?

Yes

Are volume snapshots supported?

Yes

Security and Authentication

How do you access your Kubernetes cluster?

Certificate based kubeconfig (default)

AD based kubeconfig

Certificate based kubeconfig (default)

AAD based kubeconfig

Azure Policy

Yes! Through Azure Arc enabled K8s (free for AKS-HCI customers)

Yes!

Azure Security

Yes! Through Azure Arc enabled K8s
Azure Security Center
Azure Defender

Yes!

Azure Security Center
Azure Defender

Network Policies

Yes! We support Calico network policies

Yes! We support Calico and Azure CNI network policies

Limit access to API server

Yes! By using VIP pools.

Yes! By using the “-api-server-authorized-ip-ranges” parameter and private clusters.

Cluster RBAC

Yes, with added setup (RBAC manager)

Yes! Azure RBAC, AAD

Certificate rotation and secrets encryption

Yes!

Support for private cluster

Not supported yet

Yes! You can create private AKS clusters

Secrets store CSI driver

Yes!

Support for disk encryption

Yes via bitlocker

Disks are encrypted on the storage side with platform managed keys and with support for customer provided keys.

Hosts and locally attached disks can also be encrypted with encryption at host.

Support for node-to-node traffic encryption

Can be enabled via Calico Wireguard

Pod identity support

Not yet

Windows containers - gMSA

Pod identity is in public preview

Windows containers - gMSA

Monitoring and Logging

Support for Azure Monitor

Yes! Through Azure Arc enabled K8s

Yes!

Collect logs

Yes! Through PS (Get-AksHciLogs) and WAC. All logs – management cluster, control plane nodes, target K8s clusters are collected.

Yes! Through Azure Portal, Az CLI, etc

SSH into K8s nodes to troubleshoot

Yes! You can SSH into Linux and Windows nodes

Yes! You can SSH into Linux and Windows nodes. However, we recommend using cloud native logging tools like AKS periscope or inspector gadget.

On-premises logging and monitoring tools

Yes! You can connect to Prometheus & Grafana using AKS-HCI PS commands (Install-AksHciMonitoring)

You can also setup EFK on your AKS-HCI clusters.

Not applicable. AKS is entirely based in Azure!

Develop and run applications

Azure App service

Yes! Through Azure Arc enabled K8s

Yes!

Azure Functions

Yes! Through Azure Arc enabled K8s

Yes!

Azure Logic Apps

Yes! Through Azure Arc enabled K8s

Yes!

Install applications using Helm

Yes!

OpenFaas

Yes!

Bridge to Kubernetes

Yes!

Open Liberty/WebSphere Liberty

Yes!

Run Spark jobs

Pending validation

Yes!

Use GPUs

In preview

Yes!

PostgreSQL

Pending validation

Yes!

MySQL

Pending validation

Yes!

Service Mesh

Yes! We support Open Service Mesh (OSM) through Azure Arc enabled Kubernetes.

Open Service Mesh

Istio

LinkerD

Consul Connect

DevOps

Azure DevOps through Azure Arc enabled K8s. GitOps through Azure Arc enabled Kubernetes is free for AKS-HCI customers.

Terraform

Product Pricing

Product pricing

Pricing based on number of workload cluster vCPUs. Management cluster, control plane nodes, load balancers are free.

Unlimited free clusters, pay for on-demand compute of the worker nodes.

Azure Support

AKS in Azure is supported through enterprise class support in the Azure team. You can open support requests in the Azure portal.

SLA

We do not offer SLAs since AKS-HCI runs in your environment.

Paid uptime SLA clusters for production with fixed cost on the API + worker node compute cost.

Blog Post

How do AKS and AKS on Azure Stack HCI compare?

3 Comments