8 min read
Locking Down an Azure OpenAI Resource: Network, Identity, Keys, Logs
A security baseline for an Azure OpenAI preview resource in January 2023: private endpoints, Azure AD auth, customer-managed keys, logging and policy.
Networking
38 articles
1 min read
eBPF in Kubernetes: The Technology Behind Modern Networking
eBPF programs run in a sandboxed virtual machine within the Linux kernel, processing events without kernel modifications.
1 min read
Cilium Preview on AKS: eBPF-Based Networking
eBPF (Extended Berkeley Packet Filter) allows running sandboxed programs in the Linux kernel without changing kernel source code, enabling efficient…
1 min read
Azure CNI Overlay: Scalable Pod Networking
Traditional Azure CNI assigns VNet IPs to pods, limiting scale. Overlay mode uses a separate address space for pods.
1 min read
Calico on AKS: Advanced Network Policies
Calico provides enterprise grade network security for AKS with features beyond standard Kubernetes Network Policies.
1 min read
Kubernetes Network Policies: Securing Pod Communication
Network Policies provide essential microsegmentation for Kubernetes clusters. Enable a CNI that supports policies (like Azure CNI or Calico) to enforce them.
1 min read
DNS Forwarding Strategies for Azure Hybrid Architectures
1. Document all forwarding rules : Maintain a central registry 2. Use redundant DNS servers : Always specify multiple targets 3. Monitor DNS query latency :…
1 min read
Azure DNS Private Resolver: Hybrid DNS for the Cloud Era
DNS Private Resolver solves this without virtual machines.
1 min read
Azure Private Link Service: Expose Your Services Privately
Private Endpoint : Consume services privately (you're the client) Private Link Service : Expose services privately (you're the provider) 1. SaaS providers :…
1 min read
Private Endpoints Everywhere: Securing Your Azure Data Platform
A private endpoint: Creates a network interface with a private IP in your VNet Maps to a specific Azure resource (or sub resource) Enables DNS resolution to…
2 min read
Azure Data Factory Managed Virtual Network: Secure Data Integration
Data Flows automatically use the managed VNet when connected to private endpoints.
1 min read
Application Security Groups for Simplified Network Security
Traditional NSG rules use IP addresses, which creates challenges: IP addresses change when VMs are recreated Rules become hard to read with many IP ranges…
1 min read
Network Security Groups - Microsegmentation in Azure
NSG rules are evaluated by priority (100 4096, lower = higher priority): Direction : Inbound or Outbound Priority : 100 4096 (lower numbers processed first)…
2 min read
Configuring Azure Firewall Rules for Enterprise Security
Azure Firewall rules are the configuration work that determines whether your network security posture is genuinely restrictive or accidentally permissive.…
1 min read
Azure Private DNS Zones for Internal Name Resolution
Set up a private DNS zone for your organization: Complete Private DNS setup with Terraform: Create DNS zones for Azure Private Link services: Integrate…
1 min read
Simplified Outbound Connectivity with Azure NAT Gateway
NAT Gateway solves several problems: SNAT Port Exhaustion : Each NAT Gateway supports up to 64,000 concurrent connections per public IP Simplified…
1 min read
Azure Load Balancer - Distributing Traffic Effectively
Azure offers two SKUs: Basic : Free, limited features, no SLA Standard : Zone redundant, SLA backed, supports availability zones Set up an internet facing…
2 min read
Azure Virtual Network Peering - Connecting Your Networks
VNet peering is the network connectivity primitive I configure in almost every Azure architecture. The pitch is simple: two virtual networks, connected via…
1 min read
High-Bandwidth Connectivity with Azure ExpressRoute Direct
ExpressRoute Direct offers: Direct physical connectivity to Microsoft's network 10 Gbps or 100 Gbps port pairs Support for massive data ingestion scenarios…
1 min read
Azure Application Gateway v2: Regional Load Balancing Deep Dive
Application Gateway v2 is where the regional Layer 7 load balancer story became production-serious for enterprise workloads. Autoscaling means you don't…
1 min read
Azure Front Door Standard/Premium: Global Application Delivery
Azure Front Door Standard/Premium is the convergence I've been waiting for since the days when you had to choose between classic Front Door (global routing…
1 min read
Azure DDoS Protection: Defending Against Volumetric Attacks
Basic (Free) Always on traffic monitoring Automatic mitigation Protection for Azure infrastructure No SLA or customization Standard (Paid) All Basic…
1 min read
Azure Kubernetes Service Networking Deep Dive
AKS networking is the part of Kubernetes that looks like a detail until it becomes a blocker. "I can't reach the on-prem database from the cluster" is a…
1 min read
Centralized Security Management with Azure Firewall Manager
Azure Firewall Manager provides: Hierarchical policy management Parent and child policies for inheritance Global deployment Manage firewalls across regions…
1 min read
Enterprise Network Architecture with Azure Virtual WAN
Virtual WAN simplifies enterprise networking by providing: Hub and spoke architecture Automated connectivity between hubs and spokes Branch connectivity VPN…
2 min read
Secure VM Access with Azure Bastion
I keep writing about Bastion because I keep finding jump boxes I have to replace. VM with a public IP, port 3389 open, "admin" password in a sticky note in…
2 min read
Securing Azure Services with Private Link
Private Link provides several key benefits: Private connectivity Access services over private IP addresses Data exfiltration protection Service endpoints…
2 min read
Advanced Traffic Management with Azure Front Door Rules Engine
Front Door's global load balancing and caching are easy to understand. The Rules Engine is the part that turns it into a real edge platform. Conditions on…
1 min read
Azure Application Gateway v2: Advanced Load Balancing
App Gateway v1 was a credible Layer 7 load balancer. v2 is the upgrade that makes it the default I reach for in front of internal AKS clusters and App…
1 min read
Azure DDoS Protection: Defend Against Attacks
DDoS Protection Standard provides cost credits for attack-related scaling. Azure DDoS Protection: resilience against the largest attacks.
1 min read
Azure Bastion: Secure VM Access Without Public IPs
Jump boxes are one of those legacy patterns I keep finding in environments I inherit. A Windows VM with RDP open to the internet, "for admin access only,"…
1 min read
Azure Firewall: Network Security Fundamentals
Azure Firewall: cloud-native network security without the complexity.
1 min read
Azure Virtual WAN: Enterprise-Scale Networking
The hub-and-spoke topology I've drawn on whiteboards for years is what Virtual WAN turns into a deployable resource. A managed hub per region, automatic…
1 min read
Azure ExpressRoute: Private Connectivity to Azure
ExpressRoute: enterprise-grade private connectivity to Azure.
1 min read
Azure Private DNS Zones: Name Resolution in VNets
The first time a Private Endpoint refused to resolve correctly because the VNet was using Azure-provided DNS, I learned this lesson the hard way: private…
1 min read
Azure Virtual Network Peering: Connect VNets Seamlessly
Share VPN/ExpressRoute gateway across peered VNets. VNet peering is the foundation of Azure network architecture.
1 min read
Azure Application Gateway: Layer 7 Load Balancing
"Why don't I just use Azure Load Balancer?" is the question I get most often when someone first sees Application Gateway in the architecture diagram. The…
1 min read
Azure Private Link: Secure Access to PaaS Services
By default, Azure PaaS services (Storage, SQL, Cosmos DB) have public endpoints. Even with firewall rules, data transits the public internet.