Latest

Push and pull both deploy to Kubernetes, but they flip the direction of trust. Pull moves cluster credentials out of CI, makes drift visible, and turns Git into the cluster audit log. Here is the difference, what actually changes, and what pull does not solve.

Azure networking is nested — VNet, subnet, NIC, NSG, each with one job. Here is the mental model that finally clicked for me, plus the one peering gotcha that bites everyone the first time.

Workload Identity replaces shared client secrets with per-pod OIDC tokens. Here is the mental model that finally clicked for me, plus the four pieces you need to wire it up on AKS.

Four names that look like four different things. Really, they are two real objects and two portal views. Here is the short version — what each one actually is, and which one to use in which situation.

Workload Identity gives every pod its own Azure identity. So why are we still passing connection strings around? Here is how I dropped them for SQL, Storage, and Service Bus — using DefaultAzureCredential and a single pattern.