{"id":59520,"date":"2026-11-03T12:01:39","date_gmt":"2026-11-03T02:01:39","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/03\/how-aks-flex-nodes-extend-azure-clusters-to-your-own-compute\/"},"modified":"2026-11-03T12:03:08","modified_gmt":"2026-11-03T02:03:08","slug":"how-aks-flex-nodes-extend-azure-clusters-to-your-own-compute","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/03\/how-aks-flex-nodes-extend-azure-clusters-to-your-own-compute\/","title":{"rendered":"How AKS Flex Nodes Extend Azure Clusters to Your Own Compute"},"content":{"rendered":"\n

In this blog post How AKS Flex Nodes Extend Azure Clusters to Your Own Compute<\/strong> we will explain how Microsoft\u2019s new approach lets organisations use their own servers as part of an Azure Kubernetes Service cluster\u2014and why that flexibility needs careful governance.<\/p>\n\n\n\n\n\n\n\n

Many businesses have valuable computing capacity sitting outside Azure. It may be in a Melbourne data centre, another cloud, an edge location or a specialist server fitted with expensive AI processors. Until now, using that capacity often meant operating a separate Kubernetes environment, with another control plane, another security model and another set of management tools.<\/p>\n\n\n\n

AKS Flex Nodes are designed to reduce that duplication. They let selected external machines join an existing Azure Kubernetes Service cluster as worker nodes, while the main cluster management layer remains in Azure.<\/p>\n\n\n\n

What are AKS Flex Nodes?<\/h2>\n\n\n\n

Azure Kubernetes Service, or AKS, is Microsoft\u2019s managed platform for running applications packaged into containers. Containers bundle an application with what it needs to run, making it easier to move and operate consistently across different environments.<\/p>\n\n\n\n

An AKS cluster has two main parts. The control plane decides where applications should run and monitors their health. Worker nodes are the virtual machines that provide the processor, memory and storage needed to run them.<\/p>\n\n\n\n

Standard AKS worker nodes are normally created and managed inside Azure. Flex Nodes allow the cluster to use customer-managed Linux machines instead. These can include Azure virtual machines that AKS did not create, on-premises servers, bare-metal hardware or machines in another location.<\/p>\n\n\n\n

The business benefit is straightforward: you can potentially use existing or specialised capacity without building another Kubernetes cluster around it.<\/p>\n\n\n\n

How the technology works behind the scenes<\/h2>\n\n\n\n

A Flex Node agent is installed on each external host. This agent prepares an isolated Kubernetes worker environment, connects it securely to AKS and keeps its configuration aligned with the settings requested through Azure.<\/p>\n\n\n\n

The isolation layer uses systemd-nspawn, which creates a controlled environment for the Kubernetes components on the host. In plain English, AKS can update and manage the worker-node environment without taking ownership of, or replacing, the underlying server.<\/p>\n\n\n\n

Azure also creates a Machine resource for each connected host. This records the node\u2019s intended configuration and Kubernetes version. The physical machine remains yours, but AKS gains a management record for the Kubernetes environment running on it.<\/p>\n\n\n\n

Once connected, applications can be directed to Flex Nodes using labels and placement rules. This means an AI workload could run on a server with a particular graphics processor, while ordinary web services stay on standard Azure node pools.<\/p>\n\n\n\n

Where Flex Nodes could deliver business value<\/h2>\n\n\n\n

1. Reuse computing capacity you already own<\/h3>\n\n\n\n

Some organisations have recently purchased servers that still have years of useful life. Others have private-cloud capacity committed under long-term contracts.<\/p>\n\n\n\n

Flex Nodes could allow suitable machines to support an AKS environment rather than leaving them underused or paying for equivalent Azure capacity. However, the calculation must include power, support, networking and maintenance\u2014not just the apparent saving on cloud compute.<\/p>\n\n\n\n

2. Use specialist hardware without moving everything<\/h3>\n\n\n\n

AI, engineering and analytics workloads sometimes require specialised processors that are expensive or difficult to obtain in a particular Azure region. Flex Nodes can make that hardware available to an AKS cluster while keeping general workloads on conventional Azure infrastructure.<\/p>\n\n\n\n

This could be useful for organisations taking the next step after experimenting with smaller models such as those discussed in our guide to Azure Phi-3. It provides another option for running selected AI processing without redesigning the whole application platform.<\/p>\n\n\n\n

3. Process data closer to where it is created<\/h3>\n\n\n\n

A manufacturer may need to analyse camera or sensor data inside a factory rather than sending every file to Azure first. A retailer may want local processing in a distribution centre so operations can continue when internet connectivity is limited.<\/p>\n\n\n\n

A Flex Node at that location could run the local component while remaining part of the broader AKS operating model. This may reduce delays and bandwidth costs, but it does not automatically make an application offline-capable. The application must still be designed for interrupted connectivity.<\/p>\n\n\n\n

4. Reduce the number of separate platforms<\/h3>\n\n\n\n

Without Flex Nodes, teams may operate one Kubernetes cluster in Azure, another on-premises and perhaps a third near specialist hardware. Each environment needs patching, monitoring, access controls and upgrade planning.<\/p>\n\n\n\n

A shared control plane may reduce some of this operational duplication. It can also help platform teams apply more consistent deployment practices as AI projects move from experiments into production services, an issue explored in moving AI proofs of concept into production.<\/p>\n\n\n\n

A practical business scenario<\/h2>\n\n\n\n

Consider a 200-person Australian manufacturer with an AKS-based application in Azure and several powerful servers at its production site. Those local servers process equipment data, but the IT team maintains a separate Kubernetes environment for them.<\/p>\n\n\n\n

Flex Nodes could allow selected factory servers to join the Azure cluster. The company might then manage application placement and Kubernetes versions through a more consistent process, while keeping time-sensitive processing close to the machinery.<\/p>\n\n\n\n

The outcome could be fewer management systems and better use of existing hardware. The trade-off is that the company remains responsible for the servers, their operating system, network links and physical security.<\/p>\n\n\n\n

What Flex Nodes do not manage for you<\/h2>\n\n\n\n

Flex Nodes are not the same as handing your servers over to Microsoft. AKS manages the cluster control plane and the Flex Node integration, but your team still owns several critical areas:<\/p>\n\n\n\n

    \n
  • The host operating system:<\/strong> You must patch, harden and monitor the Linux machine.<\/li>\n
  • Network connectivity:<\/strong> The host, applications and AKS control plane need secure and reliable communication.<\/li>\n
  • Identity:<\/strong> Each host needs an approved Azure identity, such as a managed identity or an identity provided through Azure Arc.<\/li>\n
  • Physical hardware:<\/strong> Failed disks, processors and network interfaces remain your responsibility.<\/li>\n
  • Workload security:<\/strong> Container images, application permissions and stored secrets still require governance.<\/li>\n<\/ul>\n\n\n\n

    Networking deserves particular attention. During the preview, organisations provide the connectivity between locations. Microsoft\u2019s documented approach uses Unbounded-Net, a networking layer that connects applications across the participating sites. Existing AKS networking features do not simply extend themselves to an external server.<\/p>\n\n\n\n

    How workloads are placed on Flex Nodes<\/h2>\n\n\n\n

    After a node is connected and reports as ready, your platform team can check its pool and type with a command such as:<\/p>\n\n\n\n

    kubectl get nodes \\\n -L kubernetes.azure.com\/agentpool,kubernetes.azure.com\/nodepool-type<\/code><\/pre>\n\n\n\n
    A workload can then include a placement rule similar to this:<\/p>\n\n\n\n
    spec:\n template:\n spec:\n nodeSelector:\n kubernetes.azure.com\/agentpool: edgepool<\/code><\/pre>\n\n\n\n
    This example tells Kubernetes to place the application on nodes belonging to the named pool. In a real environment, CloudProInc would normally recommend additional restrictions so ordinary applications cannot accidentally consume specialist or edge capacity.<\/p>\n\n\n\n
    The security and compliance questions to ask<\/h2>\n\n\n\n
    Extending a cluster across locations also extends its security boundary. A compromised external host could create risk for workloads, identities and connected networks.<\/p>\n\n\n\n
    Australian organisations should assess the design against the Essential Eight\u2014the Australian Government\u2019s cybersecurity framework\u2014including patching, administrative access, application control and multi-factor authentication. Microsoft Defender and Wiz can add visibility, but neither replaces secure host configuration and clear operational ownership.<\/p>\n\n\n\n
    Ingress controls also remain important because connecting compute does not secure the applications exposed through the cluster. Platform owners should coordinate this work with their existing AKS ingress security and upgrade planning.<\/p>\n\n\n\n
    Should you use AKS Flex Nodes now?<\/h2>\n\n\n\n
    AKS Flex Nodes are currently a public preview. Microsoft has introduced guided Azure portal onboarding for supported Azure virtual machines and Azure Arc-enabled servers, but the feature still has preview support conditions and is not recommended for production workloads.<\/p>\n\n\n\n
    For most organisations, the right first step is a controlled evaluation using non-critical workloads. Test network behaviour, upgrades, node failures, security monitoring and removal procedures before calculating any expected saving.<\/p>\n\n\n\n
      \n
    1. Identify a workload with a genuine location or hardware requirement.<\/li>\n
    2. Confirm that existing hardware is suitable and supportable.<\/li>\n
    3. Model the full operating cost, including network and staff time.<\/li>\n
    4. Define who patches and monitors every layer.<\/li>\n
    5. Test failure scenarios before considering production use.<\/li>\n<\/ol>\n\n\n\n
      Flexibility is useful only when responsibility is clear<\/h2>\n\n\n\n
      AKS Flex Nodes could give businesses a practical middle ground between an Azure-only cluster and multiple independently managed platforms. The strongest use cases involve specialised hardware, edge processing or existing capacity with a clear financial value.<\/p>\n\n\n\n
      The feature does not remove infrastructure responsibility. It changes where that responsibility sits, so cost, security and support boundaries should be documented before a host joins the cluster.<\/p>\n\n\n\n
      CloudProInc combines more than 20 years of enterprise IT experience with hands-on Azure, AKS, Microsoft Defender and Wiz security expertise. If you are considering Flex Nodes\u2014or are unsure whether your current Kubernetes footprint is costing more than it should\u2014we are happy to review the design with you, with no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"
      AKS Flex Nodes connect your own servers and virtual machines to an Azure Kubernetes cluster. Learn where the preview could reduce costs and where it adds risk.<\/p>\n","protected":false},"author":1,"featured_media":59522,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[16,139,13],"tags":[],"class_list":["post-59520","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-azure","category-azure-kubernetes-service","category-blog"],"jetpack-related-posts":[{"id":59381,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/24\/securing-aks-ingress-why-the-alb-controller-1-12-4-update-matters\/","url_meta":{"origin":59520,"position":0},"title":"Securing AKS Ingress Why the ALB Controller 1.12.4 Update Matters","author":"CPI Staff","date":"October 24, 2026","format":false,"excerpt":"ALB Controller 1.12.4 includes security patches, but upgrading safely requires compatibility checks. Here is what AKS leaders need to review before approving the change.","rel":"","context":"In "Azure"","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/securing-aks-ingress-why-the-alb-controller-1-12-4-update-matters.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/securing-aks-ingress-why-the-alb-controller-1-12-4-update-matters.png 1x, \/wp-content\/uploads\/2026\/10\/securing-aks-ingress-why-the-alb-controller-1-12-4-update-matters.png 1.5x, \/wp-content\/uploads\/2026\/10\/securing-aks-ingress-why-the-alb-controller-1-12-4-update-matters.png 2x, \/wp-content\/uploads\/2026\/10\/securing-aks-ingress-why-the-alb-controller-1-12-4-update-matters.png 3x, \/wp-content\/uploads\/2026\/10\/securing-aks-ingress-why-the-alb-controller-1-12-4-update-matters.png 4x"},"classes":[]},{"id":435,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-to-deploy-a-wiz-outpost-to-microsoft-azure\/","url_meta":{"origin":59520,"position":1},"title":"How to Deploy a Wiz Outpost to Microsoft Azure","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"This Wiz Security article will explain how to deploy a Wiz outpost to Microsoft Azure cloud infrastructure. Listen to this article Before we discuss how to deploy an outpost, it is important to understand why many companies do so. A Wiz outpost is the deployment of the Wiz security scanner\u2026","rel":"","context":"In "Azure"","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2024\/07\/How-to-Deploy-a-Wiz-Outpost-to-Microsoft-Azure.webp","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2024\/07\/How-to-Deploy-a-Wiz-Outpost-to-Microsoft-Azure.webp 1x, \/wp-content\/uploads\/2024\/07\/How-to-Deploy-a-Wiz-Outpost-to-Microsoft-Azure.webp 1.5x, \/wp-content\/uploads\/2024\/07\/How-to-Deploy-a-Wiz-Outpost-to-Microsoft-Azure.webp 2x, \/wp-content\/uploads\/2024\/07\/How-to-Deploy-a-Wiz-Outpost-to-Microsoft-Azure.webp 3x, \/wp-content\/uploads\/2024\/07\/How-to-Deploy-a-Wiz-Outpost-to-Microsoft-Azure.webp 4x"},"classes":[]},{"id":59222,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/19\/azure-arc-key-vault-extension-migration-before-2027-retirement\/","url_meta":{"origin":59520,"position":2},"title":"Azure Arc Key Vault Extension Migration Before 2027 Retirement","author":"CPI Staff","date":"October 19, 2026","format":false,"excerpt":"Microsoft will retire the Azure Arc Key Vault Secrets Provider extension on 9 October 2027. Here is a practical migration plan that reduces disruption, security risk and rushed decisions.","rel":"","context":"In "Azure Key Vault"","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 1x, \/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 1.5x, \/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 2x, \/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 3x, \/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 4x"},"classes":[]},{"id":56770,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/securely-use-managed-identity-in-production-and-azure-cli-locally\/","url_meta":{"origin":59520,"position":3},"title":"Securely use Managed Identity in Production and Azure CLI Locally","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"A clean pattern: Managed Identity in prod, Azure CLI for local dev. Practical steps, code, and gotchas to keep secrets out and developers productive.","rel":"","context":"In "Azure"","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/11\/securely-use-managed-identity-in-production-and-azure-cli-locally.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/11\/securely-use-managed-identity-in-production-and-azure-cli-locally.png 1x, \/wp-content\/uploads\/2025\/11\/securely-use-managed-identity-in-production-and-azure-cli-locally.png 1.5x, \/wp-content\/uploads\/2025\/11\/securely-use-managed-identity-in-production-and-azure-cli-locally.png 2x, \/wp-content\/uploads\/2025\/11\/securely-use-managed-identity-in-production-and-azure-cli-locally.png 3x, \/wp-content\/uploads\/2025\/11\/securely-use-managed-identity-in-production-and-azure-cli-locally.png 4x"},"classes":[]},{"id":289,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/maximizing-security-when-to-use-wiz-outpost-with-azure\/","url_meta":{"origin":59520,"position":4},"title":"Maximizing Security: When to Use Wiz Outpost with Azure","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"In this Wiz blog post, we will explain when to use a Wiz Outpost with Azure and the benefits of using an outpost. Wiz.io is a cloud security platform that provides comprehensive protection for cloud-native environments. It offers real-time visibility into security risks and vulnerabilities across multi-cloud infrastructures, allowing organizations\u2026","rel":"","context":"In "Azure"","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2024\/05\/Maximizing-Security_-When-to-Use-Wiz-Outpost-with-Azure.-The-image-should-depict-a-secure-cloud-environment-.webp","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2024\/05\/Maximizing-Security_-When-to-Use-Wiz-Outpost-with-Azure.-The-image-should-depict-a-secure-cloud-environment-.webp 1x, \/wp-content\/uploads\/2024\/05\/Maximizing-Security_-When-to-Use-Wiz-Outpost-with-Azure.-The-image-should-depict-a-secure-cloud-environment-.webp 1.5x, \/wp-content\/uploads\/2024\/05\/Maximizing-Security_-When-to-Use-Wiz-Outpost-with-Azure.-The-image-should-depict-a-secure-cloud-environment-.webp 2x"},"classes":[]},{"id":53466,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/top-vs-code-extensions-for-developers-and-devops-engineers\/","url_meta":{"origin":59520,"position":5},"title":"Top VS Code Extensions for Developers and DevOps Engineers","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"If you're searching for the Top VS Code Extensions for Developers and DevOps Engineers, you've come to the right place. Visual Studio Code (VS Code) has become one of the most popular editors for modern software development due to its speed, flexibility, and the massive ecosystem of extensions. In this\u2026","rel":"","context":"In "Blog"","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/07\/image-13.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/07\/image-13.png 1x, \/wp-content\/uploads\/2025\/07\/image-13.png 1.5x, \/wp-content\/uploads\/2025\/07\/image-13.png 2x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/11\/how-aks-flex-nodes-extend-azure-clusters-to-your-own-compute.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59520"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59520\/revisions"}],"predecessor-version":[{"id":59521,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59520\/revisions\/59521"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59522"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}