Azure Kubernetes Service to STACKIT Kubernetes Engine

An AKS cluster with two node pools, converted

A small estate written for this page and assessed by StackToIT on 4 November 2026. Left: the input. Right: the resource blocks of the STACKIT Terraform the engine wrote; the review comments that sit above each block in the file are left out here.

resource "azurerm_kubernetes_cluster" "platform" {
  name                = "aks-platform"
  location            = azurerm_resource_group.platform.location
  resource_group_name = azurerm_resource_group.platform.name
  dns_prefix          = "platform"
  kubernetes_version  = "1.31"

  default_node_pool {
    name                 = "system"
    vm_size              = "Standard_D4s_v5"
    vnet_subnet_id       = azurerm_subnet.nodes.id
    auto_scaling_enabled = true
    min_count            = 2
    max_count            = 4
  }

  identity {
    type = "SystemAssigned"
  }

  network_profile {
    network_plugin = "azure"
  }
}

resource "azurerm_kubernetes_cluster_node_pool" "workloads" {
  name                  = "workloads"
  kubernetes_cluster_id = azurerm_kubernetes_cluster.platform.id
  vm_size               = "Standard_E8s_v5"
  vnet_subnet_id        = azurerm_subnet.nodes.id
  auto_scaling_enabled  = true
  min_count             = 3
  max_count             = 9
}

resource "stackit_ske_cluster" "platform" {
  project_id = var.project_id
  name       = "aks-2a0320"
  node_pools = [{
    name               = "system"
    machine_type       = var.azurerm_kubernetes_cluster_platform_default_node_pool_machine_type
    minimum            = 2
    maximum            = 4
    availability_zones = var.availability_zones
    }, {
    name               = "workloads"
    machine_type       = var.workloads_machine_type
    minimum            = 3
    maximum            = 9
    availability_zones = var.availability_zones
  }]
  kubernetes_version_min = "1.36"
}

• Every node pool lands in one SKE cluster

  The default node pool and the separate azurerm_kubernetes_cluster_node_pool become two node pools of the same SKE cluster. min_count and max_count carry over as minimum and maximum: 2 to 4 and 3 to 9.

• Machine types with the source size beside them

  Each pool gets its own machine type variable. Its description records the Azure size, about 4 vCPU and 16 GiB for Standard_D4s_v5 and about 8 vCPU and 64 GiB for Standard_E8s_v5, and links the STACKIT machine types.

• Version checked against SKE

  The source runs Kubernetes 1.31. SKE in eu01 supports 1.35 and newer, so the code asks for 1.36, the lowest supported version at or above the source, and flags the five minor versions it crosses so you check removed APIs first.

• Cluster name fitted to SKE

  An SKE cluster name has 1 to 11 characters. aks-platform has 12, so the code names the cluster aks-2a0320 and asks you to set the name you want.

The node subnet becomes a STACKIT network

From the same run. Left: the input. Right: the resource blocks StackToIT wrote; the review comments above each block in the file are left out here.

resource "azurerm_subnet" "nodes" {
  name                 = "snet-aks-nodes"
  resource_group_name  = azurerm_resource_group.platform.name
  virtual_network_name = azurerm_virtual_network.platform.name
  address_prefixes     = ["10.10.0.0/20"]
}

resource "stackit_network" "nodes" {
  project_id       = var.project_id
  name             = "snet-aks-nodes"
  ipv4_prefix      = "10.10.0.0/20"
  ipv4_nameservers = var.default_ipv4_nameservers
}

• Same IPv4 prefix

  snet-aks-nodes keeps 10.10.0.0/20 as the prefix of its STACKIT network, so the address plan stays as it is.

• No VNet object needed

  STACKIT has no VNet container. Each subnet becomes a network in a project, and networks that must reach each other privately join a Network Area.

• DNS named

  The source relies on the Azure-provided resolver, which also answers private DNS zones. The network reads its nameservers from a variable, and the code notes that private names need a DNS server of their own.

How the AKS estate maps

Classes as the run decided them. The resource group is not a unit of its own: STACKIT has no resource groups, so the resource group and subscription layout becomes your folder and project layout.

What the code names for your architects

• Cluster identity

  The system-assigned identity of the cluster has no counterpart on an SKE cluster. The run records it as a decision for the identity architect.

• API server address

  dns_prefix has no SKE counterpart, so the API server address changes. The code says to update kubeconfigs and clients.

• Cluster networking

  Azure CNI gives way to the networking SKE runs itself. The network plugin and the pod and service ranges are not carried, and the code says so.

• Storage and ingress

  Azure Disk and Azure Files storage classes become SKE storage classes, with persistent volumes moved by a backup tool such as Velero. Application Gateway ingress is re-created with an ingress controller on SKE.

Questions platform teams ask

Sources

• Microsoft Learn: What is Azure Kubernetes Service (AKS)?
• STACKIT Docs: Kubernetes Engine (SKE)