Azure Fleet Manager: How Microsoft Governs Thousands of K8s Clusters
Cloud Platform EngineeringMost Kubernetes governance tooling was designed for a team managing one cluster, maybe a handful. Microsoft manages thousands — and the gap between those two scales is where GitOps quietly breaks.
The Single-Cluster Assumption
GitOps is a proven pattern for Kubernetes configuration management at the individual cluster level. Policies live in Git; changes flow through automated reconciliation; drift gets corrected. The model works precisely because it assumes a bounded scope: one control plane, one set of manifests, one reconciliation loop.
As Stephane Erbrech, Principal Software Engineer at Microsoft’s Azure Kubernetes Fleet team, explains, the challenge at fleet scale isn’t deployment — it’s governance: maintaining consistency, security, and compliance across a vast distributed system where every cluster may exist in a different region, cloud, or regulatory context. GitOps tools were not designed for that coordination layer. A team managing 200 clusters with individual GitOps pipelines has 200 single-cluster problems, not one multi-cluster solution.
How Azure Kubernetes Fleet Manager Works
Azure Kubernetes Fleet Manager implements a hub-spoke architecture with a single fleet control plane that manages member clusters across public clouds, private data centers, and edge locations. The core primitives operate at a layer above individual clusters.
Managed Fleet Namespaces propagate resource quotas, network policies, and role-based access control definitions uniformly across member clusters. A compliance team defines the policy once at the fleet level; every cluster in the fleet inherits enforcement automatically. There is no per-cluster configuration drift to audit.
Resource placement uses declarative label-selector policies to assign namespace-scoped Kubernetes resources to clusters matching specific criteria — region, environment, capability, regulatory tier. Teams express intent; the fleet resolves placement. Combined with automated update orchestration, Fleet Manager can roll controlled Kubernetes version updates across hundreds of clusters sequentially, with staged rollout strategies and rollback gates, without anyone writing a custom deployment script.
Cross-cluster networking is handled through a managed Cilium cluster mesh that provides a unified connectivity layer, a global service registry, and intelligent routing across the fleet. For AI workloads — an increasingly common fleet tenant — Fleet Manager also manages GPU telemetry and network traffic visibility at fleet scope.
The So What
Platform teams running multi-cluster Kubernetes should evaluate where their current tooling stops being a governance solution and starts being a configuration-distribution problem. GitOps remains the right approach for individual cluster state management. But if coordinating policy, access control, placement, and update sequencing across clusters requires custom scripting, manual coordination, or per-cluster tooling duplication, that’s the gap Azure Kubernetes Fleet Manager addresses. For teams already running AKS, Fleet Manager is the natural control plane to add as cluster count grows. For multi-cloud or hybrid teams, the hub-spoke model is worth evaluating as a pattern regardless of provider — the k0s-based fleet approaches in the CNCF ecosystem address similar problems from a different direction.
Photo by panumas nikhomkhai on Pexels
Source: The New Stack
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →