Expert Track · AKS · 2026

FRONTIER AKS HACKATHON

Deploy, harden, and operate a production-grade Azure Kubernetes Service cluster from zero — using only current, supported technology.

AKS Automatic & Standard

Workload Identity

Flux v2 GitOps

KEDA + Karpenter

AKS Managed Istio

Managed Prometheus

Azure Managed Grafana

Container Insights

Fleet Manager

AKS Cost Analysis

Start the Hack Read the Briefing →

SCROLL

Core Challenges

AI Track Challenges

Days Estimated

Production Cluster

Mission Brief

WHAT YOU'LL
ACCOMPLISH

Build a complete AKS production environment end-to-end. Every challenge uses Build it right, from the ground up.

01 Deploy a production AKS cluster with Azure CNI Overlay, Cilium, and Availability Zones

02 Eliminate all secret sprawl using Workload Identity + Azure Key Vault CSI driver

03 Achieve full-stack observability with Azure Managed Prometheus & Grafana

04 Scale to zero and beyond with KEDA, HPA, VPA, and Karpenter node provisioning

05 Implement continuous delivery with Flux v2 — Git as the source of truth

06 Harden with Entra RBAC, Azure Policy (OPA), and Defender for Containers

07 Secure service traffic with AKS managed Istio, mTLS, and canary routing

08 Operate a fleet of clusters with AKS Fleet Manager staged upgrades (advanced)

09 Run LLM inference on GPU nodes using KAITO (optional AI track)

10 Track spending by namespace with AKS Cost Analysis, spot node pools, and Azure Advisor (optional FinOps track)

az aks — frontier cluster

$ az aks create \

--network-plugin azure \

--network-plugin-mode overlay \

--network-dataplane cilium \

--enable-oidc-issuer \

--enable-workload-identity \

--os-sku AzureLinux \

--auto-upgrade-channel stable

✓ Cluster provisioned in 8m 42s

✓ OIDC issuer enabled

✓ Workload Identity enabled

✓ Cilium CNI active

$ kubectl get nodes

NAME STATUS VERSION

aks-system-00 Ready v1.31.2

aks-apppool-00 Ready v1.31.2

aks-apppool-01 Ready v1.31.2

Before You Begin

PREREQUISITES

Azure Subscription

Owner role required for RBAC assignments and --attach-acr

Azure CLI ≥ 2.65.0

Install via aka.ms/InstallAzureCLI or run az upgrade

kubectl + kubelogin

Install both with az aks install-cli

Helm ≥ 3.14

Install via helm.sh/docs/intro/install

Flux CLI v2

Install via fluxcd.io/flux/installation

GPU Quota (AI track only)

Request Standard_NC4as_T4_v3 quota 24–48h in advance

                        quick-verify.sh
                        bash
                    
# Verify all tools are ready
az --version # ≥ 2.65.0
kubectl version --client
helm version # ≥ 3.14
flux --version # ≥ 2.0.0
 
# Register required providers
for ns in \
 Microsoft.ContainerService \
 Microsoft.Monitor \
 Microsoft.Dashboard \
 Microsoft.KubernetesConfiguration; do
 az provider register --namespace $ns
                        
done
 
# Confirm Owner role
az role assignment list \
 --assignee $(az account show \
 --query user.name -o tsv) \
 --role Owner -o table

Technology

AZURE SERVICES

Services you will provision and integrate during the hackathon.

Azure Kubernetes Service

Managed Kubernetes with Automatic and Standard modes, CNI Overlay, Cilium

ch 00–13

Azure Container Registry

Premium SKU with private endpoints and ACR Tasks for image builds

ch 01

Workload Identity

Entra ID federated credentials, OIDC issuer, zero static secrets

ch 04

Azure Key Vault

Secrets Store CSI driver with RBAC authorization and soft-delete

ch 04

Managed Prometheus & Grafana

Azure Monitor workspace, pre-built Kubernetes dashboards, KQL queries

ch 05

KEDA & Karpenter

Event-driven autoscaling with Service Bus triggers, scale-to-zero, NAP

ch 06

Flux v2 GitOps

AKS microsoft.flux extension, HelmRelease, drift detection, PR-driven delivery

ch 07

Azure Policy (OPA)

OPA Gatekeeper admission control, image registry restrictions, Defender

ch 08

AKS Managed Istio

mTLS, VirtualService canary routing, AuthorizationPolicy, Envoy sidecars

ch 09

Azure Disks & Files

CSI drivers, StatefulSet PVCs, RWO vs RWX, Azure Backup for AKS

ch 10

Private Cluster & NAT

Private API server, Azure Firewall / NAT Gateway egress, private endpoints

ch 11

AKS Fleet Manager

Multi-cluster workload propagation, staged Kubernetes version upgrades

ch 12

KAITO (GPU / LLM)

AI Toolchain Operator, Phi-3-mini inference, GPU node pools with T4

ai-01, ai-02

AKS Cost Analysis

Cost Analysis add-on, spot node pools, namespace attribution, Azure Advisor cost recommendations

ch 13

The Path

CHALLENGES

Thirteen core challenges plus optional GPU/AI and FinOps tracks. Click any card to read the challenge.

Core Track — 13 Challenges

Setup CH·00

Prerequisites
Ready, Set, GO!

Configure your workstation with the full cloud-native toolset: Azure CLI, kubectl, kubelogin, Helm, and Flux v2 CLI. Verify Azure subscription access and register required resource providers.

azure-cli kubectl helm flux

Open →

Setup CH·01

Containers & ACR

Containerize FabTechOps and push images to Azure Container Registry using ACR Tasks — no local Docker required.

acrdockeracr-tasks

Open →

Setup CH·02

AKS Cluster Deployment

Deploy a production-ready AKS cluster: Azure CNI Overlay, Cilium, Workload Identity, OIDC issuer, AzureLinux, and auto-upgrade channels.

aksciliumoidc

Open →

Core CH·03

App Deployment & Gateway API

Deploy in-cluster PostgreSQL, package FabTechOps as a Helm chart, and expose it via Gateway API using the Istio-based App Routing add-on or Application Gateway for Containers.

helmgateway-apiapp-routing

Open →

Core CH·04

Workload Identity & Secrets

Replace hardcoded credentials with Azure Key Vault + Secrets Store CSI and Entra ID federated credentials. Zero static secrets in any manifest.

workload-identitykey-vaultcsi

Open →

Core CH·05

Observability

Build a full-stack observability platform: Azure Managed Prometheus, Grafana dashboards, Container Insights log collection, and KQL queries.

Configure HPA, KEDA (Service Bus queue depth, scale-to-zero), and Node Auto Provisioning (Karpenter) for just-in-time node creation.

Implement pull-based continuous delivery via the AKS Flux v2 extension. Update the pre-configured manifest in your fork, demonstrate drift correction, and use PRs for progressive delivery.

flux-v2gitopshelm-release

Open →

Security CH·08

AKS Security Hardening

Apply Entra ID RBAC, least-privilege roles, Azure Policy (OPA), image registry restrictions, and Kubernetes network policies.

entra-idopanetwork-policy

Open →

Advanced CH·09

Persistent Storage

Configure StatefulSets with Azure Disk (RWO) and Azure Files (RWX) CSI drivers. Prove data survives pod deletion. Explore Azure Backup for AKS.

azure-diskazure-filesstatefulset

Open →

Advanced CH·10

Enterprise Networking

Build a private AKS cluster, configure egress via NAT Gateway or Azure Firewall, and lock down ACR access with a private endpoint.

private-clusternat-gatewayprivate-endpoint

Open →

Advanced CH·11

AKS Fleet Manager

Create a Fleet hub, join multiple member clusters, propagate workloads with ClusterResourcePlacement, and design a staged upgrade run strategy.

fleetmulti-clusterupgrades

Open →

Security CH·12

AKS Managed Istio

Enable the AKS managed Istio add-on, enforce mTLS in STRICT mode, and implement a canary traffic split using VirtualService and DestinationRule.

Optional AI Track

AI on AKS — GPU Foundations

Add a GPU node pool (Standard_NC4as_T4_v3), verify the NVIDIA device plugin, run a CUDA validation job, and deploy an open-source model inference endpoint.

LLM Inference with KAITO

Enable the AKS AI Toolchain add-on or install KAITO, deploy a Phi-3-mini or Mistral-7B Workspace CRD, validate inference, and scale replicas.

kaitophi-3llm

Open →

Optional FinOps Track

Optional CH·13

FinOps &
Cost Management

Enable the AKS Cost Analysis add-on, add a spot node pool, set resource requests & limits on all workloads, and review Azure Advisor cost recommendations to identify waste.

cost-analysisspot-nodesfinopsvpa

Open →

FRONTIER AKS HACKATHON

WHAT YOU'LLACCOMPLISH

PREREQUISITES

AZURE SERVICES

CHALLENGES

WHAT YOU'LL
ACCOMPLISH