{"id":407,"date":"2026-04-13T23:03:47","date_gmt":"2026-04-13T23:03:47","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/azure-container-storage-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-containers\/"},"modified":"2026-04-13T23:03:47","modified_gmt":"2026-04-13T23:03:47","slug":"azure-container-storage-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-containers","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/azure-container-storage-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-containers\/","title":{"rendered":"Azure Container Storage Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Containers"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Containers<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Azure Container Storage is Microsoft\u2019s Kubernetes-focused storage offering for running <strong>stateful Containers<\/strong> on Azure. It\u2019s designed to make persistent storage for Kubernetes feel more \u201cplatform-native\u201d by packaging storage provisioning, lifecycle operations, and Kubernetes integration into an Azure-managed experience\u2014rather than requiring you to assemble and operate multiple storage components yourself.<\/p>\n\n\n\n<p>In simple terms: <strong>Azure Container Storage helps you give Kubernetes pods reliable, persistent storage<\/strong> (so data survives restarts and rescheduling) using Azure-managed building blocks, with an emphasis on operational simplicity for platform teams.<\/p>\n\n\n\n<p>In technical terms: Azure Container Storage integrates with Kubernetes through the <strong>Container Storage Interface (CSI)<\/strong> model and is typically surfaced as an Azure-managed capability for clusters such as <strong>Azure Kubernetes Service (AKS)<\/strong> (and, depending on current product scope, potentially Arc-enabled Kubernetes). It provisions storage that is consumed through Kubernetes objects like <strong>StorageClass<\/strong>, <strong>PersistentVolumeClaim (PVC)<\/strong>, and <strong>PersistentVolume (PV)<\/strong> while relying on Azure resource management, identity, monitoring, and governance patterns.<\/p>\n\n\n\n<p>The problem it solves: Kubernetes can run stateful apps, but \u201cday-2\u201d storage operations\u2014capacity planning, performance tuning, consistent provisioning standards, access control, and cost governance\u2014often become complicated. Azure Container Storage aims to reduce that complexity for Azure-hosted Kubernetes.<\/p>\n\n\n\n<blockquote>\n<p>Important: Azure\u2019s container storage landscape evolves quickly (features may be in preview\/GA, region-limited, or product-scope-limited). <strong>Verify the current status, supported regions, and supported Kubernetes distributions in official documentation<\/strong> before committing to a design or rollout:\nhttps:\/\/learn.microsoft.com\/search\/?terms=Azure%20Container%20Storage<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Azure Container Storage?<\/h2>\n\n\n\n<p><strong>Official purpose (high-level):<\/strong> Azure Container Storage is intended to provide a <strong>managed, Kubernetes-aligned persistent storage experience<\/strong> for containerized workloads on Azure\u2014especially for stateful applications running on Kubernetes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities (what it does)<\/h3>\n\n\n\n<p>At its core, Azure Container Storage provides:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Kubernetes-integrated persistent storage<\/strong> consumed via PVC\/PV.<\/li>\n<li><strong>Dynamic provisioning<\/strong> through Kubernetes StorageClasses (so developers request storage on demand).<\/li>\n<li><strong>Azure-managed lifecycle<\/strong> aligned with Azure control-plane management (resource groups, policies, RBAC, monitoring).<\/li>\n<li><strong>A standardized approach<\/strong> for platform teams to offer storage to application teams in AKS environments.<\/li>\n<\/ul>\n\n\n\n<p>Because Azure Container Storage is implemented to work with Kubernetes storage patterns, it typically centers on:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>StorageClass definitions (how storage is provisioned)<\/li>\n<li>PVCs (claims by workloads)<\/li>\n<li>PVs (backing volumes)<\/li>\n<li>CSI components (the mechanism Kubernetes uses to attach\/mount storage)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (conceptual)<\/h3>\n\n\n\n<p>Exact component names can vary by release; validate in current docs. Common building blocks include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure control plane integration<\/strong><\/li>\n<li>Managed via Azure Resource Manager (ARM)<\/li>\n<li>Governed by Azure RBAC, Policy, and tagging<\/li>\n<li><strong>Kubernetes-side components<\/strong><\/li>\n<li>CSI driver(s) and controller components in the cluster<\/li>\n<li>StorageClass objects presented to users<\/li>\n<li><strong>Backing storage<\/strong><\/li>\n<li>Azure-managed storage resources behind the scenes (for example, Azure Disks, Azure Elastic SAN, Azure Files, or other supported backends\u2014<strong>verify what is currently supported<\/strong>)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<p>Azure Container Storage is best understood as a <strong>managed Kubernetes storage service\/capability<\/strong> rather than a generic object storage service. You use it <em>through<\/em> Kubernetes APIs (kubectl\/Helm) and Azure cluster management, not as a standalone \u201cstorage account\u201d experience.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Scope (how it is scoped)<\/h3>\n\n\n\n<p>In practice, Azure Container Storage is typically:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cluster-associated<\/strong> (enabled\/installed per AKS cluster or per Kubernetes cluster type it supports)<\/li>\n<li><strong>Regional<\/strong> (aligned with the region of the cluster and backing storage resources)<\/li>\n<li><strong>Subscription and resource-group governed<\/strong> (because the cluster and backing resources live in your Azure subscription\/resource groups)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Azure ecosystem<\/h3>\n\n\n\n<p>Azure Container Storage sits at the intersection of:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AKS (Containers \/ orchestration)<\/strong><\/li>\n<li><strong>Azure storage backends<\/strong> (block\/file services)<\/li>\n<li><strong>Identity &amp; governance<\/strong> (Microsoft Entra ID, managed identities, Azure RBAC, Azure Policy)<\/li>\n<li><strong>Monitoring &amp; operations<\/strong> (Azure Monitor, Container insights, Log Analytics)<\/li>\n<\/ul>\n\n\n\n<p>It is most relevant when you want a \u201cplatform\u201d storage solution for Kubernetes that aligns with Azure\u2019s operational controls and enterprise governance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Azure Container Storage?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Faster platform enablement for stateful workloads:<\/strong> Reduce time-to-serve persistent storage to application teams.<\/li>\n<li><strong>Standardization:<\/strong> Establish approved storage profiles (performance\/cost tiers) across teams.<\/li>\n<li><strong>Reduced operational overhead:<\/strong> Fewer custom scripts and ad-hoc storage configurations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Kubernetes-native consumption:<\/strong> Developers request storage with PVCs; the platform handles provisioning.<\/li>\n<li><strong>Separation of concerns:<\/strong> Platform team curates storage classes; app teams just request what they need.<\/li>\n<li><strong>Integration with Azure primitives:<\/strong> Aligns with Azure\u2019s identity, governance, and resource lifecycle.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Repeatable provisioning patterns:<\/strong> Storage defined as code (StorageClass + PVC manifests).<\/li>\n<li><strong>Simplified day-2 ops:<\/strong> Easier auditing, monitoring, and standardized troubleshooting paths.<\/li>\n<li><strong>Supports GitOps workflows:<\/strong> Storage objects can be managed in cluster configuration repos.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Governable with Azure RBAC and policy:<\/strong> Helps keep storage configuration compliant.<\/li>\n<li><strong>Auditable resource changes:<\/strong> Activity logs for Azure-level actions; Kubernetes audit logs for cluster actions (if enabled).<\/li>\n<li><strong>Encryption expectations:<\/strong> Azure storage backends generally support encryption at rest; validate exact encryption options and key management for your chosen backend.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Right storage for the workload:<\/strong> Provide multiple storage classes suited to different performance\/cost needs.<\/li>\n<li><strong>Predictable provisioning:<\/strong> Avoid manual volume creation bottlenecks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose Azure Container Storage when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You run <strong>AKS<\/strong> and need a consistent way to offer persistent storage to many teams.<\/li>\n<li>You want Kubernetes-aligned storage provisioning with Azure-managed governance.<\/li>\n<li>You have multiple stateful workloads (databases, queues, caches, analytics) and need standardized storage tiers and operational controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<p>Azure Container Storage may not be a fit when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Your workloads are mostly stateless and don\u2019t need PV\/PVC.<\/li>\n<li>You only need basic storage and can rely on standard CSI drivers directly (for example, direct Azure Disk\/Azure Files CSI usage) and your operational needs are simple.<\/li>\n<li>You need specialized enterprise storage features not offered by the current Azure Container Storage backend options (e.g., very specific latency\/SLA\/replication semantics). In that case, consider specialized Azure offerings (like Azure NetApp Files) or approved third-party Kubernetes storage solutions\u2014after validation.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Azure Container Storage used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<p>Common in industries with strict data and operational requirements:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services (risk engines, pricing services, transaction systems)<\/li>\n<li>Healthcare (patient analytics, integration services)<\/li>\n<li>Retail\/e-commerce (catalog\/search indexes, session stores, order pipelines)<\/li>\n<li>Gaming (player state, matchmaking metadata)<\/li>\n<li>Manufacturing\/IoT (telemetry processing, edge-to-cloud ingestion)<\/li>\n<li>SaaS providers (multi-tenant app services with persistent state)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Platform engineering teams building AKS platforms<\/li>\n<li>DevOps\/SRE teams operating production clusters<\/li>\n<li>Application teams deploying stateful microservices<\/li>\n<li>Security teams defining guardrails for storage usage<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>StatefulSets (PostgreSQL, MySQL, MongoDB, Elasticsearch\/OpenSearch)<\/li>\n<li>Eventing\/streaming (Kafka-compatible systems, queues)<\/li>\n<li>CI\/CD and artifact workloads (if supported and appropriate)<\/li>\n<li>Data processing pipelines needing durable scratch space<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Microservices with a mix of stateless and stateful components<\/li>\n<li>Multi-namespace, multi-team AKS clusters (shared platform)<\/li>\n<li>GitOps-managed clusters (Flux\/Argo CD) with infrastructure-as-code<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production:<\/strong> Strong governance, monitored storage classes, controlled expansion, backups.<\/li>\n<li><strong>Dev\/Test:<\/strong> Lower-cost storage classes, fewer replicas, smaller PV sizes, relaxed performance tiers.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where Azure Container Storage can be a good fit. Each includes the problem, why it fits, and a short example.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Standardized PVC provisioning for many teams<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Each team provisions PVs differently, causing drift and incidents.<\/li>\n<li><strong>Why Azure Container Storage fits:<\/strong> Centralizes and standardizes StorageClasses and provisioning behavior.<\/li>\n<li><strong>Example:<\/strong> A platform team offers <code>sc-standard<\/code> and <code>sc-premium<\/code> classes; app teams request PVCs without learning backend details.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Running production PostgreSQL in AKS (operator-based)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> PostgreSQL needs durable, reliable volumes with predictable performance.<\/li>\n<li><strong>Why it fits:<\/strong> Enables consistent PVC provisioning for StatefulSets\/operators.<\/li>\n<li><strong>Example:<\/strong> A PostgreSQL operator requests 500Gi PVCs from a \u201cdb-tier\u201d StorageClass; platform controls performance tier and policies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Multi-tenant SaaS with namespace isolation<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Shared clusters need safe patterns for storage usage and access boundaries.<\/li>\n<li><strong>Why it fits:<\/strong> Kubernetes RBAC + curated storage classes + Azure governance reduce risky variations.<\/li>\n<li><strong>Example:<\/strong> Each tenant namespace has quotas and only approved StorageClasses; PVC sizes are controlled via policy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Stateful caching layer (Redis or similar) with persistence<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Cache rebuilds cause slow recovery; some persistence required.<\/li>\n<li><strong>Why it fits:<\/strong> Supports durable volumes for append-only files or snapshots (capability depends on backend\u2014verify).<\/li>\n<li><strong>Example:<\/strong> Redis pods write to PVC-backed volumes so failover doesn\u2019t require full warm-up.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Search\/index workloads (OpenSearch\/Elasticsearch-like)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Index shards require fast I\/O and stable storage.<\/li>\n<li><strong>Why it fits:<\/strong> Allows platform-provided storage tiers for indexing nodes.<\/li>\n<li><strong>Example:<\/strong> Index nodes use a high-performance StorageClass; query nodes remain stateless.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) CI runners needing durable workspace between jobs (selective)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Some build steps benefit from persisting dependencies.<\/li>\n<li><strong>Why it fits:<\/strong> PVC-based caching improves performance and repeatability (be cautious with concurrency and security).<\/li>\n<li><strong>Example:<\/strong> Build runners mount PVCs for dependency caches with strict access controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Data processing pipelines (durable intermediate storage)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Jobs need to persist intermediate outputs for retries and handoffs.<\/li>\n<li><strong>Why it fits:<\/strong> PVCs provide durable scratch space for batch jobs.<\/li>\n<li><strong>Example:<\/strong> ETL jobs write intermediate parquet files to PVCs; downstream jobs read after rescheduling.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Lift-and-shift of VM-based apps to AKS (stateful pieces)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Legacy apps moved to containers still need persistent disks.<\/li>\n<li><strong>Why it fits:<\/strong> Reduces friction in mapping \u201cdisk-per-instance\u201d patterns to Kubernetes.<\/li>\n<li><strong>Example:<\/strong> A Windows\/Linux line-of-business service becomes a Deployment + PVC with a stable mount path.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Platform \u201cgolden path\u201d for stateful services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams repeatedly reinvent storage choices and get it wrong.<\/li>\n<li><strong>Why it fits:<\/strong> Platform teams can provide curated documentation and safe defaults around Azure Container Storage.<\/li>\n<li><strong>Example:<\/strong> Internal templates create namespaces, resource quotas, and recommended PVC specs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Regulated environments requiring auditability and governance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Storage must be auditable and compliant.<\/li>\n<li><strong>Why it fits:<\/strong> Aligns with Azure governance and standard Kubernetes audit patterns.<\/li>\n<li><strong>Example:<\/strong> Azure Policy enforces tags; activity logs record changes; cluster policies restrict StorageClass usage.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Feature availability can vary by region, backend type, and release stage. <strong>Confirm current capabilities in official docs<\/strong>:\nhttps:\/\/learn.microsoft.com\/search\/?terms=Azure%20Container%20Storage%20features<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Kubernetes-native storage consumption (PVC\/PV)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets workloads request storage using standard Kubernetes objects.<\/li>\n<li><strong>Why it matters:<\/strong> Developers use familiar patterns; less platform-specific glue code.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster onboarding for teams already using Kubernetes.<\/li>\n<li><strong>Caveats:<\/strong> You must still design for Kubernetes storage realities (pod rescheduling, access modes, topology).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Dynamic provisioning through StorageClasses<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Automatically provisions storage when a PVC is created.<\/li>\n<li><strong>Why it matters:<\/strong> Removes manual PV creation and reduces operator error.<\/li>\n<li><strong>Practical benefit:<\/strong> Self-service storage with guardrails.<\/li>\n<li><strong>Caveats:<\/strong> StorageClass parameters and defaults must be controlled carefully; mistakes can scale quickly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Azure-managed integration and lifecycle<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Aligns cluster storage operations with Azure resource management patterns.<\/li>\n<li><strong>Why it matters:<\/strong> Supports enterprise governance, tagging, and operational consistency.<\/li>\n<li><strong>Practical benefit:<\/strong> Easier auditing and lifecycle management across environments.<\/li>\n<li><strong>Caveats:<\/strong> The exact resource footprint and \u201cwho manages what\u201d depends on backend and configuration\u2014verify.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Works with AKS operational model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Designed to be enabled\/operated in AKS contexts.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces friction compared to self-managed in-cluster storage stacks.<\/li>\n<li><strong>Practical benefit:<\/strong> More consistent support boundaries and operational playbooks.<\/li>\n<li><strong>Caveats:<\/strong> AKS versions and regions supported may be limited; check prerequisites.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Support for multiple storage \u201cprofiles\u201d (tiers)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows platform teams to offer different StorageClasses for different needs.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents one-size-fits-all storage decisions.<\/li>\n<li><strong>Practical benefit:<\/strong> Cost and performance optimization by workload.<\/li>\n<li><strong>Caveats:<\/strong> Over-proliferation of classes becomes confusing; keep it minimal.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Integration with Kubernetes scheduling and topology (where supported)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Helps ensure volumes are attachable\/mountable where pods run (zone\/region constraints).<\/li>\n<li><strong>Why it matters:<\/strong> Avoids pods stuck Pending due to storage topology mismatches.<\/li>\n<li><strong>Practical benefit:<\/strong> More predictable scheduling outcomes.<\/li>\n<li><strong>Caveats:<\/strong> Behavior depends on backend type and cluster configuration.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Operational visibility via Kubernetes status + Azure monitoring<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Exposes provisioning and attachment\/mount states through Kubernetes events\/status; can integrate with Azure Monitor\/Container insights.<\/li>\n<li><strong>Why it matters:<\/strong> Faster troubleshooting for Pending PVCs and mount failures.<\/li>\n<li><strong>Practical benefit:<\/strong> Clearer root-cause signals for SRE\/ops teams.<\/li>\n<li><strong>Caveats:<\/strong> Monitoring costs can grow quickly; tune log\/metric collection.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Policy-friendly design (guardrails)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Pairs well with Kubernetes admission controls (e.g., Gatekeeper\/Kyverno) and Azure Policy for AKS.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents insecure or excessively expensive storage requests.<\/li>\n<li><strong>Practical benefit:<\/strong> Enforce allowed StorageClasses, max PVC sizes, required labels\/tags.<\/li>\n<li><strong>Caveats:<\/strong> Requires deliberate policy design; too strict blocks deployments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Automation-friendly for IaC\/GitOps<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Storage objects can be declared in Git and applied via GitOps.<\/li>\n<li><strong>Why it matters:<\/strong> Repeatability and auditability.<\/li>\n<li><strong>Practical benefit:<\/strong> Environment parity across dev\/test\/prod.<\/li>\n<li><strong>Caveats:<\/strong> Secrets and credentials must be handled securely; avoid storing sensitive values in repos.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Fits into Azure security model (identity, encryption, audit)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Leverages Azure authentication\/authorization patterns and encryption features of underlying storage.<\/li>\n<li><strong>Why it matters:<\/strong> Easier compliance alignment.<\/li>\n<li><strong>Practical benefit:<\/strong> Centralized controls and auditing.<\/li>\n<li><strong>Caveats:<\/strong> Encryption key management (Microsoft-managed vs customer-managed keys) depends on the backend\u2014verify.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>At a high level, Azure Container Storage provides a Kubernetes-facing storage layer that translates Kubernetes storage requests (PVCs) into backing Azure storage resources and then attaches\/mounts volumes to worker nodes where pods run.<\/p>\n\n\n\n<p>Typical lifecycle:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>A developer applies a PVC referencing a StorageClass.<\/li>\n<li>Kubernetes calls the storage provisioner (CSI controller components) for that StorageClass.<\/li>\n<li>Azure Container Storage provisions or allocates backing storage (depending on backend).<\/li>\n<li>Kubernetes binds the PVC to a PV.<\/li>\n<li>When a pod starts, Kubernetes requests volume attachment\/mount.<\/li>\n<li>The node plugin mounts the volume to the node; the pod sees it at the mount path.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane flow:<\/strong> Kubernetes API \u2192 CSI controller \u2192 Azure APIs (ARM) to provision\/attach<\/li>\n<li><strong>Data plane flow:<\/strong> Application pod \u2192 filesystem\/block device mounted on node \u2192 backing storage over Azure network or local pathways (backend-dependent)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<p>Common integrations in Azure environments:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AKS<\/strong> (cluster hosting and identity integration)<\/li>\n<li><strong>Azure Monitor \/ Log Analytics<\/strong> (observability)<\/li>\n<li><strong>Microsoft Entra ID<\/strong> (human identity; Kubernetes RBAC integration)<\/li>\n<li><strong>Azure Policy for AKS<\/strong> (guardrails)<\/li>\n<li><strong>Key Vault<\/strong> (for secrets used by apps; storage encryption key scenarios depend on backend)<\/li>\n<li><strong>Backup tooling<\/strong> (Kubernetes-aware backups; backend snapshots depend on current support\u2014verify)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>Dependencies vary. Typical dependencies include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A supported Kubernetes cluster (commonly AKS)<\/li>\n<li>Azure storage backends (block\/file services)<\/li>\n<li>Azure networking (VNet integration, DNS, private endpoints if used)<\/li>\n<li>Azure identity (managed identity for cluster operations)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model (typical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cluster to Azure:<\/strong> AKS uses a managed identity or service principal to manage Azure resources.<\/li>\n<li><strong>User to cluster:<\/strong> Kubernetes RBAC (often integrated with Entra ID).<\/li>\n<li><strong>Azure governance:<\/strong> Azure RBAC controls who can enable\/configure Azure Container Storage and who can create\/modify backing resources.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model (typical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Nodes must reach backing storage endpoints.<\/li>\n<li>If using private networking patterns (Private Link\/private endpoints), ensure DNS and routing are correct.<\/li>\n<li>Cross-zone behavior depends on backend; topology constraints must be understood.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kubernetes events (<code>kubectl get events<\/code>) often show PVC\/PV provisioning problems.<\/li>\n<li>CSI component logs (in kube-system or the extension namespace) are crucial for debugging.<\/li>\n<li>Azure Monitor can collect node and pod metrics\/logs; tune retention and collection.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Simple architecture diagram<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  Dev[Developer \/ CI] --&gt;|kubectl apply PVC| K8s[Kubernetes API Server]\n  K8s --&gt;|provision request| CSI[Azure Container Storage CSI Controller]\n  CSI --&gt;|ARM calls| AzureAPI[Azure Resource Manager APIs]\n  AzureAPI --&gt; Backend[Backing Azure Storage]\n  Pod[Stateful Pod] --&gt;|read\/write| Vol[Mounted Volume on Node]\n  Vol --&gt; Backend\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Production-style architecture diagram<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Azure[\"Azure Subscription\"]\n    subgraph RG[\"Resource Group\"]\n      AKS[AKS Cluster]\n      MON[Azure Monitor \/ Log Analytics]\n      POL[Azure Policy]\n      KV[Key Vault]\n      STG[Backing Storage (e.g., Disks \/ Files \/ Elastic SAN - verify)]\n    end\n    AAD[Microsoft Entra ID]\n  end\n\n  Dev[Platform Team \/ App Team] --&gt;|Entra ID auth| AAD\n  Dev --&gt;|kubectl\/CI| AKS\n\n  AKS --&gt;|Kubernetes events\/logs| MON\n  POL --&gt;|enforce guardrails| AKS\n\n  AKS --&gt;|Managed identity \/ Azure RBAC| STG\n  AKS --&gt;|Workload uses secrets| KV\n\n  subgraph Workloads[\"Stateful Workloads\"]\n    SS[StatefulSet \/ Operator-managed DB]\n    PVC[PVC]\n  end\n\n  SS --&gt; PVC\n  PVC --&gt;|provision\/attach\/mount via CSI| STG\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Because Azure Container Storage is cluster-associated, prerequisites are mostly about your cluster and permissions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Account\/subscription requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An Azure subscription with permission to create and manage:<\/li>\n<li>Resource groups<\/li>\n<li>AKS clusters<\/li>\n<li>Azure storage resources used by the chosen backend<\/li>\n<li>Monitoring resources (optional but recommended)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>At minimum (exact needs vary by org policy):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure:<\/strong> Contributor (or a more scoped custom role) on the target resource group\/subscription to create cluster resources and enable storage capability.<\/li>\n<li><strong>AKS\/Kubernetes:<\/strong> Cluster-admin privileges for installing\/enabling cluster components and creating StorageClasses (if needed).<\/li>\n<\/ul>\n\n\n\n<p>In enterprise environments, responsibilities are often split:\n&#8211; Platform team: enable\/configure Azure Container Storage, create StorageClasses\n&#8211; App team: create PVCs and deploy apps<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A payment method configured in the subscription.<\/li>\n<li>Awareness that storage and monitoring costs are usage-based.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools needed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure CLI<\/strong>: https:\/\/learn.microsoft.com\/cli\/azure\/install-azure-cli<\/li>\n<li><strong>kubectl<\/strong>: https:\/\/kubernetes.io\/docs\/tasks\/tools\/<\/li>\n<li>Optional:<\/li>\n<li>Helm (for deploying charts)<\/li>\n<li>GitOps tooling (Flux\/Argo CD)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Availability may be limited by region and backend type.<\/li>\n<li><strong>Verify supported regions<\/strong> in official docs:\n  https:\/\/learn.microsoft.com\/search\/?terms=Azure%20Container%20Storage%20region%20availability<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Expect relevant quotas such as:\n&#8211; AKS node limits (cores, node pools)\n&#8211; Storage quotas (disk counts\/sizes, IOPS limits, snapshots)\n&#8211; API rate limits (Azure Resource Manager operations)\n&#8211; Kubernetes object quotas (if you enforce them)<\/p>\n\n\n\n<p>Always validate the specific limits that apply to the backing storage type you choose.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<p>Typically required:\n&#8211; AKS cluster\nOptional but recommended:\n&#8211; Azure Monitor \/ Log Analytics workspace (for cluster and CSI logs)\n&#8211; Azure Policy for AKS (guardrails)\n&#8211; Key Vault (app secrets)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Azure Container Storage cost is usually a combination of:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>AKS costs<\/strong><\/li>\n<li><strong>Backing storage costs<\/strong><\/li>\n<li><strong>Networking costs<\/strong><\/li>\n<li><strong>Monitoring\/logging costs<\/strong><\/li>\n<li><strong>Backup\/snapshot costs<\/strong> (if used)<\/li>\n<\/ol>\n\n\n\n<p>There may or may not be a separate \u201cAzure Container Storage\u201d line-item; in many designs, the primary cost drivers come from the underlying storage backend and operations. <strong>Verify the current pricing model in official sources<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Official pricing references (start here)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure Pricing Calculator: https:\/\/azure.microsoft.com\/pricing\/calculator\/<\/li>\n<li>Azure pricing overview: https:\/\/azure.microsoft.com\/pricing\/<\/li>\n<li>Common backing storage pricing pages (depending on your backend):<\/li>\n<li>Azure Managed Disks: https:\/\/azure.microsoft.com\/pricing\/details\/managed-disks\/<\/li>\n<li>Azure Files: https:\/\/azure.microsoft.com\/pricing\/details\/storage\/files\/<\/li>\n<li>Azure Elastic SAN: https:\/\/azure.microsoft.com\/pricing\/details\/elastic-san\/<\/li>\n<li>Azure NetApp Files: https:\/\/azure.microsoft.com\/pricing\/details\/netapp\/<\/li>\n<\/ul>\n\n\n\n<p>For Azure Container Storage-specific pricing details (if published), use:\nhttps:\/\/learn.microsoft.com\/search\/?terms=Azure%20Container%20Storage%20pricing<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (what you typically pay for)<\/h3>\n\n\n\n<p>You commonly pay for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Provisioned storage capacity<\/strong> (GiB\/TiB per month)<\/li>\n<li><strong>Performance tier<\/strong> (e.g., premium vs standard; IOPS\/throughput characteristics)<\/li>\n<li><strong>Snapshots\/backups<\/strong> (capacity stored and operations)<\/li>\n<li><strong>Transactions\/operations<\/strong> (more relevant for file\/object-style backends)<\/li>\n<li><strong>Compute<\/strong> (AKS nodes that run your workloads and storage components)<\/li>\n<li><strong>Data transfer<\/strong><\/li>\n<li>Zone-to-zone or region-to-region (if applicable)<\/li>\n<li>Egress to Internet (rare for storage traffic if private networking is used)<\/li>\n<li><strong>Monitoring logs<\/strong><\/li>\n<li>Log Analytics ingestion + retention can become a large recurring cost<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AKS has a free control plane tier for some configurations, but node compute is billed.<\/li>\n<li>Storage backends generally do not have meaningful \u201cfree tiers\u201d for production usage.<\/li>\n<li>Always confirm current promotions\/free grants in the pricing pages.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (most important)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Over-provisioned PVC sizes (unused allocated storage)<\/li>\n<li>Premium storage tiers used broadly rather than selectively<\/li>\n<li>High log ingestion (verbose CSI logs, container logs)<\/li>\n<li>Large snapshot retention<\/li>\n<li>Frequent provisioning\/deprovisioning (operational churn)<\/li>\n<li>Multi-zone replication requirements (backend-dependent)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Operational time<\/strong>: debugging scheduling\/topology\/storage issues<\/li>\n<li><strong>Observability<\/strong>: logs\/metrics retention<\/li>\n<li><strong>Backups<\/strong>: storage of backups plus restore testing environments<\/li>\n<li><strong>Network design<\/strong>: private endpoints and DNS can add complexity (and sometimes costs)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Storage traffic typically stays within Azure\u2019s network when using Azure storage.<\/li>\n<li>If your architecture crosses regions or uses DR replicas, data transfer costs can appear.<\/li>\n<li>Private endpoints may be used for tighter security; validate any cost impacts for your design.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Offer a small number of StorageClasses aligned to cost tiers:<\/li>\n<li>dev\/test low-cost tier<\/li>\n<li>production general-purpose tier<\/li>\n<li>performance tier for I\/O-heavy databases<\/li>\n<li>Use quotas and policy:<\/li>\n<li>max PVC size<\/li>\n<li>allowed StorageClasses per namespace<\/li>\n<li>Right-size PVs and implement expansion policies where supported.<\/li>\n<li>Tune Azure Monitor:<\/li>\n<li>collect only required logs<\/li>\n<li>set retention appropriately<\/li>\n<li>Use scheduled cleanup in dev\/test namespaces (PVCs and snapshots are often forgotten).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A low-cost starter lab typically includes:\n&#8211; 1 small AKS cluster (1 node pool, small VM size)\n&#8211; 1 namespace\n&#8211; 1 PVC (a few GiB to tens of GiB depending on minimums)\n&#8211; Minimal monitoring retention<\/p>\n\n\n\n<p>Use the Azure Pricing Calculator to estimate:\n&#8211; AKS node VM cost\n&#8211; Storage capacity cost for the chosen backend\n&#8211; Log Analytics ingestion (if enabled)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, costs often come from:\n&#8211; Multiple node pools across zones\n&#8211; Many PVCs (databases per service\/team)\n&#8211; Premium tiers for performance workloads\n&#8211; Snapshot\/backup storage and retention\n&#8211; 30\u201390+ day logging retention\n&#8211; DR or multi-region replication (where used)<\/p>\n\n\n\n<p>A practical approach: model costs per \u201cstateful service unit\u201d (e.g., one PostgreSQL cluster = X PVCs, Y size, Z snapshot retention, plus compute).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab focuses on a safe, low-cost pattern: enable Azure Container Storage on an AKS cluster, then deploy a simple pod that writes data to a PVC and verify persistence across restarts.<\/p>\n\n\n\n<p>Because Azure Container Storage enablement steps can change (preview \u2192 GA, portal wording, CLI flags), this lab uses a <strong>hybrid approach<\/strong>:\n&#8211; Azure CLI for AKS creation (stable)\n&#8211; Portal-based enablement for Azure Container Storage (less fragile than guessing CLI flags)\n&#8211; kubectl for Kubernetes objects (stable)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Deploy a small Kubernetes workload on AKS using <strong>Azure Container Storage<\/strong>-provided persistent storage, then validate:\n&#8211; PVC binds successfully\n&#8211; Pod can write\/read data\n&#8211; Data persists after pod restart<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create an AKS cluster.\n2. Enable Azure Container Storage on the cluster.\n3. Identify the StorageClass created or recommended by Azure Container Storage.\n4. Create a PVC using that StorageClass.\n5. Deploy a pod that mounts the PVC and writes data.\n6. Restart the pod and confirm the data remains.\n7. Clean up all resources to avoid ongoing charges.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create a resource group<\/h3>\n\n\n\n<p><strong>Expected outcome:<\/strong> Resource group exists.<\/p>\n\n\n\n<pre><code class=\"language-bash\">az login\naz account set --subscription \"&lt;YOUR_SUBSCRIPTION_ID&gt;\"\n\nexport RG=\"rg-acs-lab\"\nexport LOCATION=\"eastus\"   # pick a supported region for Azure Container Storage (verify)\naz group create --name \"$RG\" --location \"$LOCATION\"\n<\/code><\/pre>\n\n\n\n<p>Verify:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group show --name \"$RG\" --query \"{name:name, location:location}\" -o table\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create an AKS cluster<\/h3>\n\n\n\n<p><strong>Expected outcome:<\/strong> AKS cluster is created and ready.<\/p>\n\n\n\n<p>Notes:\n&#8211; Keep node count small to reduce cost.\n&#8211; Use a Kubernetes version supported by Azure Container Storage (verify in docs).<\/p>\n\n\n\n<pre><code class=\"language-bash\">export AKS=\"aks-acs-lab\"\n\naz aks create \\\n  --resource-group \"$RG\" \\\n  --name \"$AKS\" \\\n  --location \"$LOCATION\" \\\n  --node-count 1 \\\n  --generate-ssh-keys\n<\/code><\/pre>\n\n\n\n<p>Get credentials:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az aks get-credentials --resource-group \"$RG\" --name \"$AKS\" --overwrite-existing\nkubectl get nodes\n<\/code><\/pre>\n\n\n\n<p>You should see one node in <code>Ready<\/code> state.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Enable Azure Container Storage on the AKS cluster<\/h3>\n\n\n\n<p><strong>Expected outcome:<\/strong> Azure Container Storage components are installed\/enabled and at least one StorageClass is available for use.<\/p>\n\n\n\n<p>Because exact enablement steps can vary, use the most current official guidance:\nhttps:\/\/learn.microsoft.com\/search\/?terms=Enable%20Azure%20Container%20Storage%20AKS<\/p>\n\n\n\n<p>A typical Azure Portal flow (verify wording in your portal):\n1. Open the Azure Portal: https:\/\/portal.azure.com\n2. Go to <strong>Kubernetes services<\/strong> \u2192 select your AKS cluster (<code>aks-acs-lab<\/code>)\n3. Find the area for <strong>Extensions<\/strong>, <strong>Add-ons<\/strong>, or <strong>Storage<\/strong> capabilities (names can vary)\n4. Select <strong>Azure Container Storage<\/strong> and follow the enablement wizard\n5. Wait for deployment to complete<\/p>\n\n\n\n<p>After enablement, validate from Kubernetes:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl get pods -A\nkubectl get storageclass\n<\/code><\/pre>\n\n\n\n<p>Look for a StorageClass that is documented\/recommended for Azure Container Storage. The exact name varies by configuration and release. If you\u2019re unsure which StorageClass to use:\n&#8211; Check the Azure Container Storage docs for the expected StorageClass name(s), or\n&#8211; Inspect StorageClasses and look for annotations\/provisioners that match the Azure Container Storage CSI driver (verify).<\/p>\n\n\n\n<p>To inspect details:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl get storageclass -o wide\nkubectl describe storageclass &lt;STORAGECLASS_NAME&gt;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a namespace for the lab<\/h3>\n\n\n\n<p><strong>Expected outcome:<\/strong> Namespace exists.<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl create namespace acs-lab\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Create a PVC using the Azure Container Storage StorageClass<\/h3>\n\n\n\n<p><strong>Expected outcome:<\/strong> PVC is created and becomes <code>Bound<\/code>.<\/p>\n\n\n\n<p>Create a file named <code>pvc.yaml<\/code>. Replace <code>&lt;STORAGECLASS_NAME&gt;<\/code> with the StorageClass you identified in Step 3.<\/p>\n\n\n\n<pre><code class=\"language-bash\">cat &gt; pvc.yaml &lt;&lt;'EOF'\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: acs-pvc\n  namespace: acs-lab\nspec:\n  accessModes:\n    - ReadWriteOnce\n  resources:\n    requests:\n      storage: 5Gi\n  storageClassName: &lt;STORAGECLASS_NAME&gt;\nEOF\n<\/code><\/pre>\n\n\n\n<p>Apply it:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl apply -f pvc.yaml\nkubectl get pvc -n acs-lab\n<\/code><\/pre>\n\n\n\n<p>If it stays <code>Pending<\/code>, describe it:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl describe pvc acs-pvc -n acs-lab\nkubectl get events -n acs-lab --sort-by=.metadata.creationTimestamp\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Deploy a pod that writes to the PVC<\/h3>\n\n\n\n<p><strong>Expected outcome:<\/strong> Pod is running and can write data to the mounted volume.<\/p>\n\n\n\n<p>Create <code>pod.yaml<\/code>:<\/p>\n\n\n\n<pre><code class=\"language-bash\">cat &gt; pod.yaml &lt;&lt;'EOF'\napiVersion: v1\nkind: Pod\nmetadata:\n  name: pvc-writer\n  namespace: acs-lab\nspec:\n  containers:\n  - name: writer\n    image: busybox:1.36\n    command: [\"\/bin\/sh\", \"-c\"]\n    args:\n      - |\n        set -e\n        echo \"hello from $(date -Iseconds)\" &gt;&gt; \/data\/out.txt\n        echo \"Wrote a line. Now sleeping...\"\n        tail -f \/dev\/null\n    volumeMounts:\n    - name: data\n      mountPath: \/data\n  volumes:\n  - name: data\n    persistentVolumeClaim:\n      claimName: acs-pvc\nEOF\n<\/code><\/pre>\n\n\n\n<p>Apply and check:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl apply -f pod.yaml\nkubectl get pod -n acs-lab -w\n<\/code><\/pre>\n\n\n\n<p>Once Running, view the file:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl exec -n acs-lab pvc-writer -- cat \/data\/out.txt\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Restart the pod and confirm persistence<\/h3>\n\n\n\n<p><strong>Expected outcome:<\/strong> After deleting and recreating the pod, the file still contains the previous content.<\/p>\n\n\n\n<p>Delete the pod:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl delete pod -n acs-lab pvc-writer\n<\/code><\/pre>\n\n\n\n<p>Re-apply:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl apply -f pod.yaml\nkubectl get pod -n acs-lab -w\n<\/code><\/pre>\n\n\n\n<p>Check the file again:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl exec -n acs-lab pvc-writer -- cat \/data\/out.txt\n<\/code><\/pre>\n\n\n\n<p>You should see the line written before the restart and an additional line written after the restart.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Run these checks:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>PVC is bound:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">kubectl get pvc -n acs-lab\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li>PV exists and is bound to the claim:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">kubectl get pv\nkubectl describe pv &lt;PV_NAME&gt;\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\">\n<li>Pod is running and mounted:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">kubectl describe pod -n acs-lab pvc-writer\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"4\">\n<li>Data persists after pod recreation (already verified via <code>\/data\/out.txt<\/code>).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and fixes:<\/p>\n\n\n\n<p><strong>Issue: PVC stuck in <code>Pending<\/code><\/strong>\n&#8211; Check events:\n  <code>bash\n  kubectl describe pvc -n acs-lab acs-pvc\n  kubectl get events -n acs-lab --sort-by=.metadata.creationTimestamp<\/code>\n&#8211; Common causes:\n  &#8211; Wrong <code>storageClassName<\/code>\n  &#8211; Azure Container Storage not fully enabled\/ready\n  &#8211; Backend quota exceeded (disk limits, capacity limits)\n  &#8211; Region\/feature not supported for your cluster version\n&#8211; Fix:\n  &#8211; Confirm supported regions and AKS versions in official docs\n  &#8211; Re-check available StorageClasses and use the recommended one<\/p>\n\n\n\n<p><strong>Issue: Pod stuck in <code>ContainerCreating<\/code> or mount errors<\/strong>\n&#8211; Describe the pod:\n  <code>bash\n  kubectl describe pod -n acs-lab pvc-writer<\/code>\n&#8211; Look for mount\/attach errors; then check CSI-related pods logs (namespace varies):\n  <code>bash\n  kubectl get pods -A | grep -i csi<\/code>\n  Then:\n  <code>bash\n  kubectl logs -n &lt;NAMESPACE&gt; &lt;CSI_POD_NAME&gt;<\/code>\n&#8211; Fix:\n  &#8211; Ensure node has network access to the backend\n  &#8211; Ensure cluster identity has rights to manage required Azure resources\n  &#8211; Confirm backend and topology constraints (zone alignment)<\/p>\n\n\n\n<p><strong>Issue: No StorageClass appears after enabling<\/strong>\n&#8211; Wait a few minutes; some components take time to deploy.\n&#8211; Re-check portal deployment status.\n&#8211; Confirm enablement succeeded in the AKS resource.\n&#8211; Consult official docs and release notes for the current enablement behavior.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid charges, delete Kubernetes objects and the AKS cluster resources.<\/p>\n\n\n\n<p>Delete objects:<\/p>\n\n\n\n<pre><code class=\"language-bash\">kubectl delete namespace acs-lab\n<\/code><\/pre>\n\n\n\n<p>Delete the AKS cluster (and all resources in the RG) by deleting the resource group:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group delete --name \"$RG\" --yes --no-wait\n<\/code><\/pre>\n\n\n\n<p>Verify deletion:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group exists --name \"$RG\"\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Offer curated StorageClasses<\/strong>, not dozens. Keep 2\u20134 tiers maximum (dev, general prod, high-perf, shared-file if applicable).<\/li>\n<li><strong>Match workload to access mode:<\/strong><\/li>\n<li><code>ReadWriteOnce<\/code> is common for block storage per pod.<\/li>\n<li><code>ReadWriteMany<\/code> requires a file-capable backend (if supported).<\/li>\n<li><strong>Design for failure domains:<\/strong> If the backend is zone-scoped, ensure node pools and pod topology align.<\/li>\n<li><strong>Avoid coupling storage to ephemeral node pools<\/strong> unless explicitly designed for it.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use least privilege for:<\/li>\n<li>Azure permissions to enable\/configure Azure Container Storage<\/li>\n<li>Kubernetes RBAC for creating PVCs and StorageClasses<\/li>\n<li>Restrict StorageClass creation to platform admins.<\/li>\n<li>Use policies to restrict which StorageClasses can be used per namespace.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enforce <strong>namespace ResourceQuotas<\/strong> and limit ranges for storage requests.<\/li>\n<li>Use policy to prevent accidental large PVC requests.<\/li>\n<li>Regularly audit:<\/li>\n<li>orphaned PVCs<\/li>\n<li>unused PVs (retained by reclaim policy)<\/li>\n<li>snapshot accumulation<\/li>\n<li>Tune logging\/metrics to avoid runaway Log Analytics costs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Benchmark with realistic I\/O patterns (latency\/IOPS\/throughput) before production rollout.<\/li>\n<li>Separate workloads:<\/li>\n<li>performance-critical databases on dedicated node pools and storage tiers<\/li>\n<li>general workloads on standard tiers<\/li>\n<li>Avoid noisy neighbor issues by limiting shared cluster usage for heavy stateful workloads unless you implement isolation (node pools, taints\/tolerations, quotas).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use multiple replicas for stateful apps where the app supports it (DB replication).<\/li>\n<li>Test node replacement scenarios and upgrades:<\/li>\n<li>confirm volumes reattach cleanly<\/li>\n<li>confirm pod rescheduling works<\/li>\n<li>Implement backup\/restore testing as a routine, not a one-time setup.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create runbooks for:<\/li>\n<li>PVC Pending<\/li>\n<li>mount\/attach failures<\/li>\n<li>slow I\/O<\/li>\n<li>backend quota exhaustion<\/li>\n<li>Centralize monitoring:<\/li>\n<li>Kubernetes events<\/li>\n<li>CSI component logs<\/li>\n<li>node disk\/memory pressure<\/li>\n<li>Track changes:<\/li>\n<li>use GitOps for StorageClass and policy manifests<\/li>\n<li>document approved storage tiers and SLAs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use naming conventions for:<\/li>\n<li>StorageClasses (include tier and intended workload)<\/li>\n<li>namespaces (team\/environment)<\/li>\n<li>Apply Azure tags consistently (environment, owner, cost center) to resource groups and any backing resources that are taggable (backend-dependent).<\/li>\n<li>Use Azure Policy to enforce tags where possible.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<p>Security spans two planes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Azure plane<\/strong>\n   &#8211; Who can enable\/configure Azure Container Storage on clusters\n   &#8211; Who can create\/modify backing resources\n   &#8211; Controlled by Azure RBAC and possibly management groups\/policies<\/p>\n<\/li>\n<li>\n<p><strong>Kubernetes plane<\/strong>\n   &#8211; Who can create PVCs (consuming storage)\n   &#8211; Who can create\/modify StorageClasses (defining how storage is provisioned)\n   &#8211; Controlled by Kubernetes RBAC and admission policies<\/p>\n<\/li>\n<\/ol>\n\n\n\n<p>Best practice:\n&#8211; Platform team owns StorageClasses and Azure Container Storage configuration.\n&#8211; App teams can create PVCs only in their namespaces.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>At rest:<\/strong> Most Azure storage backends encrypt at rest by default. Customer-managed keys (CMK) options vary by backend and configuration\u2014<strong>verify in backend documentation<\/strong>.<\/li>\n<li><strong>In transit:<\/strong> Kubernetes-to-Azure API traffic uses TLS. Data plane encryption depends on backend and protocol\u2014verify if you have strict requirements.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer private networking patterns:<\/li>\n<li>Use private endpoints where supported by the chosen backend.<\/li>\n<li>Ensure correct private DNS integration.<\/li>\n<li>Minimize public endpoint use for storage backends in regulated environments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<p>Azure Container Storage itself is typically managed through cluster identity. For application secrets:\n&#8211; Use Kubernetes secrets carefully (base64 is not encryption).\n&#8211; Prefer managed secret solutions:\n  &#8211; Azure Key Vault + CSI Secrets Store driver (where appropriate)\n  &#8211; External Secrets operators (with strong RBAC)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable Kubernetes audit logs if required by your compliance posture (AKS supports audit log integrations; verify current options).<\/li>\n<li>Use Azure Activity Logs for tracking Azure resource changes.<\/li>\n<li>Consider centralized SIEM integration (Microsoft Sentinel) if needed.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Validate data residency (region), encryption requirements, and retention requirements.<\/li>\n<li>Confirm the compliance certifications of the underlying storage backend (Azure compliance offerings vary by service and region).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Allowing developers to create arbitrary StorageClasses (can lead to insecure\/expensive configs).<\/li>\n<li>Not limiting PVC sizes (cost and risk).<\/li>\n<li>Using shared file volumes without correct POSIX permissions\/FSGroup configuration.<\/li>\n<li>Over-permissive cluster identity with broad subscription rights.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Lock down StorageClass and extension management to a small admin group.<\/li>\n<li>Use Azure Policy + admission policies to enforce allowed classes and maximum PVC sizes.<\/li>\n<li>Prefer private networking for storage backends where possible.<\/li>\n<li>Monitor for unexpected PV\/PVC growth and unusual I\/O patterns.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Because features and support boundaries can change, treat this list as a planning checklist and <strong>verify current limitations<\/strong> in official docs:\nhttps:\/\/learn.microsoft.com\/search\/?terms=Azure%20Container%20Storage%20limitations<\/p>\n\n\n\n<p>Common limitations and gotchas in Kubernetes storage designs (often applicable here):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Region and Kubernetes-version constraints:<\/strong> Some capabilities may only be available in certain regions or AKS versions.<\/li>\n<li><strong>Access mode constraints:<\/strong> Some backends are <code>ReadWriteOnce<\/code> only; <code>ReadWriteMany<\/code> may require a file-based backend.<\/li>\n<li><strong>Topology\/zone constraints:<\/strong> A pod may not schedule if the volume is constrained to a zone that doesn\u2019t match the node pool.<\/li>\n<li><strong>PVC expansion behavior:<\/strong> Online expansion and filesystem resize behavior depends on the StorageClass settings and backend.<\/li>\n<li><strong>Reclaim policy surprises:<\/strong> Deleting a PVC may or may not delete the underlying storage (depends on reclaim policy). Orphaned volumes can be a cost leak.<\/li>\n<li><strong>Upgrades and node rotation:<\/strong> Volume detach\/attach during upgrades can cause downtime if apps aren\u2019t resilient.<\/li>\n<li><strong>Monitoring cost:<\/strong> CSI logs and container logs can create high Log Analytics ingestion.<\/li>\n<li><strong>Quota exhaustion:<\/strong> Azure backend quotas (disk count, IOPS limits, capacity) can block provisioning at scale.<\/li>\n<li><strong>Backup expectations:<\/strong> Not all backends\/snapshot mechanisms behave the same; validate your backup\/restore workflow early.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Azure Container Storage sits in a broader ecosystem of Kubernetes and cloud storage options. The best choice depends on your workload, performance needs, and operational preferences.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Azure Container Storage<\/strong><\/td>\n<td>AKS platform teams standardizing Kubernetes storage<\/td>\n<td>Kubernetes-aligned provisioning with Azure-managed integration; consistent operational model<\/td>\n<td>Feature\/region\/version support may vary; backend-specific constraints<\/td>\n<td>When you want a curated, Azure-aligned storage experience for Kubernetes<\/td>\n<\/tr>\n<tr>\n<td><strong>AKS + Azure Disk CSI (direct)<\/strong><\/td>\n<td>Simple block storage for single-pod volumes<\/td>\n<td>Mature, widely used; straightforward<\/td>\n<td>More DIY standardization; RWO focus<\/td>\n<td>When needs are basic and teams can manage StorageClasses directly<\/td>\n<\/tr>\n<tr>\n<td><strong>AKS + Azure Files CSI (direct)<\/strong><\/td>\n<td>Shared file storage (RWX)<\/td>\n<td>RWX support; common for shared content<\/td>\n<td>Throughput\/latency not for all DBs; permissions complexity<\/td>\n<td>When multiple pods need shared files (web content, shared artifacts)<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure NetApp Files<\/strong><\/td>\n<td>High-performance enterprise NAS for stateful workloads<\/td>\n<td>Strong performance and enterprise features<\/td>\n<td>Higher cost; requires design expertise<\/td>\n<td>When you need premium file performance and enterprise capabilities<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Elastic SAN (direct via CSI where supported)<\/strong><\/td>\n<td>Consolidated block storage for many volumes (verify CSI integration path)<\/td>\n<td>Centralized capacity\/performance model<\/td>\n<td>Requires careful planning; not always simplest<\/td>\n<td>When you want SAN-like pooling and performance management<\/td>\n<\/tr>\n<tr>\n<td><strong>Self-managed Ceph \/ Rook<\/strong><\/td>\n<td>Teams wanting full control inside Kubernetes<\/td>\n<td>Portable; feature-rich<\/td>\n<td>High operational burden<\/td>\n<td>When you need cloud portability and accept ops complexity<\/td>\n<\/tr>\n<tr>\n<td><strong>Portworx \/ other third-party Kubernetes storage<\/strong><\/td>\n<td>Enterprise Kubernetes storage features<\/td>\n<td>Rich feature sets, replication, mobility<\/td>\n<td>Licensing cost; vendor dependency<\/td>\n<td>When you need advanced Kubernetes storage features beyond built-in options<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS EBS\/EFS<\/strong> (other cloud)<\/td>\n<td>Stateful Kubernetes on AWS<\/td>\n<td>Native integrations in AWS ecosystem<\/td>\n<td>Different governance and tooling<\/td>\n<td>When your platform is on AWS<\/td>\n<\/tr>\n<tr>\n<td><strong>GCP Persistent Disk\/Filestore<\/strong> (other cloud)<\/td>\n<td>Stateful Kubernetes on GCP<\/td>\n<td>Native integrations in GCP ecosystem<\/td>\n<td>Different governance and tooling<\/td>\n<td>When your platform is on GCP<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: Shared AKS platform for regulated workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A large enterprise runs multiple product teams on shared AKS clusters. Teams deploy PostgreSQL, Redis, and search indexes. Incidents occur due to inconsistent StorageClasses, oversized PVCs, and unclear ownership of storage costs.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Platform team enables Azure Container Storage on AKS clusters.<\/li>\n<li>Defines three StorageClasses:<ul>\n<li><code>dev-standard<\/code> (lower cost)<\/li>\n<li><code>prod-general<\/code> (baseline production)<\/li>\n<li><code>prod-performance<\/code> (I\/O intensive)<\/li>\n<\/ul>\n<\/li>\n<li>Enforces Azure Policy\/Kubernetes admission policies:<ul>\n<li>only approved StorageClasses allowed<\/li>\n<li>maximum PVC size by namespace<\/li>\n<\/ul>\n<\/li>\n<li>Central observability:<ul>\n<li>Container insights<\/li>\n<li>alerts on PVC provisioning failures and PV growth<\/li>\n<\/ul>\n<\/li>\n<li>Backup strategy validated for each stateful service (tooling chosen based on backend support).<\/li>\n<li><strong>Why Azure Container Storage was chosen:<\/strong><\/li>\n<li>Fits platform engineering model: curated, standardized, auditable Kubernetes storage provisioning.<\/li>\n<li>Integrates with Azure governance and operational tooling.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Reduced storage-related incidents (fewer ad-hoc configs)<\/li>\n<li>Predictable cost allocation (namespace tagging and quota enforcement)<\/li>\n<li>Faster onboarding for new teams (golden path templates)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: SaaS with a single AKS cluster<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A small SaaS team wants to run a few stateful components (PostgreSQL and background workers) on AKS but lacks time to engineer a complex storage stack.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Single AKS cluster<\/li>\n<li>Azure Container Storage enabled with one \u201cgeneral\u201d StorageClass<\/li>\n<li>Operator-managed PostgreSQL with PVCs<\/li>\n<li>Basic monitoring and weekly backup\/restore tests<\/li>\n<li><strong>Why Azure Container Storage was chosen:<\/strong><\/li>\n<li>Faster implementation with fewer moving parts than self-managed storage.<\/li>\n<li>Kubernetes-native pattern allows the team to keep everything in manifests.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Simple persistent storage setup with reasonable defaults<\/li>\n<li>Clear upgrade and troubleshooting path via AKS + Azure documentation<\/li>\n<li>Ability to introduce additional tiers later as the workload grows<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is Azure Container Storage a standalone storage service like Blob Storage?<\/strong><br\/>\nNo. It\u2019s primarily a Kubernetes-facing storage capability used through PV\/PVC and StorageClasses, usually associated with AKS (and potentially other supported Kubernetes environments\u2014verify).<\/p>\n\n\n\n<p>2) <strong>Do I still need PVCs and StorageClasses?<\/strong><br\/>\nYes. Azure Container Storage is consumed using standard Kubernetes storage objects.<\/p>\n\n\n\n<p>3) <strong>Does Azure Container Storage replace Azure Disks or Azure Files?<\/strong><br\/>\nTypically it <em>uses<\/em> Azure storage backends rather than replacing them. The backend depends on what Azure Container Storage supports in your configuration (verify).<\/p>\n\n\n\n<p>4) <strong>Can I use Azure Container Storage for <code>ReadWriteMany<\/code> (RWX) volumes?<\/strong><br\/>\nRWX depends on having a file-capable backend. Confirm which backends and access modes Azure Container Storage supports in your region and release.<\/p>\n\n\n\n<p>5) <strong>How do I know which StorageClass to use?<\/strong><br\/>\nAfter enabling Azure Container Storage, list StorageClasses (<code>kubectl get sc<\/code>) and use the one recommended by official docs for your scenario.<\/p>\n\n\n\n<p>6) <strong>Is Azure Container Storage production-ready?<\/strong><br\/>\nThis depends on current release status (preview vs GA), supported regions, and workload fit. Verify status and SLA statements in official docs.<\/p>\n\n\n\n<p>7) <strong>How do I back up PVC data?<\/strong><br\/>\nBackup methods vary: CSI snapshots (if supported), application-level backups, or Kubernetes backup tools. Validate snapshot support and consistency requirements for your databases.<\/p>\n\n\n\n<p>8) <strong>What happens if I delete a PVC?<\/strong><br\/>\nIt depends on the PV reclaim policy. You might delete the underlying storage (data loss) or retain it (cost leak). Always check reclaim behavior.<\/p>\n\n\n\n<p>9) <strong>Can I expand a PVC after creation?<\/strong><br\/>\nOften yes if the StorageClass allows volume expansion and the backend supports it. Verify your StorageClass settings and test expansion in non-prod.<\/p>\n\n\n\n<p>10) <strong>Why is my PVC stuck in Pending?<\/strong><br\/>\nCommon reasons: wrong StorageClass name, backend quota exhausted, region\/version not supported, or provisioning components not healthy. Use <code>kubectl describe pvc<\/code> and events.<\/p>\n\n\n\n<p>11) <strong>Do I need to open inbound network ports for storage?<\/strong><br\/>\nUsually not; storage traffic is outbound from nodes to Azure services. If using private endpoints, ensure correct routing\/DNS.<\/p>\n\n\n\n<p>12) <strong>Does Azure Container Storage work with GitOps?<\/strong><br\/>\nYes. Storage manifests (PVCs, quota policies, app deployments) are Kubernetes objects and fit GitOps well.<\/p>\n\n\n\n<p>13) <strong>How do I control costs across teams?<\/strong><br\/>\nUse quotas and policy to limit PVC sizes and allowed StorageClasses, and apply tagging\/cost allocation at Azure resource boundaries where possible.<\/p>\n\n\n\n<p>14) <strong>How do I monitor storage health?<\/strong><br\/>\nMonitor Kubernetes events, CSI pod logs, and backend storage metrics. Use Azure Monitor\/Container insights with tuned retention.<\/p>\n\n\n\n<p>15) <strong>Can I migrate existing PVs to Azure Container Storage?<\/strong><br\/>\nMigration depends on backend compatibility and existing PV types. Plan migrations at the application level (backup\/restore or replication), and validate on a staging cluster.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Azure Container Storage<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>https:\/\/learn.microsoft.com\/search\/?terms=Azure%20Container%20Storage<\/td>\n<td>Canonical starting point; find overview, quickstarts, and supported backends\/regions<\/td>\n<\/tr>\n<tr>\n<td>Official docs (AKS storage concepts)<\/td>\n<td>https:\/\/learn.microsoft.com\/azure\/aks\/concepts-storage<\/td>\n<td>Helps you understand PV\/PVC\/StorageClass patterns in AKS<\/td>\n<\/tr>\n<tr>\n<td>Official pricing calculator<\/td>\n<td>https:\/\/azure.microsoft.com\/pricing\/calculator\/<\/td>\n<td>Model end-to-end cost (AKS + storage + monitoring)<\/td>\n<\/tr>\n<tr>\n<td>Official pricing pages<\/td>\n<td>https:\/\/azure.microsoft.com\/pricing\/details\/managed-disks\/<\/td>\n<td>Understand managed disk pricing dimensions relevant to many Kubernetes volume scenarios<\/td>\n<\/tr>\n<tr>\n<td>Official pricing pages<\/td>\n<td>https:\/\/azure.microsoft.com\/pricing\/details\/storage\/files\/<\/td>\n<td>Understand file share pricing if your use case needs RWX<\/td>\n<\/tr>\n<tr>\n<td>Official architecture guidance<\/td>\n<td>https:\/\/learn.microsoft.com\/azure\/architecture\/<\/td>\n<td>Patterns and best practices for production Azure architectures<\/td>\n<\/tr>\n<tr>\n<td>Monitoring for containers<\/td>\n<td>https:\/\/learn.microsoft.com\/azure\/azure-monitor\/containers\/container-insights-overview<\/td>\n<td>Operational monitoring guidance for AKS<\/td>\n<\/tr>\n<tr>\n<td>Kubernetes storage concepts<\/td>\n<td>https:\/\/kubernetes.io\/docs\/concepts\/storage\/<\/td>\n<td>Vendor-neutral understanding of Kubernetes storage primitives<\/td>\n<\/tr>\n<tr>\n<td>CSI concept and drivers<\/td>\n<td>https:\/\/kubernetes-csi.github.io\/docs\/<\/td>\n<td>Understand CSI behavior, troubleshooting patterns, and lifecycle<\/td>\n<\/tr>\n<tr>\n<td>Azure updates (to track status changes)<\/td>\n<td>https:\/\/azure.microsoft.com\/updates\/<\/td>\n<td>Track GA\/preview announcements and region expansions (search for Azure Container Storage)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, platform teams, beginners to advanced<\/td>\n<td>DevOps, Kubernetes, AKS, CI\/CD, cloud operations<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Developers, build\/release engineers, DevOps learners<\/td>\n<td>SCM, CI\/CD, DevOps fundamentals, tooling<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud engineers, operations teams, architects<\/td>\n<td>Cloud operations, reliability, monitoring, cost<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.cloudopsnow.in<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, operations engineers, platform teams<\/td>\n<td>SRE practices, observability, incident response<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.sreschool.com<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops teams, SREs, engineers exploring AIOps<\/td>\n<td>AIOps concepts, automation, monitoring analytics<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.aiopsschool.com<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>Cloud\/DevOps training content (verify offerings)<\/td>\n<td>Learners seeking practical DevOps\/cloud guidance<\/td>\n<td>https:\/\/rajeshkumar.xyz<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps and tooling training (verify offerings)<\/td>\n<td>Beginners to intermediate DevOps practitioners<\/td>\n<td>https:\/\/www.devopstrainer.in<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps expertise marketplace\/info (verify offerings)<\/td>\n<td>Teams\/individuals needing targeted help<\/td>\n<td>https:\/\/www.devopsfreelancer.com<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support\/training resources (verify offerings)<\/td>\n<td>Ops teams seeking troubleshooting and operational guidance<\/td>\n<td>https:\/\/www.devopssupport.in<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting (verify portfolio)<\/td>\n<td>AKS platform setup, DevOps pipelines, cloud operations<\/td>\n<td>AKS landing zone, GitOps rollout, observability baseline<\/td>\n<td>https:\/\/cotocus.com<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps consulting and training services (verify offerings)<\/td>\n<td>Kubernetes enablement, CI\/CD modernization, SRE practices<\/td>\n<td>AKS production readiness review, pipeline standardization<\/td>\n<td>https:\/\/www.devopsschool.com<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting services (verify offerings)<\/td>\n<td>DevOps transformation, automation, operational support<\/td>\n<td>Kubernetes adoption planning, monitoring and alerting design<\/td>\n<td>https:\/\/www.devopsconsulting.in<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Azure Container Storage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kubernetes fundamentals:<\/li>\n<li>Pods, Deployments, StatefulSets<\/li>\n<li>Services and networking basics<\/li>\n<li>Kubernetes storage basics:<\/li>\n<li>PV, PVC, StorageClass<\/li>\n<li>Access modes (RWO\/RWX) and reclaim policies<\/li>\n<li>AKS fundamentals:<\/li>\n<li>node pools, upgrades, identity basics<\/li>\n<li>Azure fundamentals:<\/li>\n<li>resource groups, RBAC, networking (VNets), monitoring<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Advanced Kubernetes operations:<\/li>\n<li>upgrades, node rotation, disruption budgets<\/li>\n<li>GitOps:<\/li>\n<li>Flux or Argo CD<\/li>\n<li>Policy and governance:<\/li>\n<li>Azure Policy for AKS, Gatekeeper\/Kyverno<\/li>\n<li>Observability:<\/li>\n<li>Azure Monitor tuning, SLOs, alerting<\/li>\n<li>Stateful workload operations:<\/li>\n<li>database operators, backup\/restore, DR patterns<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Platform Engineer<\/li>\n<li>DevOps Engineer<\/li>\n<li>Site Reliability Engineer (SRE)<\/li>\n<li>Cloud Solutions Architect<\/li>\n<li>Kubernetes Administrator<\/li>\n<li>Security Engineer (governance\/policy)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>There is no known dedicated \u201cAzure Container Storage certification.\u201d Typical Azure\/Kubernetes certifications that align with this skill set:\n&#8211; Microsoft: AKS and Azure administrator\/architect certifications (verify current certification names\/paths on Microsoft Learn)\n&#8211; CNCF Kubernetes certifications (CKA\/CKAD\/CKS)<\/p>\n\n\n\n<p>Start here:\nhttps:\/\/learn.microsoft.com\/credentials\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a \u201cgolden path\u201d AKS namespace template:<\/li>\n<li>quotas + approved StorageClasses + sample StatefulSet<\/li>\n<li>Create a policy pack:<\/li>\n<li>restrict allowed StorageClasses<\/li>\n<li>enforce max PVC size per namespace<\/li>\n<li>Implement a backup\/restore drill for a StatefulSet database<\/li>\n<li>Run a performance benchmark suite comparing two storage tiers (with cost tracking)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AKS (Azure Kubernetes Service):<\/strong> Managed Kubernetes service on Azure.<\/li>\n<li><strong>Azure Container Storage:<\/strong> Azure-managed Kubernetes storage capability for persistent storage in container environments (verify exact supported scopes\/backends).<\/li>\n<li><strong>CSI (Container Storage Interface):<\/strong> Standard interface for exposing storage systems to Kubernetes.<\/li>\n<li><strong>PersistentVolume (PV):<\/strong> Kubernetes object representing provisioned storage.<\/li>\n<li><strong>PersistentVolumeClaim (PVC):<\/strong> Kubernetes object requesting storage resources.<\/li>\n<li><strong>StorageClass:<\/strong> Kubernetes object defining how storage is dynamically provisioned.<\/li>\n<li><strong>StatefulSet:<\/strong> Kubernetes workload controller for stateful apps requiring stable identity and storage.<\/li>\n<li><strong>Access modes (RWO\/RWX):<\/strong> Define whether a volume can be mounted read-write by one node or many.<\/li>\n<li><strong>Reclaim policy:<\/strong> What happens to storage when the PVC is deleted (<code>Delete<\/code> vs <code>Retain<\/code>).<\/li>\n<li><strong>Managed identity:<\/strong> Azure identity used by services (like AKS) to access Azure APIs securely.<\/li>\n<li><strong>Azure RBAC:<\/strong> Role-based access control for Azure resources.<\/li>\n<li><strong>Kubernetes RBAC:<\/strong> Role-based access control within a Kubernetes cluster.<\/li>\n<li><strong>Container insights:<\/strong> Azure Monitor feature for collecting logs\/metrics from Kubernetes clusters.<\/li>\n<li><strong>Private Endpoint \/ Private Link:<\/strong> Azure networking feature to access PaaS services privately from a VNet.<\/li>\n<li><strong>Quota:<\/strong> Limits on resources (including storage) applied at namespace level in Kubernetes.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Azure Container Storage is an Azure-managed way to provide <strong>persistent storage for Kubernetes workloads<\/strong>\u2014especially on <strong>AKS<\/strong>\u2014using standard Kubernetes primitives like <strong>StorageClasses and PVCs<\/strong> while aligning storage operations with Azure governance and operational tooling.<\/p>\n\n\n\n<p>It matters because stateful Containers are common in real systems (databases, indexes, pipelines), and reliable storage is where many Kubernetes platforms struggle operationally. Azure Container Storage helps platform teams standardize provisioning, improve operational consistency, and apply guardrails.<\/p>\n\n\n\n<p>Cost-wise, the biggest drivers are usually the <strong>backing storage capacity\/performance tier<\/strong>, <strong>AKS node compute<\/strong>, <strong>monitoring\/log retention<\/strong>, and <strong>snapshots\/backups<\/strong>. Security-wise, focus on <strong>least privilege<\/strong>, restricting StorageClass creation, enforcing policy on PVC sizes\/classes, and using private networking where required.<\/p>\n\n\n\n<p>Use Azure Container Storage when you want a Kubernetes-native storage experience that fits Azure operations and governance. If you only need basic volumes, direct use of CSI drivers and simpler storage patterns may be sufficient. Next step: review the current official documentation for supported regions\/backends and run the hands-on lab in a dev subscription:\nhttps:\/\/learn.microsoft.com\/search\/?terms=Azure%20Container%20Storage<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Containers<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[40,27,7],"tags":[],"class_list":["post-407","post","type-post","status-publish","format-standard","hentry","category-azure","category-containers","category-storage"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=407"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/407\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}