AKS SRE Platform — Real-Time Control Plane & Telemetry Console

Control Plane

Azure AKS

API Server 99.99% Up

Live Throughput

1,240 req/s

0.00% Error Rate

P99 SLA Latency

11.8 ms

Budget: < 50.0 ms

SRE Gate Compliance

12/12 PASS

47/47 Verification Tests

Interactive SRE Chaos & Traffic Controller

Trigger live microservice workload, inject dependency failure, or test circuit-breaker behavior in real time.

Throughput & Error Rate (RED Method)

Live requests/sec (blue) vs HTTP 5xx errors/sec (red) • 1s stream

Streaming Live

Duration & Latency Percentiles (P50, P90, P99)

Service response time • Target P99 < 50ms • Prometheus histogram

Histogram

Node & Pod Resource Saturation (USE Method)

VMSS Node: aks-sys-13411604-vmss000000 • Ubuntu 24.04 • 4 vCPU / 16GB

Sampling: 1000ms

Active Edge Ingress Telemetry

Real-time HTTP round-trip measurements to production edge.

Client-to-Edge RTT 18.4 ms

Protocol & TLS HTTP/2 • TLS 1.3

Edge Data Center Cloudflare SIN / SGN

Azure Ingress Route EastAsia • rg-aks-platform

Circuit Breaker: CLOSED (HEALTHY)

Live Cluster Event Stream (kubectl get events -w)

System Node Pool: aks-sys-vmss

NodeReady: 100%

NODE NAME	STATUS	ROLES	VERSION	OS IMAGE	KERNEL	CONTAINER RUNTIME
aks-sys-13411604-vmss000000	Ready	<none>	v1.36.4	Ubuntu 24.04.5 LTS	6.8.0-1071-azure	containerd://2.3.3-3

Core System & Security Pods (kube-system)

Azure CNI, Network Policy Manager, CoreDNS & Workload Identity Webhook

11/11 Running • 0 Restarts

POD NAME	READY	STATUS	RESTARTS	CPU	MEMORY	ROLE

ArgoCD GitOps Architecture & AppProjects

Multi-application isolation pattern with Automated Prune & Self-Heal SLA ≤ 21s

v2.13.0 Pinned

AppProject: portfolio Strict Boundary

Restricts source repos strictly to explicit repository URLs without wildcard leakage. Allowed cluster destinations: https://kubernetes.default.svc.

File: platform/argocd/appproject.yaml • 0 Wildcard rules

Application: flashsale Self-Heal Active

Synchronizes Azure FlashSale microservice stack. Automated sync enabled with automated prune policy. Target namespace: flashsale.

File: platform/argocd/applications/flashsale.yaml • main

python scripts/validate-gitops.py output:

  PASS                         appproject-sourceRepos     platform/argocd/appproject.yaml#portfolio  (2 repo(s), no wildcard)
  PASS                         appproject-destinations    platform/argocd/appproject.yaml#portfolio  (2 destination(s))
  PASS                         app-project                platform/argocd/applications/flashsale.yaml#flashsale  (project portfolio)
  PASS                         app-repoURL                platform/argocd/applications/flashsale.yaml#flashsale  (FlashSale-Backend)
  PASS                         app-targetRevision         platform/argocd/applications/flashsale.yaml#flashsale  (main)
  PASS                         app-path                   platform/argocd/applications/flashsale.yaml#flashsale  (infrastructure/kubernetes/overlays/local)
  PASS                         app-namespace              platform/argocd/applications/flashsale.yaml#flashsale  (flashsale allowed by portfolio)
  PASS                         app-automated-sync         platform/argocd/applications/flashsale.yaml#flashsale  (automated sync enabled)
  PASS                         app-sourceRepo-allowed     platform/argocd/applications/flashsale.yaml#flashsale  (allowed by project)
  PASS                         app-project                platform/argocd/applications/legacyapp.yaml#legacyapp  (project portfolio)
  PASS                         app-repoURL                platform/argocd/applications/legacyapp.yaml#legacyapp  (AKS-SRE-Platform)
  PASS                         app-targetRevision         platform/argocd/applications/legacyapp.yaml#legacyapp  (main)
  PASS                         app-path                   platform/argocd/applications/legacyapp.yaml#legacyapp  (apps/legacy-inventory/infrastructure/kubernetes/overlays/prod)
  PASS                         app-namespace              platform/argocd/applications/legacyapp.yaml#legacyapp  (legacyapp allowed by portfolio)
  PASS                         app-automated-sync         platform/argocd/applications/legacyapp.yaml#legacyapp  (automated sync enabled)
  PASS                         app-sourceRepo-allowed     platform/argocd/applications/legacyapp.yaml#legacyapp  (allowed by project)

GITOPS: 16 passed, 0 failed, 2 external advisory (1 AppProject file, 2 distinct applications)

Production SRE Compliance Gates (G1 – G12)

Verified architectural invariants across Terraform, GitOps, Kubernetes Probes and Observability

47/47 Clean

G1: Terraform lock file present

.terraform.lock.hcl verified in git

PASS

G2: Provider versions pinned

azurerm pinned strictly without optimistic range

PASS

G3: Probe split verified

liveness /health/live isolated from dependencies

PASS

G4: Host header injection safe

URL routing parsed strictly by PATH component

PASS

G5: Multi-window burn rate alerts

1h/6h/24h windows configured for SLO burn

PASS

G6: GitOps drift SLA ≤ 21.0s

Self-healing loop converges ≤ 21s

PASS

G7: Zero-Trust Workload Identity

OIDC Federated credential without long-lived keys

PASS

G8: AppProject sourceRepos locked

Zero wildcard `*` allowed in Git sources

PASS

G9: Failure injection gated

/api/fail unreachable in production profile

PASS

G10: CI verification breadth

All 47 invariant tests execute in CI gates

PASS

G11: Project file collision

Distinct namespace boundaries validated

PASS

G12: Argo CD version pinned

Pinned strictly to v2.13.0

PASS

Interactive SRE Chaos & Traffic Controller

Throughput & Error Rate (RED Method)

Duration & Latency Percentiles (P50, P90, P99)

Node & Pod Resource Saturation (USE Method)

Active Edge Ingress Telemetry

Live Cluster Event Stream (kubectl get events -w)

System Node Pool: aks-sys-vmss

Core System & Security Pods (kube-system)

Probe Split Architecture: Liveness vs Readiness

ArgoCD GitOps Architecture & AppProjects

Production SRE Compliance Gates (G1 – G12)