Introduction In this series, I will take you through building an on-premises / Azure hybrid environment, with the on-premises network running entirely on a single machine. We will set up an on-premises Active Directory forest, create OUs and users, deploy domain controllers, join Windows and Linux VMs to the domain, and establish hybrid connectivity to Azure using an S2S VPN tunnel. I want to clarify right at the outset that on-premises identity is not a mandatory starting point for a hybrid cloud environment. But I have chosen to build it from the ground up starting with the identity plane (on-premises Active Directory) . ...

Photo by Tom Frances Palattao on Unsplash Photo by Tom Frances Palattao on Unsplash I have always wondered if we truly understand what the other person is communicating. When I say, “it tastes so good,” “it is the best,” or “it is unbearable” — does the other person truly understand? Is my “unbearable” the same as the other person’s “unbearable”? The Need The need to “feel” understood is one of the primitive needs for humans — to be seen. To have one’s existence witnessed. ...

This guide outlines the process for assigning application roles to a Managed Identity (MI) in Entra ID. It covers observed behaviors, inherent limitations, and the necessary steps required when an MI must authenticate with another application (such as an API in APIM) using role-based access control (RBAC). Scenario In a typical architecture, a Logic App utilizes a Managed Identity (either System-Assigned or User-Assigned) to communicate with downstream resources. When that Logic App needs to call an API exposed via APIM, the following requirements usually apply: ...

Symptom Calling Azure Table Storage REST API returns: 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. Even though Authorization header looks valid Root Cause The request is missing x-ms-version header Azure Storage requires this header to determine the API version used for request validation. Without it, the service may reject the request with a misleading authentication error. Fix Add header ...

Accessing Azure App Configuration using Managed Identity in Azure Functions is slightly different from accessing other Azure services. For most Azure services (Storage, Service Bus, Key Vault), you typically: Enable Managed Identity on the Function Grant RBAC access to the resource Create the SDK client using DefaultAzureCredential However, App Configuration is usually loaded as part of the application configuration pipeline at startup, so it must be added via the host builder. ...

Coding with Integrity The real measure of a software engineer is simple — how you code when no one is watching. We often associate strong engineering with technical brilliance — mastering languages, designing scalable systems, or solving complex problems. But beyond skill, the most valuable attribute a software engineer can bring to the table is integrity. “Coding with Integrity, is how you code when you know that no one is going to review your code” ...

When using Terraform to import an OpenAPI/Swagger definition into Azure API Management (APIM), the API and its operations are created successfully. However, one subtle behavior can cause confusion when trying to manage operation-level policies declaratively. This post explains the issue and a simple workaround. The Scenario I was importing my API using Terraform: Swagger/OpenAPI definition imported into APIM API created successfully All operations appeared correctly in Azure Later, I wanted to attach operation-level policies using Terraform using azurerm_api_management_api_operation_policy ...

Here’s a ready-to-run “one-shot” demo workflow for Minikube that sets up a webserver deployment, exposes it, configures HPA, and generates load so you can see autoscaling in action immediately. You can copy-paste these commands one after the other in your terminal. Step 0: (Optional) Clean up old resources kubectl delete deployment webserver --ignore-not-found kubectl delete svc webserver --ignore-not-found kubectl delete hpa webserver --ignore-not-found kubectl delete pod load\-generator --ignore-not-found Step 1: Create the webserver deployment kubectl create deployment webserver --image=gcr.io/google_containers/echoserver:1.10 Step 2: Expose the deployment as a NodePort service kubectl expose deployment webserver --type=NodePort --port=8080 Check service: ...

When you want to use a model but don’t want to keep initializing it with a specific persona, temperature, and other attributes, you can use the .modelfile Customization Approach. Step 1: Create a .modelfile as shown below (sys_admin.modelfile) # 1. THE BASE (Required) FROM llama3 # 2. BRAIN PHYSICS (Parameters) PARAMETER temperature 0.7 # Creativity (0.0 to 1.0+) PARAMETER num_ctx 4096 # How many "tokens" of memory it has PARAMETER top_k 40 # Limits the "vocabulary" pool for each word PARAMETER top_p 0.9 # Probability threshold for word choice PARAMETER repeat_penalty 1.1 # Prevents the AI from getting stuck in a loop PARAMETER stop "User:" # Tells the AI exactly when to stop talking PARAMETER stop "---" # 3. THE TEMPLATE (The "Skeleton" of a conversation) # This defines how the model sees the Turn-taking between User and AI. TEMPLATE """{{ if .System }}<|start_header_id|>system<|end_header_id|> {{ .System }}<|eot_id|>{{ end }}{{ if .Prompt }}<|start_header_id|>user<|end_header_id|> {{ .Prompt }}<|eot_id|>{{ end }}<|start_header_id|>assistant<|end_header_id|> {{ .Response }}<|eot_id|>""" # 4. (System Instructions) SYSTEM """ You are a specialized Azure Networking Assistant and System Administrator with plenty of experience. You provide CLI commands for Linux Mint and PowerShell for Windows. Constraints: 1. If a config is insecure, call it out immediately. """ # 5. PRE-LOADING (The "Conversation Starter") # You can bake in a "fake" memory so the model thinks it's already talking to you. # [OPTIONAL] ADAPTER ~/models/my-adapter # (for actual fine-tuned weights) MESSAGE user "Check the S2S status." MESSAGE assistant "checking the IPsec tunnels now. One moment." Step 2: Create an overlay on top of existing model Once the .modelfile is ready, pick one of you exisiting models and create a new overlay like so - ...

Before you start reading, I want to clarify that this is not a technical article on the Mark and Sweep Algorithm. This is a story about weapon possed by a great warrior called Barbarika. Barbarika was grandson of Gadothgaja (Bheema’s son). He possessed a very powerful weapon — a bow and quiver with 3 arrows. The speciality of the weapon is that with just those 3 arrows he can vanquish the enemies and win any war. ...