Azure

• Use az group create and az deployment group create --template-file main.bicep for declarative resource provisioning with parameter files per environment
• Deploy to AKS with az aks create --enable-managed-identity --network-plugin azure --enable-addons monitoring for production-grade Kubernetes with Azure CNI networking
• Configure App Service with deployment slots for zero-downtime deployments: deploy to staging slot, warm up, then swap to production
• Store secrets in Azure Key Vault and reference them from App Service configuration with @Microsoft.KeyVault(SecretUri=...) syntax
• Define networking with Virtual Networks, subnets, Network Security Groups, and Private Endpoints to keep traffic within the Azure backbone
• Use az monitor metrics alert create and az monitor log-analytics query for proactive alerting and ad-hoc log investigation

Common Patterns

• Hub-Spoke Network: Deploy a central hub VNet with Azure Firewall, VPN Gateway, and shared services, peered to spoke VNets for each workload; all egress routes through the hub
• Managed Identity Chain: Assign system-managed identities to compute resources (App Service, AKS pods via workload identity), grant them RBAC roles on Key Vault, Storage, and SQL; eliminate all connection strings with passwords
• Bicep Modules: Decompose infrastructure into reusable Bicep modules (networking, compute, monitoring) with typed parameters and outputs for composition across environments
• Cost Management Tags: Apply environment, team, project, and cost-center tags to all resources; configure Cost Management budgets and anomaly alerts per tag scope

Pitfalls to Avoid

• Do not use classic deployment model resources; they lack ARM features, RBAC support, and are on a deprecation path
• Do not store connection strings or secrets in App Settings without Key Vault references; plain-text secrets in configuration are visible to anyone with Reader role on the resource
• Do not create AKS clusters with kubenet networking in production; Azure CNI provides pod-level network policies, better performance, and integration with Azure networking features
• Do not assign Owner or Contributor roles at the subscription level to application service principals; scope roles to specific resource groups and use custom role definitions