Stage 5 · Platform

Storage & Secrets

Managed Disks & Persistent Volumes

Premium SSD, LRS/ZRS/GRS replication, and PVC provisioning in AKS.

7 min readAzure Cloud EngineeringPlatform

Managed Disk Types

Azure Managed Disks come in several types optimized for different workloads. Premium SSD v2 and Ultra Disks provide the lowest latency for I/O-intensive applications.

Disk Type	IOPS	Throughput	Latency	Best For
Standard HDD	500	60 MB/s	~10ms	Backup, infrequent access
Standard SSD	6,000	750 MB/s	~1ms	Dev/test, web servers
Premium SSD	20,000	900 MB/s	<1ms	Production databases
Premium SSD v2	80,000	1,200 MB/s	<1ms	SAP HANA, critical workloads
Ultra Disk	160,000	4,000 MB/s	<1ms	SQL Server, Oracle

Replication Options

Managed Disks support three replication types. LRS (Locally Redundant) copies data three times within a single datacenter. ZRS (Zone-Redundant) spreads copies across three availability zones. GRS adds cross-region replication.

Create a disk with specific replication


# Create a Premium SSD with LRS
az disk create \
  --resource-group rg-payments \
  --name disk-payments-data \
  --size-gb 256 \
  --sku Premium_LRS \
  --lun 0

# Create a disk with ZRS (zone-redundant)
az disk create \
  --resource-group rg-payments \
  --name disk-payments-zrs \
  --size-gb 256 \
  --sku Premium_ZRS

LRS provides 99.999999999% durability (11 nines) within a datacenter. ZRS extends this across zones but is only available for certain disk types in supported regions.

Disk Performance

Disk performance scales with size. A larger Premium SSD has more IOPS and throughput. You can also provision IOPS and throughput independently with Premium SSD v2 and Ultra Disks.

Check disk performance metrics


# Monitor disk IOPS and throughput
az monitor metrics list \
  --resource "/subscriptions/{sub-id}/resourceGroups/rg-payments/providers/Microsoft.Compute/disks/disk-payments-data" \
  --metric "Disk IOPS" \
  --interval PT1M \
  --query "value[].timeseries[].data[].average" --output table

Premium SSD performance is provisioned — you always get the IOPS and throughput you pay for, regardless of disk utilization.

Persistent Volume Claims in AKS

Kubernetes Persistent Volume Claims (PVCs) request storage from the cluster. The Azure Disk CSI driver provisions Managed Disks automatically when PVCs are created.

Persistent Volume Claim manifest


apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-payments-data
  namespace: default
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: managed-csi-premium
  resources:
    requests:
      storage: 100Gi

The managed-csi-premium StorageClass provisions Premium SSD Managed Disks. Use managed-csi for Standard SSD or managed-csi-ultra for Ultra Disks.

Use PVC in a Deployment


apiVersion: apps/v1
kind: Deployment
metadata:
  name: payments-api
spec:
  replicas: 1
  selector:
    matchLabels:
      app: payments
  template:
    spec:
      containers:
      - name: payments
        image: craksprodeastus.azurecr.io/payments:v1
        volumeMounts:
        - name: data-volume
          mountPath: /data
      volumes:
      - name: data-volume
        persistentVolumeClaim:
          claimName: pvc-payments-data

ReadWriteOnce PVCs can only be mounted to a single node. For multi-node access, use Azure Files with ReadWriteMany access mode.

ReadWriteOnce limits pod scheduling

A ReadWriteOnce Azure Disk PVC can only be attached to one node. If your deployment has multiple replicas, each needs its own PVC. Use Azure Files for shared storage.

Disk Encryption

Managed Disks are encrypted at rest by default with platform-managed keys. For additional control, use customer-managed keys (CMK) stored in Key Vault, or double encryption with both platform and CMK.

Create disk with customer-managed key


# Create an encryption set with Key Vault
az disk-encryption-set create \
  --resource-group rg-payments \
  --name des-payments \
  --key-url "https://kv-payments-prod.vault.azure.net/keys/encryption-key/{version}" \
  --source-vault kv-payments-prod

# Create a disk with the encryption set
az disk create \
  --resource-group rg-payments \
  --name disk-payments-cmk \
  --size-gb 256 \
  --sku Premium_LRS \
  --disk-encryption-set des-payments

Customer-managed keys give you full control over encryption keys. You can revoke access, rotate keys, and audit key usage through Key Vault.

Snapshots and Backup

Disk snapshots create a point-in-time copy of a managed disk. They are used for backup, disaster recovery, and creating custom images.

Create and restore a snapshot


# Create a snapshot
az snapshot create \
  --resource-group rg-payments \
  --name snap-payments-20250115 \
  --source disk-payments-data \
  --sku Standard_LRS

# Create a disk from a snapshot
az disk create \
  --resource-group rg-payments \
  --name disk-payments-restored \
  --sku Premium_LRS \
  --source "/subscriptions/{sub-id}/resourceGroups/rg-payments/providers/Microsoft.Compute/snapshots/snap-payments-20250115"

# List snapshots
az snapshot list --query "[].{name:name, sizeGB:diskSizeGb, time:creationTime}" --output table

Snapshots are incremental by default — only changed blocks are stored. This reduces both cost and creation time compared to full copies.

Use Azure Backup for automated disk snapshots

Azure Backup can automatically create daily/weekly snapshots of managed disks with retention policies. It is simpler and more reliable than manual snapshot scripts.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.