Newest first, grouped by year. Search or filter by topic.
Sync-over-async, a new HttpClient per call, out parameters everywhere - the discovery library needed a rewrite, and dozens of deployed consumers meant it could not break anyone. How the second generation shipped side by side with the first in the same NuGet package, what it fixed, and the one thing it deliberately kept. Part 7 of Service Discovery Without a Service Mesh.
The complete honest ledger for a Key Vault-backed service discovery layer after years in production - the debts I would pay tomorrow, the trade-offs I would sign again, and the concrete signals that it is time to graduate to App Configuration, APIM, Dapr or a mesh. Part 8, the finale of Service Discovery Without a Service Mesh.
The estate's transaction logging wrote to blob storage through a dedicated logging function - which consumers located through the same Key Vault registry the logger belongs to. Discovery consuming discovery, the transaction-id thread that made it useful, and the bootstrap questions self-reference always raises. Part 6 of Service Discovery Without a Service Mesh.
One static registration method wires the whole discovery subsystem into an Azure Functions host, and one CI pipeline packs it as a private NuGet package. The lifetime choices in those few lines quietly decide the caching semantics of the entire estate - and a duplicate registration teaches how DI forgives. Part 5 of Service Discovery Without a Service Mesh.
Above raw resolution sits a convention layer - an abstract endpoint base class that derives its Key Vault lookup key from its own type name, a template method separating the call from the interpretation, and a generic proxy that routes by name across every endpoint the DI container knows. Part 4 of Service Discovery Without a Service Mesh.
Azure Functions want their key in an x-functions-key header; Logic App workflows want a SAS signature in the query string. How a discovery record's type field became a calling-convention discriminator, and how one small HTTP service hid that difference from every caller in the estate. Part 3 of Service Discovery Without a Service Mesh.
The resolution path of a Key Vault-backed discovery client - three fail-fast environment variables, DefaultAzureCredential with a user-assigned managed identity, a name composed as service-plus-environment, a tolerant JSON parser, and a process-lifetime cache with a bug I shipped and honest trade-offs I chose. Part 2 of Service Discovery Without a Service Mesh.
Dozens of Azure Functions and Logic Apps need each other's URLs and keys, and there is no Kubernetes, no sidecar, no mesh to hand them out. How a small .NET library turned one Key Vault and a naming convention into a working discovery layer - the consumer side of a registry made of secrets. Part 1 of a new series.
The catalog's finale: three child modules fanned out over locals maps turn AAD groups, APIM products and OpenAPI-imported APIs into reviewable code, map keys double as URL routing taxonomy, and policy XML gets environment-templated by a blunt string replace - plus a retrospective on what fifteen modules taught. Part 15 of the Terraform Module Catalog.
The public DNS template exposes every record type - A, AAAA, CAA, CNAME, MX, PTR, SRV, TXT - as an optional object list on a single module, and its twelve-kilobyte README quietly becomes the reference manual. When one module with optional shapes beats fifteen micro-modules, and when it stops being true. Part 13 of the Terraform Module Catalog.
The catalog's cautionary tale: an empty variables.tf, no platform JSON, UPDATE placeholders for every value, one pvars file for four declared workspaces, a subscription ID hardcoded into the provider, and a pipeline with a leftover debug step - what shipping a half-finished golden template does to the two hundred copies made from it, and a checklist for done. Part 14 of the Terraform Module Catalog.
The classic Front Door template does global entry properly - custom domains behind WAF policies, Key Vault TLS, HTTP-to-HTTPS redirect rules - and then teaches by counterexample: a hardcoded ARM resource ID where a lookup map should be, and a missing environment key silently swallowed by a forgiving default. Part 12 of the Terraform Module Catalog.
The catalog's most divergent template - a different module-source depth, extra pipeline-fed variables, a computed cluster name, CMK from a second Key Vault and a renamed provider alias - and what its dated Kubernetes pins say about version governance. Part 10 of the Terraform Module Catalog.
Inside the module with the biggest surface in the catalog: listener, pool, settings and probe objects cross-referenced by name, Key Vault TLS through a user-assigned identity, a private-by-default frontend - and a deliberately invalid placeholder IP that turns an unfilled template into a loud failure. Part 11 of the Terraform Module Catalog.
A search template that ships with "TBD" where partition and replica counts belong - so it cannot apply until someone makes a sizing decision - plus a three-way diagnostics choice documented entirely in commented-out code. Part 9 of the Terraform Module Catalog.
The smallest template in the catalog - a hundred lines of Redis cache config - as a study in what even the simplest secure-PaaS wrapper must still carry, and the one pipeline typo that quietly broke environment isolation. Part 8 of the Terraform Module Catalog.
A Data Factory template whose most important code is not HCL - after apply, an Azure CLI step finds the factory and a PowerShell step PATCHes the ARM resource to enable CMK and disable public network access, because the provider couldn't. Part 7 of the Terraform Module Catalog.
How one Terraform template models an entire Event Hubs estate as nested lookup maps - hubs, capture, boolean-triplet authorization rules and consumer groups - and the type-unification trap hiding in its empty environments. Part 6 of the Terraform Module Catalog.
The catalog's data-tier entry draws an unusually good boundary - the module owns the account and its security posture, raw resources own the data model - and its commented-out option menu doubles as accidental documentation.
The smallest module in the catalog teaches the two biggest lessons: strict lookups that refuse to pass null downstream, and shared plans as standalone stacks that dozens of apps reference by nothing but a name.
The storage catalog entry is really five templates over one base module - blob, file, queue, table and static website - and the least-used wrapper is where every copy-paste defect in the estate went to hide.
Reading the Function App module against its App Service sibling: the shared secure-hosting chassis, the runtime storage account and version knobs that are genuinely new, and what half-populated prod values teach about templates.
Opening the Terraform Module Catalog with the library's flagship: how an App Service module bundles VNet integration, dual managed identities and Key Vault TLS into a surface app teams can fill in but not opt out of.
The honest retrospective that closes the series - how template scaffolding metastasizes mistakes, why version pinning without governance curates a museum, what secrets in locals really cost, and the upgrade list I would run on this estate today. Part 12 of the Terraform on Azure series.
Three manually-run pipelines, one JSON config bag and a TDE certificate wrinkle - how live SQL Server databases moved into Azure SQL Managed Instance with LRS, and why all the project risk compresses into the sixty seconds around cutover. Part 11 of the Terraform on Azure series.
