Tag
Tagged “azure”
-
Building an AI Landing Zone on Azure — Part 3: One front door for many models
How a single, VNet-injected API Management instance becomes the only way to reach Azure OpenAI, Mistral OCR and Azure Maps, with policy fragments as composable building blocks and an identity per hop.
-
Building an AI Landing Zone on Azure — Part 2: The platform underneath
Before the gateway and the metering there is a private AKS cluster, a hub-and-spoke network and a GitOps setup where no application ever holds a secret. This is how that foundation is put together.
-
Building an AI Landing Zone on Azure - Part 1: Why every enterprise needs an AI gateway
Teams are calling LLM endpoints directly with API keys in config files and nobody knows who is spending what. Here is the landing zone I built to fix that, and why.
-
Building a Cloud-Native PKI with HashiCorp Vault
I built an HA Vault PKI on Kubernetes to sign the subordinate CA that Global Secure Access needs for TLS inspection. Vault cannot issue a certificate that is both a CA and carries Server Auth EKU, so it could not be done. Updated September 2026: Microsoft now offers a managed certificate for GSA in preview, which removes the problem entirely.
-
Self-hosted Gitlab Runners on AKS, with Managed Identities
Self-hosted GitLab runners on AKS using Managed Identities instead of service principals - so a runner can only ever act as itself, with exactly the permissions its jobs need.