AKS paid control plane on a non-production cluster
An AKS cluster on the Standard or Premium control plane tier while tagged non-production.
Why it happens
The AKS control plane is free on the Free tier, $0.10 per cluster per hour on Standard and $0.60 on Premium, independent of the nodes. Standard buys a financially-backed uptime SLA and Premium adds long term support for older Kubernetes versions. A development or test cluster cannot claim an SLA credit, so the tier is a fixed monthly charge for a guarantee it will never use. Moving to Free changes no feature a non-production cluster reaches.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.containerservice/managedclusters'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend tier = tostring(sku.tier)
| where tier in~ ('Standard', 'Premium')
| project name, resourceGroup, location, tier, clusterSku = tostring(sku.name), environment = cfopEnvFilter on sku.tier and NOT on sku.name. For AKS the name is the cluster SKU, Base or Automatic, while the tier is the separate Free, Standard or Premium field, so reading the name as a tier reads a different field that happens to sit beside the right one. The control plane is free on Free, about $0.10 per cluster per hour on Standard and $0.60 on Premium, independent of the nodes, and a non-production cluster cannot claim the SLA credit Standard buys. This is a structural test, so what it returns is what the check reports.
Applies to microsoft.containerservice/managedclustersWhat the agent does about it
An AKS cluster on the Standard or Premium control plane tier while tagged non-production.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
Premium container registry on a non-production registry
A container registry on the Premium tier while tagged non-production.
Container App holding replicas warm with no traffic
A Consumption-plan Container App with minReplicas above zero that served no HTTP requests in the window, so it paid idle charges to stay warm for traffic that never came.
Idle virtual machine
A running VM whose CPU and network have been near zero for the whole window.