🔹 Feature: Azure Kubernetes Application Network for AKS
🔹 What It Does: Managed zero-trust service mesh for AKS — with mTLS, no sidecars, and native multi-cluster support.
What Is It Giving You:
✅ Automatic mTLS: Encrypts service-to-service traffic by default. Supports both encrypted and unencrypted flows during rollout, then switch to strict mode when ready. FIPS-compliant cryptography in transit.
✅ Managed Certificate Authority: Backed by Azure Key Vault. Issues SPIFFE-compliant workload certificates with 24-hour validity, rotated automatically every 12 hours. Root and intermediate CAs managed for you.
✅ Ambient Architecture — No Sidecars: Node-level L4 proxies (ztunnel) handle traffic instead of a proxy container in every pod. Lower CPU/memory overhead, simpler operations.
✅ Optional L7 Waypoint Proxies: Turn on when you need advanced HTTP routing, header-based policy, or service-level policy enforcement. Off by default — you don’t pay the L7 tax on every workload.
✅ Multi-Cluster Mesh — The Strongest Use Case: Connect multiple AKS clusters into a unified service mesh. Services in one member cluster communicate directly with services in another, with mTLS enforced end-to-end across cluster boundaries. Cross-cluster traffic flows through east-west gateways; you provide reachability between them (VNet peering, VPN, ExpressRoute). Enables cross-region failover, dev/test/prod inter-cluster communication, and fault-domain separation — without stitching it together at the application layer.
✅ Unified Trust Across Every Member Cluster: One root CA anchors trust across all connected AKS clusters. Each cluster gets an intermediate CA signed by the root, and issues short-lived workload certs. Cross-cluster identity just works.
✅ Fully Managed Control & Data Plane: Azure operates, patches, and upgrades the service network components. Version and release channels for controlled upgrade cadence. (Note: does NOT manage or upgrade the AKS cluster itself, Kubernetes version, or node images.)
✅ Zero-Trust In-Cluster (and Cross-Cluster) Networking Without Running Your Own Istio: The security posture of a full ambient Istio deployment, without the operational cost of one.
🌐 https://learn.microsoft.com/en-us/azure/application-network/overview
🌐 Architecture (multi-cluster details): https://learn.microsoft.com/en-us/azure/application-network/architecture
