Cloud Computing and Cloud Architecture

The cloud is not a deployment target. It is a different operating model with different identity primitives, a different cost model, and a different definition of what “available” means. Articles tagged here focus on the platform-specific decisions — Azure managed services, identity federation, regional design, billing — that decide whether a workload behaves like a cloud system or like a lift-and-shift that happens to run in someone else’s data centre.

Managed-service content sits at the centre of the collection. Azure SQL versus a self-managed instance is not only a price comparison; it is a decision about who owns patching, backup, failover, and the audit trail those operations produce. App Service versus Container Apps versus AKS is not a runtime question alone — each tier changes which knobs the platform owns and which the team has to operate. The articles name what each managed boundary actually covers, because the marketing material rarely does.

Identity is the second recurring theme. Managed Identity replaces stored credentials with Azure-attested tokens; Workload Identity Federation extends the same model to AKS and cross-tenant scenarios; conditional access enforces device and location constraints that ASP.NET Core authorization policies cannot see. Articles cover the wiring on both sides — Bicep for the role assignment, DefaultAzureCredential for the consumption — and the failure modes that show up only in production.

Cost-model articles treat consumption pricing as an architectural input. Cold-start latency in Functions, throughput units in Event Hubs, RU/s in Cosmos DB — each is a decision that shows up on the invoice before it shows up in a design review.

For container and twelve-factor patterns that apply across providers, see the cloudnative tag. This collection stays on the cloud-platform side of the line: the managed services, identities, and regional choices that only exist because a hyperscaler runs them.

Container Registry & Image Security in AKS Deployments

Container Registry & Image Security in AKS Deployments

Securing Azure Container Registry for AKS needs more than a single control. This guide walks through a production-ready sequence: vulnerability scanning, image signing, RBAC, private endpoints, policy enforcement, and geo-replication. You get practical Terraform, Kubernetes, and pipeline patterns, plus clear trade-offs for real-world operations.
Your TLS Config is Probably Wrong: Five Audit Failures I Keep Finding

Your TLS Config is Probably Wrong: Five Audit Failures I Keep Finding

Production systems with HTTP endpoints wide open and TLS 1.0 enabled for backward compatibility that died in 2020 are still everywhere. If auditors haven’t flagged your encryption config yet, they will. This guide shows the fatal configurations that fail security audits and the Azure Front Door patterns that actually pass.
Multi-AKS Cluster Networking & Hub-Spoke Topology

Multi-AKS Cluster Networking & Hub-Spoke Topology

Running more than one AKS cluster changes networking from a setup task into an operating model. This guide covers practical connectivity patterns, hub-spoke routing, cross-cluster DNS, ingress options, and decision criteria that help teams scale safely without adding complexity too early.
Observability in AKS CNI Overlay: When Pod IPs Hide Behind Nodes

Observability in AKS CNI Overlay: When Pod IPs Hide Behind Nodes

CNI Overlay masks pod IPs behind node IPs through SNAT, breaking traditional observability. Network logs show nodes, application logs show pods. Without Container Insights, correlation IDs, and distributed tracing, you’re debugging blind. SNAT port exhaustion mimics network failures, and timestamp-based correlation is fragile. The cost of proper monitoring is trivial compared to debugging outbound connectivity at 3 AM without visibility.
Your Azure SQL Is Public Right Now. ISO 27017 Demands You Fix It

Your Azure SQL Is Public Right Now. ISO 27017 Demands You Fix It

That SQL Server you deployed last week? Publicly accessible. That Storage Account? Same story. Azure defaults are security theater. ISO 27017 calls this a compliance violation, and your next audit will too. Stop trusting “cloud-native” to mean “secure” and start implementing VNets, Private Endpoints, and NSGs before your data becomes someone else’s problem.