Azure Vertical vs. Horizontal Scaling

Start with the workload, not the label.

Scaling decisions depend on how an application behaves, where its bottlenecks sit, and which changes the team can operate safely. A useful plan makes those assumptions explicit.

Understand the constraintsIdentify application state, shared services, database behavior, availability requirements, and the kinds of load the system needs to serve.
Compare the operational tradeoffsConsider architecture complexity, deployment effort, observability, and the operational ownership needed for each approach.
Validate against real demandAgree what to measure, how to evaluate performance, and which signals should trigger the next change.

Company Profile

ReadyPay is a Series B fintech running a real-time payment authorization + settlement platform on Azure Kubernetes Service (AKS). It supports ~200 merchant integrations and connects to upstream processors including StripeConnect, Adyen, and BankNet.

Current footprint:

AKS: 3-node cluster on D8s_v5 with Azure CNI on a /24 subnet
Workloads: transaction engine + settlement workers + webhook processors
Data: Azure SQL + Redis (Private Endpoints)
Egress: Standard Load Balancer outbound SNAT
Observability: App Insights + Container Insights

The Problem

ReadyPay saw predictable p99 latency spikes from ~120ms baseline to 800ms+ during peak windows (market open and lunch rush), causing SLA breaches with enterprise merchants. Leadership was split on what to do:

CTO

horizontal scaling (HPA + Cluster Autoscaler)

Infra lead

vertical scaling (move to D16s_v5; they already bought D16s_v5 Reserved Instances but deferred the upgrade)

Without Company Context vs With Company Context

CloudGo.ai benchmarked the same prompt against Claude without access to ReadyPay's internal docs.

Without Company Context

• flagged SNAT exhaustion as a high probability root cause

• suggested investigating SQL and Redis connection behavior

• recommended a phased plan (NAT Gateway → vertical scaling with RIs → conservative horizontal scaling)

• provided a validation checklist (look at LB SNAT metrics, kubectl top, etc.)

But the key limitation: it had to hypothesize and ask ReadyPay to validate before acting. It could not confirm what was actually happening or what was operationally blocked.

With Company Context

CloudGo.ai connected two things Claude did not have:

• Read-only Azure environment connection (inventory + live telemetry + config)

• Internal company documentation (ADRs, incident history, PCI policy, vendor constraints, cost reports, team skills)

Confirmed reality from telemetry:

• CPU CFS throttling: ~3,200 throttled periods/min during peak despite node CPU headroom

• SNAT pressure: ~93% utilization with ~45–47 failures/min during peak windows

• Subnet constraint: /24 subnet with only 51 IPs remaining → effectively blocks node scale-out

• Ruled out red herrings: SQL ~78% DTU (healthy), Redis load ~0.38 avg (healthy)

Pulled critical constraints from ReadyPay docs:

• ADR-017 mandated Guaranteed QoS + tight CPU limits after a prior incident; it also defined an escalation threshold (500/min throttling) that ReadyPay was exceeding by ~6×

• INC-2025-031 showed a prior peak-time outage misdiagnosed as network instability, with Azure support pointing at SNAT; the NAT Gateway action item was opened but never executed

• PCI network change policy: subnet CIDR changes are Tier 1 changes with 2–3 week lead time

• Vendor constraints: processors require IP allowlisting, and BankNet requires 30-day notice for IP changes (so egress IP stability matters)

The Decision

CloudGo.ai reframed the “horizontal vs vertical” debate into a sequencing problem:

Finding: Both scaling strategies were premature because three independent bottlenecks would persist (or worsen) under scaling—and one strategy (horizontal) was physically blocked by subnet/IP capacity.

Context-aware conclusion:

Horizontal scaling first is not just risky—it’s not currently executable (subnet IP ceiling), and it would likely worsen SNAT exhaustion.
Vertical scaling is attractive because it leverages existing D16s_v5 RIs, but it should happen after addressing the immediate causes of tail latency (SNAT + throttling) and after planning IP headroom for safe node-pool migration.

What CloudGo.ai Recommended

Step-by-step plan

Define success criteria

What “good” looks like (cost, latency, reliability, timelines).

Implement the minimum safe baseline

Logging, metrics, alerts, backups, and access controls.

Iterate with measured changes

Change one lever at a time; validate impact against metrics.

Phase 0 (immediate): stop the p99 spike drivers

Deploy NAT Gateway for AKS egress (massively increases SNAT port capacity vs default LB allocation)
Adjust/raise/remove CPU limits for the latency-sensitive transaction engine (keep requests; stop throttling during bursts)
Add app-side guidance (e.g., .NET connection reuse/pooling) to further reduce SNAT churn

Phase 1 (weeks 1–3): unblock safe scaling

Address IP constraints (expand subnet / add subnet + new node pool / move to overlay/dynamic IP allocation) acknowledging PCI change gates

Phase 2 (after prerequisites): capture RI value + add resilience

Migrate node pool to D16s_v5 using existing Reserved Instances
Then enable HPA + Cluster Autoscaler with guardrails once IP and egress are stable

Business Impact of Adding Context

Why the company context materially benefited ReadyPay:

✅ Speed + certainty: shifted from “investigate then remediate” to “remediate now with confirmed parameters” (critical when SLAs are being breached).
✅ Avoided a costly wrong move: prevented a horizontal scale-out plan that was blocked by subnet IPs and likely to increase SNAT failures — a classic “make it worse while spending more” outcome.
✅ Operationally executable plan: integrated real constraints (PCI lead times, vendor allowlisting/notice windows, prior incident learnings), not generic best practices.
✅ Cost-aware optimization: identified that the full plan was likely net-neutral or net-saving after applying existing RIs (including an example of -$1,960/mo eliminable on-demand compute offsetting modest NAT costs).
✅ Reduced commercial risk: faster stabilization of merchant-facing tail latency reduces ongoing SLA penalties, churn risk, and executive-level escalation pressure.

Download the full case study (PDF)readypay_case_study.pdf