One workload (webplat), deployed by Bicep and
Kustomize, entirely through GitHub Actions using OIDC — no long-lived
Azure credentials anywhere in the pipeline.
A dedicated VNet with three subnets: snet-aks for nodes and
pods (no direct inbound from the Internet), snet-appgw for
the Application Gateway (443/80 from the Internet, plus the port range
Azure's own health probes need), and snet-pe for private
endpoints into ACR and Key Vault. Nothing reaches the cluster except
through the Gateway.
The Application Gateway Ingress Controller (AGIC) watches this app's
Kubernetes Ingress object and reconfigures the Application
Gateway automatically — no manual listener or routing-rule changes.
TLS terminates at the Gateway using a certificate issued by
Let's Encrypt via cert-manager, which
proves domain ownership with an automated ACME HTTP-01 challenge and
renews the certificate before it expires — the same mechanism browsers
trust for any public HTTPS site.
Every push builds and pushes a container image to ACR, tagged with the
commit SHA, then applies the Kubernetes manifests to the cluster via
az aks command invoke — the only way a GitHub-hosted runner
(no VNet line-of-sight) can reach a cluster with no public API server,
without a VPN, self-hosted runner, or Bastion host.