Azure

Azure networking is nested — VNet, subnet, NIC, NSG, each with one job. Here is the mental model that finally clicked for me, plus the one peering gotcha that bites everyone the first time.

Workload Identity replaces shared client secrets with per-pod OIDC tokens. Here is the mental model that finally clicked for me, plus the four pieces you need to wire it up on AKS.

Four names that look like four different things. Really, they are two real objects and two portal views. Here is the short version — what each one actually is, and which one to use in which situation.

Workload Identity gives every pod its own Azure identity. So why are we still passing connection strings around? Here is how I dropped them for SQL, Storage, and Service Bus — using DefaultAzureCredential and a single pattern.