Master Microsoft Azure with the Interactive Editor

Cloud concepts, the portal, CLI, ARM/Bicep, RBAC, cost, policy, tags.

• Step 1

  Azure 1: Cloud Concepts & Azure Portal

  Microsoft Azure is one of the three major cloud platforms. Understanding cloud computing models (Iaa...

  Start Lesson
• Step 2

  Azure 2: Resource Groups & Subscriptions

  Everything in Azure lives inside a hierarchy: Management Groups > Subscriptions > Resource Groups > ...

  Start Lesson
• Step 3

  Azure 3: Azure CLI Essentials

  The Azure CLI (`az`) is the primary command-line tool for managing Azure resources. Learning it is e...

  Start Lesson
• Step 4

  Azure 4: ARM Templates & Bicep

  Infrastructure as Code (IaC) is how you define Azure resources declaratively. ARM templates use JSON...

  Start Lesson
• Step 5

  Azure 5: Role-Based Access Control (RBAC)

  Azure RBAC controls who can do what on which resources. It uses role assignments that combine a prin...

  Start Lesson
• Step 6

  Azure 6: Cost Management & Budgets

  Azure costs can spiral quickly without monitoring. Cost Management + Billing helps you analyze spend...

  Start Lesson
• Step 7

  Azure 7: Azure Policy & Governance

  Azure Policy enforces organizational standards and assesses compliance at scale. Policies can audit,...

  Start Lesson
• Step 8

  Azure 8: Tags & Resource Organization

  Tags are key-value pairs attached to Azure resources for organization, cost tracking, automation, an...

  Start Lesson

VMs, App Service, Functions, Container Instances, AKS, Logic Apps.

• Step 9

  Azure 9: Virtual Machines

  Azure VMs are the core IaaS compute offering. Full control over OS, runtime, and configuration....

  Start Lesson
• Step 10

  Azure 10: Azure App Service

  App Service is Azure's PaaS for hosting web apps, REST APIs, and mobile backends. Deploy code or con...

  Start Lesson
• Step 11

  Azure 11: Azure Functions (Serverless)

  Azure Functions is the serverless compute service. Write code that runs in response to events and pa...

  Start Lesson
• Step 12

  Azure 12: Container Instances

  Azure Container Instances (ACI) is the fastest way to run containers in Azure. No VM management, no ...

  Start Lesson
• Step 13

  Azure 13: Azure Kubernetes Service (AKS)

  AKS is Azure's managed Kubernetes. Azure manages the control plane; you manage worker nodes....

  Start Lesson
• Step 14

  Azure 14: Logic Apps & Workflow Automation

  Logic Apps is a low-code platform for building automated workflows that integrate services and data....

  Start Lesson

Blob, Table/Queue, Cosmos DB, SQL Database, Cache for Redis.

• Step 15

  Azure 15: Blob Storage

  Azure Blob Storage is massively scalable object storage for unstructured data — images, videos, logs...

  Start Lesson
• Step 16

  Azure 16: Table Storage & Queue Storage

  Table Storage is a NoSQL key-value store. Queue Storage provides reliable messaging between componen...

  Start Lesson
• Step 17

  Azure 17: Azure Cosmos DB

  Cosmos DB is Azure's globally distributed, multi-model NoSQL database with single-digit ms reads and...

  Start Lesson
• Step 18

  Azure 18: Azure SQL Database

  Azure SQL Database is a fully managed relational database engine based on SQL Server with auto-patch...

  Start Lesson
• Step 19

  Azure 19: Azure Cache for Redis

  Azure Cache for Redis provides an in-memory data store for caching, session management, and real-tim...

  Start Lesson

VNets, NSGs, Load Balancer, App Gateway, DNS, custom domains.

• Step 20

  Azure 20: Virtual Networks & Subnets

  Azure VNet is the foundation of Azure networking — isolation, segmentation, and connectivity for clo...

  Start Lesson
• Step 21

  Azure 21: Network Security Groups (NSGs)

  NSGs are Azure's built-in firewall for filtering traffic based on IP, port, and protocol....

  Start Lesson
• Step 22

  Azure 22: Load Balancer & Application Gateway

  Azure Load Balancer (Layer 4) and Application Gateway (Layer 7 with WAF) distribute traffic across b...

  Start Lesson
• Step 23

  Azure 23: Azure DNS & Custom Domains

  Azure DNS hosts your DNS zones on Azure's global anycast network for both public and private resolut...

  Start Lesson

Azure Pipelines, GitHub Actions, Terraform, ACR.

• Step 24

  Azure 24: Azure DevOps Pipelines

  Azure DevOps Pipelines provides CI/CD with YAML-based pipelines that live in your repo....

  Start Lesson
• Step 25

  Azure 25: GitHub Actions for Azure

  GitHub Actions integrates natively with Azure using official actions for login, deployment, and reso...

  Start Lesson
• Step 26

  Azure 26: Terraform on Azure

  Terraform is a multi-cloud IaC tool. The AzureRM provider lets you manage Azure resources with HCL....

  Start Lesson
• Step 27

  Azure 27: Azure Container Registry (ACR)

  ACR is a managed Docker registry integrated with AKS, App Service, and Azure DevOps....

  Start Lesson

Key Vault, Azure Monitor, Application Insights.

• Step 28

  Azure 28: Azure Key Vault

  Key Vault centralizes secrets, encryption keys, and certificates. Never store secrets in code....

  Start Lesson
• Step 29

  Azure 29: Azure Monitor & Application Insights

  Azure Monitor is the unified monitoring platform. App Insights adds APM with request tracking and an...

  Start Lesson
• Step 30

  Azure 30: Cloud Architecture - Putting It All Together

  Final lesson! Combine everything to architect a complete solution using the Azure Well-Architected F...

  Start Lesson

Entra ID for SPA & Spring, Service Bus, Artifacts, Helm, Key Vault at scale.

• Step 31

  Azure 31: Entra ID & MSAL.js — SPA Authentication

  Microsoft Entra ID (formerly Azure AD) is Azure's identity platform. MSAL.js lets Single-Page Apps s...

  Start Lesson
• Step 32

  Azure 32: Entra ID + Spring Boot — Resource Server

  A resource server accepts a JWT access token and validates it before serving data. Spring Boot apps ...

  Start Lesson
• Step 33

  Azure 33: Service Bus — Topics, Queues & Dead-Letter

  Azure Service Bus is the enterprise messaging broker — **queues** for 1-to-1 work distribution, **to...

  Start Lesson
• Step 34

  Azure 34: Azure Artifacts — Private Package Feeds

  Azure Artifacts hosts private Maven, npm, NuGet, and Python package feeds inside Azure DevOps. Feeds...

  Start Lesson
• Step 35

  Azure 35: Helm on AKS — Values Overlays

  Helm is the package manager for Kubernetes. A **chart** is a templated bundle of manifests + a `valu...

  Start Lesson
• Step 36

  Azure 36: Key Vault Integration at Scale — Pipeline, CSI, App Service

  A Key Vault full of secrets is only useful if your workloads can read them safely. In practice there...

  Start Lesson

The full real-world stack: pipeline-templates, VMSS agents, Service Bus, AKS multi-cluster, Istio + Argo Rollouts, terraform-common, Datadog APM, end-to-end deploy.

• Step 37

  Azure 37: YAML Pipeline Templates — the `extends` + `parameters` pattern

  Lythia has ~35 service repos. Each repo's `pipelines/{env}.yml` is tiny — 30-50 lines — because all ...

  Start Lesson
• Step 38

  Azure 38: Variable Groups & Service Connections — the secret backbone

  Pipeline YAML is public in git. The credentials it uses to talk to Azure (ARM SPN, AKS kubeconfig, A...

  Start Lesson
• Step 39

  Azure 39: GitVersion → image tag → chart version

  Every artifact Lythia ships — a Docker image, a Helm chart, an npm package, a Maven JAR — needs the ...

  Start Lesson
• Step 40

  Azure 40: Multi-Registry Docker Build & Push — the loop pattern

  Lythia runs one ACR per environment: `drivewaydevcontainerregistry.azurecr.io`, `drivewaytestcontain...

  Start Lesson
• Step 41

  Azure 41: Self-Hosted ADO Build Agents on VMSS — pipeline-agents

  Microsoft-hosted ADO agents are fine for small projects, but Lythia builds JVMs with private Gradle ...

  Start Lesson
• Step 42

  Azure 42: Service Bus Topics with terraform-common Publisher/Subscriber

  Lythia's microservices talk asynchronously through **Azure Service Bus topics**: `availability`, `ec...

  Start Lesson
• Step 43

  Azure 43: AKS Multi-Cluster Topology — apps + elasticsearch

  Lythia runs **two** AKS clusters per environment: `AKS-apps-k8s-{env}` for the customer-facing micro...

  Start Lesson
• Step 44

  Azure 44: Helm Universal Charts — api | headless | cron | frontend

  Instead of every service maintaining its own chart, Lythia ships **four** charts in `platform-univer...

  Start Lesson
• Step 45

  Azure 45: Istio VirtualService + DestinationRule for canary

  Istio is the data plane that turns AKS into a real service mesh: mTLS between every pod, weighted tr...

  Start Lesson
• Step 46

  Azure 46: Argo Rollouts canary steps + Analysis

  Argo Rollouts is the controller that orchestrates Lythia's canary releases. The `api` universal char...

  Start Lesson
• Step 47

  Azure 47: Environment Rollout Strategies — dev=direct, uat=optional canary, prod=canary+promote

  Different environments need different release safety. Lythia's `mesh.canary.requiresApproval` value ...

  Start Lesson
• Step 48

  Azure 48: Per-Service Key Vault naming — `{service}-{abbrev}-kv-{env}`

  Lythia provisions a Key Vault **per service per environment**, not one giant vault per env. The nami...

  Start Lesson
• Step 49

  Azure 49: PostgreSQL Flexible Server per-service + Liquibase auxiliary images

  Most Lythia services own their own **Azure Database for PostgreSQL Flexible Server** instance. The h...

  Start Lesson
• Step 50

  Azure 50: Azure Artifacts npm feed — `@driveway/react` (Lib)

  Lythia's shared React component library lives at `Lib/` and is published as `@driveway/react` to a *...

  Start Lesson
• Step 51

  Azure 51: Azure Artifacts Maven/Gradle — `ado_artifacts_token` for backend libs

  Lythia's Java/Kotlin services publish shared libraries to a Maven feed in Azure Artifacts. The `Dock...

  Start Lesson
• Step 52

  Azure 52: AzureKeyVault@2 chained with Helm `--set secrets`

  The final piece of Lythia's secret-flow puzzle: how a value in Key Vault becomes an environment vari...

  Start Lesson
• Step 53

  Azure 53: Terraform plan/apply with exit-code-2 gating

  `pipeline-templates/cd/stages/terraform-deploy.yaml` is Lythia's IaC entry point. It runs `terraform...

  Start Lesson
• Step 54

  Azure 54: createprodcr — ADO Change Request work items for prod

  Prod deploys at Lythia require a **Change Request** (CR) work item in Azure Boards before the apply ...

  Start Lesson
• Step 55

  Azure 55: Front Door + APIM + AKS Ingress — north-south traffic path

  A customer request reaching `cart-api` traverses: **Azure Front Door** (global TLS termination, WAF,...

  Start Lesson
• Step 56

  Azure 56: End-to-end deploy — from `git push v1.5.0` to canary promote in prod

  Time to wire everything together. A merge to `cart-service/main` with `+semver: minor` and a `v1.5.0...

  Start Lesson
• Step 57

  Azure 57: Datadog APM wired through the universal chart

  Every Lythia backend service ships with **Datadog APM** baked in: a `dd-java-agent.jar` copied into ...

  Start Lesson
• Step 58

  Azure 58: AAD App Registrations via terraform-common

  Every Lythia API that authenticates with Entra ID needs an **AAD App Registration**: a service princ...

  Start Lesson
• Step 59

  Azure 59: Standardized resource tagging — `terraform-common/azure/tags`

  Lythia has thousands of Azure resources across 5 environments. Without standardised tagging, asking ...

  Start Lesson
• Step 60

  Azure 60: Multi-Component Services — `services[]` + `auxiliaryImages[]`

  Many Lythia services are not a single container. `offer-api` ships an `api` (REST endpoint), an `off...

  Start Lesson

Health probes, SLOs & error budgets, distributed tracing, structured logging, retries/timeouts/circuit breakers, multi-region failover, and a chaos-engineering capstone.

• Step 61

  Azure 61: Health Probes — Liveness, Readiness & Startup

  Resilience starts with honesty: a pod must tell the platform when it's alive, when it's ready for tr...

  Start Lesson
• Step 62

  Azure 62: SLOs, SLIs & Error Budgets

  You can't prioritize reliability without a number. SLIs measure, SLOs target, and the error budget t...

  Start Lesson
• Step 63

  Azure 63: Distributed Tracing with OpenTelemetry

  When a request crosses five services, a single stack trace is useless. Distributed tracing stitches ...

  Start Lesson
• Step 64

  Azure 64: Structured Logging & Dashboards

  A log line is only useful if a machine can query it. Structured logs — JSON with consistent fields —...

  Start Lesson
• Step 65

  Azure 65: Retries, Timeouts & Circuit Breakers

  A flaky dependency shouldn't take you down with it. Timeouts bound the wait, retries paper over blip...

  Start Lesson
• Step 66

  Azure 66: Multi-Region Failover & Traffic Manager

  A single region is a single point of failure. Health-based global routing sends users to a healthy r...

  Start Lesson
• Step 67

  Azure 67: Capstone — Chaos Engineering & a Resilience Scorecard

  Chaos engineering is the discipline of breaking things on purpose, in controlled experiments, to fin...

  Start Lesson

Author reusable Terraform modules, loop resources with for_each & dynamic blocks, and template Helm charts from values — then drill the commands in the Command Lab.

• Step 68

  Azure 68: Terraform Module Authoring

  A reusable Terraform module is a folder with variables.tf (inputs), main.tf (resources), and outputs...

  Start Lesson
• Step 69

  Azure 69: Terraform for_each & dynamic blocks

  for_each creates one resource per element of a map/set, keyed stably. dynamic blocks generate repeat...

  Start Lesson
• Step 70

  Azure 70: Helm Chart Templating

  A Helm template renders Kubernetes manifests by interpolating values. Change values.yaml and the sam...

  Start Lesson