AKS Production Reference Architecture

This reference architecture describes the canonical production deployment pattern for Cognisafe on Azure Kubernetes Service. It is the pattern a well-run platform team would build: zone-redundant, GitOps-driven, secret-rotation-safe, and observable from day one. Use it as an authoritative baseline, not a starting point you have to work backwards from. This document is intentionally opinionated. Where there are trade-offs, a specific choice is made and the rationale is given.

Architecture overview

                        Internet
                            │
                            ▼
               Azure Load Balancer (public IP, zone-redundant)
                            │
                            ▼
          NGINX Ingress Controller  (ingress-nginx namespace, 2 replicas)
          TLS terminated here · cert-manager issues Let's Encrypt wildcard
                            │
          ┌─────────────────┼──────────────────────┐
          ▼                 ▼                       ▼
proxy.cognisafe.        api.cognisafe.        app.cognisafe.
yourco.com              yourco.com            yourco.com
          │                 │                       │
          ▼                 ▼                       ▼
    proxy Service     api Service             web Service
    (ClusterIP)       (ClusterIP)             (ClusterIP)
          │                 │                       │
          │           ┌─────┤                       │
          │           ▼     ▼                       │
          │     PostgreSQL  Redis            api Service
          │     Flexible    Azure Cache      (server-side
          │     Server      for Redis        Next.js calls)
          │     (private    (private
          │     endpoint)   endpoint)
          │           ▲
          │           │
    safety-worker (3–20 replicas, HPA)
    pulls from Redis · runs scoring · writes scores to PostgreSQL

Azure Key Vault  ←→  CSI SecretProviderClass  ←→  all Deployments
Azure Container Registry  ←→  AKS kubelet identity (pull)
Azure Monitor + Container Insights  ←→  AKS diagnostics
Prometheus + Grafana (kube-prometheus-stack)  ←→  custom metrics

Node pools:
  system pool  (3× Standard_D4s_v3, across 3 zones)
  user pool    (3–10× Standard_D4s_v3, spot, across 3 zones, HPA-driven)
  [optional]   GPU pool (1–3× Standard_NC4as_T4_v3) for local LLM safety scoring

Why this architecture

Zone redundancy at every layer

A single AZ failure must not cause an outage. This requires: a zone-redundant load balancer, NGINX Ingress replicas across zones, application pods spread across zones via topologySpreadConstraints, a zone-redundant PostgreSQL Flexible Server, and an Azure Cache for Redis Standard C1 (which includes a replica in a separate fault domain). The AKS control plane is zone-redundant by default when you set --zones 1 2 3 on the node pools.

Spot instances for the safety worker only

The safety worker is the only component suitable for spot instances. It is stateless, processes jobs from a queue, and handles SIGTERM gracefully. The proxy, API, and web services are latency-sensitive and must run on regular-priority nodes to avoid the 30-second eviction notice.

GitOps, not imperative kubectl

All cluster state is declared in a Helm chart checked into a deploy/ directory. The CI pipeline runs helm upgrade --install on every merge to main. There is no “apply some YAML files” step in production — that creates configuration drift. The Helm chart is the single source of truth.

Node pool design

Pool	SKU	Count	Priority	Zones	Taints	Workloads
`system`	Standard_D4s_v3	3 (fixed)	Regular	1, 2, 3	`CriticalAddonsOnly=true:NoSchedule`	kube-system, ingress-nginx, cert-manager, monitoring
`user`	Standard_D4s_v3	3–10 (CA)	Regular	1, 2, 3	—	proxy, api, web
`worker`	Standard_D4s_v3	0–10 (CA+HPA)	Spot	1, 2, 3	`workload=scoring:NoSchedule`	safety-worker
`gpu` (optional)	Standard_NC4as_T4_v3	1–3	Regular	1	`hardware=gpu:NoSchedule`	local LLM safety scoring with GPU acceleration

# System pool — created at cluster provisioning time
az aks create \
  --resource-group rg-cognisafe-prod \
  --name aks-cognisafe-prod \
  --location uksouth \
  --kubernetes-version 1.30 \
  --node-count 3 \
  --node-vm-size Standard_D4s_v3 \
  --zones 1 2 3 \
  --enable-cluster-autoscaler \
  --min-count 3 \
  --max-count 3 \
  --nodepool-name system \
  --nodepool-taints "CriticalAddonsOnly=true:NoSchedule" \
  --enable-oidc-issuer \
  --enable-workload-identity \
  --attach-acr acr-cognisafe-prod \
  --enable-addons azure-keyvault-secrets-provider,monitoring \
  --workspace-resource-id /subscriptions/<sub>/resourcegroups/rg-cognisafe-prod/providers/microsoft.operationalinsights/workspaces/law-cognisafe-prod \
  --network-plugin azure \
  --network-policy azure \
  --generate-ssh-keys

# User pool (regular priority, zone-spread, autoscaler 3–10)
az aks nodepool add \
  --resource-group rg-cognisafe-prod \
  --cluster-name aks-cognisafe-prod \
  --name userpool \
  --node-count 3 \
  --min-count 3 \
  --max-count 10 \
  --enable-cluster-autoscaler \
  --node-vm-size Standard_D4s_v3 \
  --zones 1 2 3

# Worker pool (spot, autoscaler 0–10)
az aks nodepool add \
  --resource-group rg-cognisafe-prod \
  --cluster-name aks-cognisafe-prod \
  --name workerpool \
  --node-count 0 \
  --min-count 0 \
  --max-count 10 \
  --enable-cluster-autoscaler \
  --priority Spot \
  --eviction-policy Delete \
  --spot-max-price -1 \
  --node-vm-size Standard_D4s_v3 \
  --zones 1 2 3 \
  --node-taints "workload=scoring:NoSchedule" \
  --labels workload=scoring

Spot nodes receive 30 seconds notice before eviction via a scheduled event. The safety worker must catch SIGTERM and finish or re-queue its in-flight job before exiting. Set terminationGracePeriodSeconds: 60 on the safety-worker pod spec. If a worker exits mid-job, the Redis job will remain in the queue and be picked up by another replica.

Namespace design

Three namespaces keep platform, data, and monitoring concerns cleanly separated. RBAC policies are applied per namespace so the monitoring namespace cannot write to platform secrets.

# namespaces.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: cognisafe-system      # proxy, api, web, safety-worker
  labels:
    app.kubernetes.io/managed-by: helm
---
apiVersion: v1
kind: Namespace
metadata:
  name: cognisafe-data        # only used if running PostgreSQL/Redis in-cluster (not recommended for prod)
  labels:
    app.kubernetes.io/managed-by: helm
---
apiVersion: v1
kind: Namespace
metadata:
  name: cognisafe-monitoring  # kube-prometheus-stack, Grafana, alertmanager
  labels:
    app.kubernetes.io/managed-by: helm

In the reference architecture, PostgreSQL and Redis run as fully managed Azure services (PostgreSQL Flexible Server and Azure Cache for Redis), not in-cluster. The cognisafe-data namespace is only relevant if you choose to run in-cluster databases for cost or latency reasons — this is not recommended for production.

High availability configuration

Proxy (2+ replicas)

# Excerpt from Helm chart: values-prod.yaml
proxy:
  replicaCount: 2
  podDisruptionBudget:
    enabled: true
    minAvailable: 1
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: DoNotSchedule
      labelSelector:
        matchLabels:
          app: proxy
  resources:
    requests:
      cpu: 250m
      memory: 128Mi
    limits:
      cpu: "1"
      memory: 256Mi

API (2+ replicas)

api:
  replicaCount: 2
  podDisruptionBudget:
    enabled: true
    minAvailable: 1
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: DoNotSchedule
      labelSelector:
        matchLabels:
          app: api
  resources:
    requests:
      cpu: 500m
      memory: 512Mi
    limits:
      cpu: "2"
      memory: 1Gi

Safety worker (3 replicas minimum, HPA up to 20)

safetyWorker:
  replicaCount: 3
  tolerations:
    - key: workload
      operator: Equal
      value: scoring
      effect: NoSchedule
  nodeSelector:
    workload: scoring
  terminationGracePeriodSeconds: 60
  resources:
    requests:
      cpu: 500m
      memory: 512Mi
    limits:
      cpu: "2"
      memory: 2Gi

# hpa-safety-worker.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: safety-worker-hpa
  namespace: cognisafe-system
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: safety-worker
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 30
      policies:
        - type: Pods
          value: 3
          periodSeconds: 60
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
        - type: Pods
          value: 1
          periodSeconds: 120

If queue depth is a better signal than CPU for your workload (common during batch red team runs), deploy KEDA with the Azure Cache for Redis scaler targeting the safety_score_jobs list length. Set listLength: 100 as the trigger threshold — this scales one worker replica per 100 queued jobs.

PostgreSQL Flexible Server (zone-redundant)

az postgres flexible-server create \
  --resource-group rg-cognisafe-prod \
  --name pg-cognisafe-prod \
  --location uksouth \
  --sku-name Standard_D4s_v3 \
  --tier GeneralPurpose \
  --storage-size 128 \
  --version 15 \
  --high-availability ZoneRedundant \
  --zone 1 \
  --standby-zone 2 \
  --active-directory-auth Enabled \
  --password-auth Enabled \
  --backup-retention 30 \
  --geo-redundant-backup Enabled

Azure Cache for Redis (Standard C1 with replica)

az redis create \
  --resource-group rg-cognisafe-prod \
  --name redis-cognisafe-prod \
  --location uksouth \
  --sku Standard \
  --vm-size C1 \
  --enable-non-ssl-port false \
  --minimum-tls-version 1.2

Secret management

All secrets live in Azure Key Vault and are injected into pods at runtime via the Secrets Store CSI driver. Secrets are never stored in etcd, never in manifests, and never in environment files committed to source control. Key rotation happens in Key Vault; the CSI driver picks up new values on the next pod restart without a redeployment.

# Provision the Key Vault
az keyvault create \
  --resource-group rg-cognisafe-prod \
  --name kv-cognisafe-prod \
  --location uksouth \
  --sku standard \
  --enable-purge-protection true \
  --retention-days 90

# Store each secret (repeat for all vars)
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-postgres-url   --value "postgresql+asyncpg://..."
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-redis-url      --value "rediss://..."
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-proxy-api-key  --value "<random-256-bit>"
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-stripe-secret  --value "sk_live_..."
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-stripe-webhook --value "whsec_..."
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-internal-api   --value "<random-256-bit>"
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-openai-key     --value "sk-..."
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-clerk-secret   --value "sk_live_..."
az keyvault secret set --vault-name kv-cognisafe-prod --name cognisafe-clerk-pub-key  --value "pk_live_..."

# Create workload identity and federated credential
az identity create \
  --resource-group rg-cognisafe-prod \
  --name id-cognisafe-kv

IDENTITY_CLIENT_ID=$(az identity show \
  --resource-group rg-cognisafe-prod \
  --name id-cognisafe-kv \
  --query clientId -o tsv)

IDENTITY_OBJECT_ID=$(az identity show \
  --resource-group rg-cognisafe-prod \
  --name id-cognisafe-kv \
  --query principalId -o tsv)

OIDC_ISSUER=$(az aks show \
  --resource-group rg-cognisafe-prod \
  --name aks-cognisafe-prod \
  --query "oidcIssuerProfile.issuerUrl" -o tsv)

az keyvault set-policy \
  --name kv-cognisafe-prod \
  --object-id "$IDENTITY_OBJECT_ID" \
  --secret-permissions get list

az identity federated-credential create \
  --name cognisafe-federated \
  --identity-name id-cognisafe-kv \
  --resource-group rg-cognisafe-prod \
  --issuer "$OIDC_ISSUER" \
  --subject "system:serviceaccount:cognisafe-system:cognisafe-sa" \
  --audiences api://AzureADTokenExchange

Certificate management

cert-manager issues and renews a wildcard TLS certificate for *.cognisafe.yourco.com using DNS-01 challenge against Azure DNS. This avoids exposing each individual subdomain for HTTP-01 validation.

# clusterissuer-letsencrypt-prod.yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: platform@yourco.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - dns01:
          azureDNS:
            subscriptionID: <subscription-id>
            resourceGroupName: rg-cognisafe-prod
            hostedZoneName: yourco.com
            environment: AzurePublicCloud
            managedIdentity:
              clientID: <identity-client-id>

# certificate-wildcard.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: cognisafe-wildcard-tls
  namespace: cognisafe-system
spec:
  secretName: cognisafe-wildcard-tls
  dnsNames:
    - "*.cognisafe.yourco.com"
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer

Ingress rules

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cognisafe-ingress
  namespace: cognisafe-system
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
    nginx.ingress.kubernetes.io/limit-rps: "500"
    nginx.ingress.kubernetes.io/limit-connections: "100"
spec:
  tls:
    - hosts:
        - proxy.cognisafe.yourco.com
        - api.cognisafe.yourco.com
        - app.cognisafe.yourco.com
      secretName: cognisafe-wildcard-tls
  rules:
    - host: proxy.cognisafe.yourco.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: proxy
                port:
                  number: 8080
    - host: api.cognisafe.yourco.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 8000
    - host: app.cognisafe.yourco.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 3000

Deployment pipeline

The deployment pipeline runs on GitHub Actions. The pipeline builds, tests, pushes images to ACR, and performs a Helm upgrade. The Alembic migration runs as a Kubernetes Job before the new API pods are promoted, not as an init container in production (init containers on every replica are acceptable in staging but create race conditions at scale).

# .github/workflows/deploy.yml
name: Deploy to AKS

on:
  push:
    branches: [main]

env:
  ACR_NAME: acrcognisafeprod
  AKS_CLUSTER: aks-cognisafe-prod
  AKS_RG: rg-cognisafe-prod

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Build and push images
        run: |
          az acr login --name $ACR_NAME

          # API + worker (same image, different CMD)
          docker build -t $ACR_NAME.azurecr.io/cognisafe/api:$GITHUB_SHA api/
          docker push $ACR_NAME.azurecr.io/cognisafe/api:$GITHUB_SHA

          # Proxy
          docker build -t $ACR_NAME.azurecr.io/cognisafe/proxy:$GITHUB_SHA proxy/
          docker push $ACR_NAME.azurecr.io/cognisafe/proxy:$GITHUB_SHA

          # Web
          docker build -t $ACR_NAME.azurecr.io/cognisafe/web:$GITHUB_SHA web/
          docker push $ACR_NAME.azurecr.io/cognisafe/web:$GITHUB_SHA

  migrate:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Get AKS credentials
        run: az aks get-credentials --resource-group $AKS_RG --name $AKS_CLUSTER

      - name: Run Alembic migration Job
        run: |
          kubectl create job alembic-migrate-$GITHUB_SHA \
            --from=cronjob/alembic-migrate \
            -n cognisafe-system \
            --image=$ACR_NAME.azurecr.io/cognisafe/api:$GITHUB_SHA

          kubectl wait job/alembic-migrate-$GITHUB_SHA \
            -n cognisafe-system \
            --for=condition=complete \
            --timeout=300s

  deploy:
    needs: migrate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Get AKS credentials
        run: az aks get-credentials --resource-group $AKS_RG --name $AKS_CLUSTER

      - name: Helm upgrade
        run: |
          helm upgrade --install cognisafe deploy/helm/cognisafe \
            --namespace cognisafe-system \
            --create-namespace \
            --values deploy/helm/cognisafe/values-prod.yaml \
            --set global.image.tag=$GITHUB_SHA \
            --atomic \
            --timeout 10m \
            --wait

--atomic on the Helm upgrade automatically rolls back to the previous release if any pod fails its readiness probe within the timeout window. This prevents a bad deploy from leaving the cluster in a partially-upgraded state.

Observability

Azure Monitor + Container Insights

Container Insights is enabled at cluster creation. It provides per-node and per-pod CPU, memory, network, and disk metrics in Azure Monitor, plus log forwarding to a Log Analytics workspace. Navigate to AKS → Monitoring → Insights in the Azure Portal.

kube-prometheus-stack

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

helm install kube-prometheus-stack prometheus-community/kube-prometheus-stack \
  --namespace cognisafe-monitoring \
  --create-namespace \
  --set grafana.adminPassword="<strong-random-password>" \
  --set prometheus.prometheusSpec.retention=30d \
  --set prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.storageClassName=managed-premium \
  --set prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage=50Gi

Key alerts

Alert	Threshold	Severity	Action
safety-worker CPU	> 80% for 5 min	Warning	Check Redis queue depth; HPA should have responded
safety-worker CPU	> 95% for 2 min	Critical	Manual scale or investigate
API p99 latency	> 2 s	Warning	Check PostgreSQL connection pool, slow queries
Pod restart count	> 3 in 10 min	Critical	OOMKill or crash loop; `kubectl describe pod`
Redis queue depth	> 10,000	Warning	Workers not keeping up; scale manually
Redis queue depth	> 50,000	Critical	Workers saturated; investigate backpressure
PVC used	> 80%	Warning	Prometheus storage filling; expand PVC

Custom Cognisafe Prometheus metrics

Expose these metrics from the API service by adding a /metrics endpoint (FastAPI + prometheus-fastapi-instrumentator):

from prometheus_fastapi_instrumentator import Instrumentator

Instrumentator().instrument(app).expose(app, endpoint="/metrics")

Then define a ServiceMonitor so Prometheus scrapes the API pods:

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: cognisafe-api
  namespace: cognisafe-monitoring
  labels:
    release: kube-prometheus-stack
spec:
  namespaceSelector:
    matchNames:
      - cognisafe-system
  selector:
    matchLabels:
      app: api
  endpoints:
    - port: http
      path: /metrics
      interval: 30s

Backup and restore

Daily pg_dump to Azure Blob Storage

# Create storage account and container
az storage account create \
  --resource-group rg-cognisafe-prod \
  --name stcognisafebackup \
  --sku Standard_GRS \
  --kind StorageV2

az storage container create \
  --account-name stcognisafebackup \
  --name postgres-backups

# CronJob: runs pg_dump daily at 02:00 UTC
apiVersion: batch/v1
kind: CronJob
metadata:
  name: postgres-backup
  namespace: cognisafe-system
spec:
  schedule: "0 2 * * *"
  successfulJobsHistoryLimit: 7
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: cognisafe-sa
          restartPolicy: OnFailure
          containers:
            - name: pg-dump
              image: postgres:15
              env:
                - name: PGPASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: cognisafe-secrets
                      key: POSTGRES_PASSWORD
              command:
                - /bin/bash
                - -c
                - |
                  TIMESTAMP=$(date +%Y%m%d_%H%M%S)
                  pg_dump -h $PGHOST -U $PGUSER -d cognisafe -Fc \
                    | az storage blob upload \
                        --account-name stcognisafebackup \
                        --container postgres-backups \
                        --name "cognisafe_${TIMESTAMP}.dump" \
                        --auth-mode login \
                        --data @-

Retention: configure a lifecycle management policy on the storage account to delete blobs older than 30 days.

Tested restore procedure

List available backups

az storage blob list \
  --account-name stcognisafebackup \
  --container postgres-backups \
  --output table \
  --auth-mode login

Download the target dump

az storage blob download \
  --account-name stcognisafebackup \
  --container postgres-backups \
  --name "cognisafe_20260501_020012.dump" \
  --file /tmp/cognisafe.dump \
  --auth-mode login

Restore to a recovery PostgreSQL instance

# Point at the recovery server, NOT production
pg_restore -h pg-cognisafe-recovery.postgres.database.azure.com \
  -U adminuser \
  -d cognisafe \
  -Fc /tmp/cognisafe.dump \
  --no-owner \
  --no-privileges \
  --verbose

Verify row counts match expectation

SELECT schemaname, tablename, n_live_tup
FROM pg_stat_user_tables
ORDER BY n_live_tup DESC;

Promote the recovery instance

Update the POSTGRES_URL secret in Key Vault to point at the recovery server. Restart all pods to pick up the new connection string.

Run this procedure quarterly in a dedicated recovery subscription, not against production. An untested backup is not a backup.

Disaster recovery

Metric	Target	Mechanism
RTO (Recovery Time Objective)	1 hour	Zone failover is automatic via PostgreSQL zone-redundant HA. Region failover requires manual promotion of geo-replica and AKS redeployment in the secondary region.
RPO (Recovery Point Objective)	24 hours	Daily pg_dump backup. PostgreSQL Flexible Server also maintains continuous WAL backups (PITR up to 30 days).

Failover procedure (full region loss)

Promote PostgreSQL geo-replica

az postgres flexible-server replica promote \
  --resource-group rg-cognisafe-dr \
  --name pg-cognisafe-dr

Deploy AKS cluster in secondary region

Run the same Terraform/Bicep that provisions the primary cluster, targeting the secondary region (e.g., northeurope).

Update Key Vault secrets

Update cognisafe-postgres-url and cognisafe-redis-url in the secondary region’s Key Vault to point at the promoted replicas.

Deploy application via Helm

helm upgrade --install cognisafe deploy/helm/cognisafe \
  --namespace cognisafe-system \
  --values deploy/helm/cognisafe/values-prod.yaml \
  --set global.image.tag=<last-known-good-tag>

Reroute DNS

Update Azure DNS or Traffic Manager to point *.cognisafe.yourco.com at the secondary region’s load balancer IP.

Cost estimate

All prices are approximate UK South list pricing as of mid-2026. Actual costs depend on reserved instance discounts, egress, and storage.

Tier	AKS nodes	PostgreSQL	Redis	Total estimate
Small (< 1M req/mo)	3× D4s_v3 regular + 2× D4s_v3 spot	Standard_D2s_v3 (2 vCores)	Standard C0	~£800/mo
Medium (1–10M req/mo)	3× D4s_v3 regular + 3–5× D4s_v3 spot	Standard_D4s_v3 (4 vCores) + standby	Standard C1	~£1,800/mo
Large (10M+ req/mo)	3× D8s_v3 regular + 5–10× D4s_v3 spot	Standard_D8s_v3 (8 vCores) + standby	Standard C2	~£4,500/mo

Purchase 1-year reserved instances for the system and user node pools. Spot instances on the worker pool already provide 60–80% discount. Reserved instances on the regular pools typically save an additional 30–40% over pay-as-you-go.

Getting Started

SDKs

LLM Providers

Self-hosted Models

Self-hosting

Integrations

Reference Architectures

Deployment Blueprints

Safety & Scoring

AKS Production Reference Architecture

Architecture overview

Why this architecture

Zone redundancy at every layer

Spot instances for the safety worker only

GitOps, not imperative kubectl

Node pool design

Namespace design

High availability configuration

Proxy (2+ replicas)

API (2+ replicas)

Safety worker (3 replicas minimum, HPA up to 20)

PostgreSQL Flexible Server (zone-redundant)

Azure Cache for Redis (Standard C1 with replica)

Secret management

Certificate management

Ingress rules

Deployment pipeline

Observability

Azure Monitor + Container Insights

kube-prometheus-stack

Key alerts

Custom Cognisafe Prometheus metrics

Backup and restore

Daily pg_dump to Azure Blob Storage

Tested restore procedure

Disaster recovery

Failover procedure (full region loss)

Cost estimate

Security hardening checklist

​Architecture overview

​Why this architecture

​Zone redundancy at every layer

​Spot instances for the safety worker only

​GitOps, not imperative kubectl

​Node pool design

​Namespace design

​High availability configuration

​Proxy (2+ replicas)

​API (2+ replicas)

​Safety worker (3 replicas minimum, HPA up to 20)

​PostgreSQL Flexible Server (zone-redundant)

​Azure Cache for Redis (Standard C1 with replica)

​Secret management

​Certificate management

​Ingress rules

​Deployment pipeline

​Observability

​Azure Monitor + Container Insights

​kube-prometheus-stack

​Key alerts

​Custom Cognisafe Prometheus metrics

​Backup and restore

​Daily pg_dump to Azure Blob Storage

​Tested restore procedure

​Disaster recovery

​Failover procedure (full region loss)

​Cost estimate

​Security hardening checklist

Architecture overview

Why this architecture

Zone redundancy at every layer

Spot instances for the safety worker only

GitOps, not imperative kubectl

Node pool design

Namespace design

High availability configuration

Proxy (2+ replicas)

API (2+ replicas)

Safety worker (3 replicas minimum, HPA up to 20)

PostgreSQL Flexible Server (zone-redundant)

Azure Cache for Redis (Standard C1 with replica)

Secret management

Certificate management

Ingress rules

Deployment pipeline

Observability

Azure Monitor + Container Insights

kube-prometheus-stack

Key alerts

Custom Cognisafe Prometheus metrics

Backup and restore

Daily pg_dump to Azure Blob Storage

Tested restore procedure

Disaster recovery

Failover procedure (full region loss)

Cost estimate

Security hardening checklist