Sensitive infrastructure

An AKS upgrade unblocked without exposing private infrastructure details

BaristaLabs resolved subnet and VM-capacity blockers and completed the upgrade with zero application downtime.

A National Certification Board

Healthcare & Certification

6 min read

The Challenge

The organization's Azure Kubernetes Service cluster was running on a deprecated Kubernetes version and needed an upgrade to remain on a supported path. The upgrade was blocked by insufficient subnet IP headroom for rolling node replacement and limited regional capacity for the existing VM SKU.

Our Solution

BaristaLabs analyzed subnet utilization, calculated the IP headroom required for a safe rolling upgrade, provisioned a larger subnet, migrated node pools, selected an available equivalent-performance VM SKU, validated workloads, and completed the Kubernetes version upgrade without application downtime.

Results & Impact

Zero

Downtime

Application downtime during migration and upgrade

Restored

Kubernetes Support

Cluster returned to a vendor-supported Kubernetes version path

Expanded

Subnet Capacity

Additional IP headroom created for rolling upgrades and node scaling

Cleared

Upgrade Path

Future Kubernetes upgrades and node-pool changes no longer blocked by the original constraints

Project Snapshot

Engagement

AKS upgrade remediation

What Shipped

Subnet expansion, node-pool migration, VM SKU change, workload validation, and Kubernetes version upgrade

Public proof boundary

The client and infrastructure details stay confidential. The public proof can describe the blockers, remediation path, and zero-downtime result without naming systems or implying compliance certification.

Project Details

Difficulty Level

advanced

Team Size

1 person

Services Used

Cloud InfrastructureDevOps ConsultingCustom Solutions

Technologies

Azure Kubernetes ServiceAzure Virtual NetworkKubernetesAzure CLIInfrastructure as CodeContainer Orchestration

Related services and controls

Define the blocker before the migration

Bring the blocker, constraints, validation criteria, and recovery path. We'll scope the work around those boundaries without assuming a universal outcome.

Scope a sensitive technical blocker