Tink vs Azure CNI
Azure CNI is AKS's default CNI. It also exposes azure-cns, azure-npm, and VNet IPAM gauges for Prometheus. That is not a mechanic. Tink installs in one command, watches the Linux server, explains what is wrong, and helps you fix it.
Azure CNI scrapes VNets. Tink answers “why is this VPS sick?”
Accidental sysadmins land on Azure CNI because every AKS getting-started guide ships azure-cni. Then the volume fills, nginx dies, and Grafana still shows assigned IPs — no PromQL matched host fill. A filling /var is a Tink warning; it is not an azure-cns job unless the VNet pool itself is the failure.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep scraping Azure CNI if you already operate AKS and need CNI SLOs. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | Azure CNI |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Hours — azure-cni plugin, azure-cns, azure-npm, overlay vs VNet IPAM, and prometheus.yml scrape |
| What you get | Working monitoring, diagnosis, and approved fixes | A CNI scrape target. Host disk fill, nginx, Postgres, and certs stay your problem until PromQL fires and you SSH in |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open-source (MIT). You still pay AKS nodes, VNet/IP quotas, Prometheus, Grafana, and the engineer who owns azure-cns |
| Hidden costs | None — fully managed | VNet IP exhaustion, overlay SNAT surprises, azure-npm iptables storms, azure-cns CrashLoops, and a second tool to tell you the box is sick |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | azure-cns IPAM and azure-npm policy gauges. Azure CNI does not watch host fill or a quiet cert unless you added another exporter |
| Configuration | None after install — heuristics and AI | Overlay vs traditional Azure CNI, max pods, NetworkPolicy, and which PromQL actually pages you |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | You graph azure_npm_acl and cns IPAM in Grafana, then SSH in to change the box |
| Fix execution | Proposes and executes approved commands with an audit trail | Metrics only — Azure CNI cannot free disk, restart nginx, or rotate a cert |
| Alerting | Built-in across 8 channels | Not an Azure CNI job — Prometheus rules and Alertmanager have to fire |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Not an Azure CNI job — a CNI scrape does not forecast a quiet volume filling up |
| SSH brute-force detection | Built-in — parses auth.log every scan | Never — Azure CNI does not read auth.log, journald, or host firewall state |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | Silence if the agent dies — unless you built an up{job="azure-cns"} deadman check |
| Public status page | Shareable URL with 90-day history | None — Azure CNI has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | None — a VNet scrape target is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire Alertmanager into PagerDuty or another incident tool |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | az aks and Grafana. No mechanic you text when /var filled and azure-cns still showed IPs |
| Learning curve | None — works after install | Steep — azure-cns, azure-npm, overlay vs VNet, max pods, PromQL, and which IPAM counter actually pages |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Teams that already run AKS and need Azure CNI scrapes, not a sick-VPS mechanic |
When Azure CNI metrics are the right choice
Keep scraping Azure CNI when you already want that exact job:
- AKS CNI SLOs — you need VNet IPAM, overlay SNAT, and azure-npm policy counters, not a mechanic.
- Pod IP density at cluster scale — max pods and VNet CIDR matter more than host nginx, certs, and SSH on a quiet VPS.
- An existing Prometheus + Grafana stack — azure-cns already clusters, azure-npm already scrapes, and someone owns VNet quotas.
- Hosts that only page on Azure CNI — you already run exporters and PromQL, not a sick-box SSH loop.
The real cost of “just scrape Azure CNI”
Azure CNI is a serious AKS CNI. A working ops loop for five Linux boxes is not:
- A healthy azure-cns IPAM gauge still means you SSH in and change the box by hand
- Host fill, nginx, certs, and SSH brute-force never appear unless Prometheus scraped those signals and a rule fired
- A filling /var is a Tink disk warning on every scan — Azure CNI will stay quiet until the VNet pool itself is the failure
- A single VPS with a dead azure-cns still needs a mechanic, not another CNI scrape
For a 5-server team, Tink Mechanic at $45/month is cheaper than Azure CNI plus the engineer who keeps Prometheus scrapes and azure-npm policy rules alive, and every scan includes a diagnosis a quiet Grafana board will not type.
No VNet homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs Amazon VPC CNI · Tink vs Calico · Tink vs Prometheus