kubernetes-iaclisted

# Kubernetes IaC for AKS: Comprehensive Reference ## Core Principle: Separation of Concerns **Platform IaC** (Terraform/Bicep for AKS cluster, VNet, ACR, Key Vault) and **Application IaC** (Helm/Kustomize for workload manifests) operate on completely different lifecycles, use different tools, require different credentials, and must live in **separate repositories with separate pipelines**. | Dimension | Platform IaC | Application IaC | |---|---|---| | Changes | Infrequently (cluster upgrades, networking) | Daily (app deployments) | | Blast radius | High — can destroy the cluster | Namespace-scoped | | Credentials | Cloud-provider credentials (Terraform/Bicep) | Cluster credentials only | | Owner | Platform team | Application teams | | Tools | Terraform, Bicep | Helm, Kustomize | **Never mix platform and app resources in one Terraform state.** An application change must never be able to accidentally destroy the cluster. --- ## GitOps: The Operational Model GitOps extends declarative IaC to operations via four principles: 1. **Git as single source of truth** for all desired state 2. **Pull-based deployment** — in-cluster agent pulls changes (eliminates stored cluster credentials in CI) 3. **Continuous reconciliation** — automatically corrects drift 4. **Declarative descriptions** for everything ### Flux CD v2 vs ArgoCD — When to Choose Each | Aspect | Flux CD v2 | ArgoCD | |---|---|---| | UI | None (CLI only) | Rich web dashboard with app visualization, diff views | |