Field Notes
Azure landing zones, leadership notes, and life adapting to change — including working in tech with MS. Practical rabbit holes from the queue to the cloud.
Browse articles
Jump to a topic without scrolling the full feed. Newest posts are still listed below.
Azure landing zone
- Deployment Model: Who Is Allowed to Click
- Cost: Who Pays When Nobody Owns the Bill
- Kusto: The Queries That End the Argument
- Logging: You Can’t Defend What You Can’t See
- Networking: Where Architecture Becomes Reality
- Private Endpoints: Architecture and Trade-Offs
- Identity & Access: The Undersized Control Plane
- Subscription Design
- Azure Policy in Landing Zones
- Management Groups
- Building a Landing Zone That Scales
- Private Endpoints: How They Work
Leadership
Latest posts
-
Guardrails on the Cluster
Azure Policy on the subscription was green. The cluster still allowed privileged pods from latest tags pulling public images. Governance stopped at the resource ID. Inside the API…
-
Who Deploys What on AKS
Everyone has kubectl. That is the problem. Cluster-admin in three teams’ CI jobs means the landing zone identity model stopped at the API server door. The hub is…
-
Workload Identity on AKS: Federation Over Secrets in Pods
The namespace had three Kubernetes Secrets that were just Storage account keys. Rotation was a wiki page. The wiki page was wrong. Pods kept working until they did…
-
AKS Networking Through the Hub
The cluster is private. Pods still cannot resolve privatelink.blob.core.windows.net. Or they can, but egress bypasses the firewall because the route table never made it onto the node subnet.…
-
Cluster Baseline You Will Defend
The marketplace of AKS addons looks like progress. Enable all of them and you inherit five upgrade trains, three ways to ship logs, and an on-call graph nobody…
-
AKS Belongs in the Landing Zone
Someone stood up AKS in a sandbox subscription with a public API server, admin group set to their user object ID, and default outbound to the Internet. It…
-
Platform Incident Response: Freeze, Isolate, Evidence
App incident response runbooks assume the cluster or the site is on fire. Platform incident response assumes the identity that deploys the cluster might be on fire too.…
-
Audit Season Runbook
They will not ask for your strategy narrative first. They will ask who has Owner at the root management group, how you know logs were retained, and why…
-
Secure SDLC for IaC
A README said “all changes through Terraform.” A platform engineer still had Owner and a habit. The insecure storage account arrived from a click, not from a PR.…
-
Network Posture Beyond the Firewall Slide
The architecture deck shows a firewall icon in the hub. The auditor asks how you prevent lateral movement inside a spoke. Silence. Someone opens a drawing of NSGs…