DevOps Training
Azure Track
— Islamabad 2026

Kubernetes on Azure Kubernetes Service — the most in-demand enterprise container platform. Three weeks to cover it properly: the Kubernetes object model, AKS-specific operations, and the GitOps delivery layer.

1. Architecture: API server, etcd, scheduler, controller manager, kubelet, kube-proxy, and container runtime
2. Core workload objects: Pods, ReplicaSets, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs — when each is right
3. Services: ClusterIP, NodePort, LoadBalancer — DNS-based discovery with CoreDNS
4. Ingress: NGINX Ingress Controller and the Azure Application Gateway Ingress Controller (AGIC) — TLS termination and path routing
5. Persistent Volumes: PV, PVC, StorageClass — the Azure Disk CSI driver and Azure Files CSI driver for RWO and RWX storage
6. Namespaces and RBAC: isolating teams, ClusterRoles vs Roles, ServiceAccounts, and binding Azure AD groups to Kubernetes roles
7. Resource requests/limits, LimitRanges, ResourceQuotas, and QoS classes
8. Health checks: liveness, readiness, and startup probes — probes that avoid unnecessary restarts
9. Pod scheduling: node affinity/anti-affinity, taints, tolerations, topology spread constraints, and PodDisruptionBudgets

1. AKS provisioning with Terraform and Bicep: system node pools, user node pools, Spot node pools, and network plugin selection (Azure CNI vs kubenet vs Azure CNI Overlay)
2. AKS authentication: Azure AD integration, Azure AD-backed kubectl, and disabling local accounts for compliance
3. Workload Identity for AKS: the replacement for AAD Pod Identity — federated credentials for Azure RBAC access from Kubernetes ServiceAccounts
4. AKS networking: Azure CNI pod IP assignment, NSG rules for pods, Azure Network Policy, and Calico
5. AKS autoscaling: Cluster Autoscaler and KEDA — scaling nodes and pods based on workload demand
6. Secrets Store CSI Driver with Azure Key Vault: mounting Key Vault secrets directly as Kubernetes volumes
7. AKS add-ons and extensions: AGIC, Container Insights, Secrets Store CSI Driver, and Open Service Mesh
8. AKS observability: Managed Prometheus, Azure Managed Grafana, and Log Analytics for cluster and pod logs
9. AKS cost optimisation: spot node pools, Start/Stop cluster schedules, and AKS Cost Analysis

1. Helm: packaging applications — charts, values files, release management, and Azure-specific Helm charts
2. Kustomize: environment-specific overlays — base + overlays for dev/staging/prod on AKS
3. Flux CD on AKS: the GitOps operator built into AKS as an extension — source, kustomize, helm, and image automation controllers
4. ArgoCD on AKS: Applications, ApplicationSets, App of Apps, and multi-cluster deployments
5. Progressive delivery with Argo Rollouts: canary and blue/green on AKS with Application Insights metric analysis
6. External Secrets Operator with Azure Key Vault: managing secrets safely in a GitOps repository
7. OPA Gatekeeper and Azure Policy for AKS: restricting privileged containers, enforcing resource limits
8. Istio add-on on AKS: mTLS, traffic management, and Kiali for mesh observability

Enterprise Azure environments operate under regulatory frameworks — GDPR, ISO 27001, SOC 2, PCI-DSS. This track covers Azure security tooling, DevSecOps pipeline integration, and compliance automation.

1. Microsoft Defender for Cloud in depth: Secure Score, regulatory compliance (NIST, CIS, PCI-DSS), and Defender plans for VMs, SQL, Storage, Containers, and App Service
2. Microsoft Sentinel: cloud-native SIEM — data connectors (Azure AD, Office 365, Activity), analytics rules, and incident investigation playbooks
3. Azure DDoS Protection: Standard tier — adaptive tuning, attack telemetry, and Azure Monitor integration
4. Azure Bastion: browser-based SSH and RDP to VMs without public IP addresses — eliminating jump boxes
5. Just-in-time VM access: Defender for Cloud JIT — time-limited NSG rules for administrative access
6. Customer-managed keys (CMK): bringing your own keys for Storage, SQL, Cosmos DB, and AKS — key rotation and emergency revocation
7. Azure Active Directory Identity Protection: risk-based Conditional Access — sign-in risk, user risk, and automated remediation
8. Privileged Identity Management (PIM): just-in-time elevation of Azure RBAC roles — approval workflows and access reviews
9. Azure Private Link and Private DNS: end-to-end private connectivity to PaaS services from on-premises and hub-spoke networks

1. Shift-left security: Trivy (containers), Checkov (Bicep/Terraform), Semgrep (SAST), OWASP Dependency-Check, and the Microsoft Security DevOps Azure DevOps extension
2. Microsoft Security DevOps GitHub Action: Credential Scanner, Template Analyzer, and Trivy in GitHub Actions
3. SBOM: generating with Syft and Microsoft SBOM Tool — storing in ACR for audit and vulnerability tracking
4. Container image signing with Notation (CNCF): signing ACR images with Key Vault-backed certificates and verifying with Ratify on AKS
5. SLSA supply chain security on Azure: provenance attestation for container builds in Azure DevOps
6. Azure Policy as code: managing Policy assignments with Terraform and Bicep — the policy-as-code DevOps workflow
7. Compliance frameworks on Azure: ISO 27001, SOC 2, PCI-DSS, and NIST SP 800-53 initiatives — mapping controls to Azure services
8. Incident response on Azure: isolating compromised resources, forensic investigation with Activity Logs and Sentinel, and runbook automation with Azure Automation

Azure's serverless and event-driven services — Functions, Durable Functions, APIM, Event Grid, Service Bus, and Event Hubs — form a complete platform for building event-driven applications without managing servers.

1. Azure Functions deep dive: execution model, cold starts, Flex Consumption plan, Durable Functions orchestration (chaining, fan-out/fan-in, human interaction, eternal orchestration)
2. Azure Functions triggers and bindings: HTTP, Timer, Service Bus, Event Hubs, Blob, Cosmos DB, Queue Storage — the binding-based development model
3. Azure Functions scaling: KEDA-based scaling on Container Apps vs Consumption plan automatic scaling
4. Azure API Management (APIM): the enterprise API gateway — policies (rate limiting, transformation, caching, auth), products, subscriptions, and the developer portal
5. Azure Event Grid: event routing across Azure services — topics, subscriptions, event filtering, and dead-letter queues
6. Azure Service Bus: enterprise messaging — queues, topics, subscriptions, sessions for ordered processing, dead-letter queues
7. Azure Event Hubs: high-throughput event streaming — partitions, consumer groups, capture to Blob, and the Kafka-compatible endpoint
8. Azure Cosmos DB: globally distributed NoSQL — partition key design, consistency levels, change feed for event-driven patterns, serverless capacity
9. Azure Logic Apps: low-code workflow automation — connectors, triggers, actions, and enterprise integration patterns
10. Azure Static Web Apps: hosting SPAs with integrated Functions backends — GitHub Actions and Azure DevOps integration
11. Event-driven architecture patterns: choreography vs orchestration, the outbox pattern, and saga coordination with Durable Functions
12. Serverless observability: Application Insights for Azure Functions — request, dependency, exception tracking, and distributed tracing across Service Bus and Event Grid

Platform Engineering on Azure — building the internal developer platform that enterprise development teams use to self-service environments, deployments, and infrastructure without depending on the central infrastructure team for every change.

1. Platform Engineering principles: golden paths, paved roads, and measuring developer experience with DORA and SPACE metrics
2. Azure Landing Zones: Microsoft's reference architecture — management groups, policy assignments, hub-spoke networking, and the Enterprise-Scale CAF
3. Azure Landing Zone Bicep accelerator: deploying the Microsoft reference landing zone from the ALZ Bicep repository
4. Terraform Azure Landing Zones module: the community and Microsoft-maintained Terraform equivalent — when to choose Terraform over Bicep
5. Azure Deployment Environments: developer self-service environment provisioning backed by Bicep or Terraform templates in Azure DevOps Catalogs
6. Azure Developer CLI (azd): the developer-focused CLI for deploying Azure applications — azd templates, pipelines, and the developer workflow
7. Backstage with Azure: internal developer portal — Azure DevOps plugin, ACR plugin, and Azure resource entity provider for service catalogue integration
8. Bicep advanced patterns: modules registry with ACR, Bicep extensibility providers, and porting ARM templates to Bicep with decompile
9. Terraform advanced patterns for Azure: Azure Verified Modules, provider aliasing for multi-subscription deployments, and AzureRM backend with state encryption
10. Policy as code at enterprise scale: Azure Policy exemptions, remediation tasks, and compliance reports in pipelines
11. Multi-account Azure strategy: AWS Organizations equivalent — Azure Management Groups, SCPs, delegated admin, and Control Tower customisations
12. FinOps on Azure: the FinOps Foundation framework — Inform, Optimise, and Operate phases with Azure Cost Management tooling

Azure is the enterprise home for AI workloads. This track covers the infrastructure engineering required to provision, operate, and secure Azure OpenAI Service, Azure Machine Learning, Databricks, and Synapse in production.

1. Azure OpenAI Service infrastructure: deploying GPT-4o and embedding models — model deployments, capacity planning, PTU (provisioned throughput units) vs standard
2. Azure OpenAI private networking: Private Endpoints, network isolation, and routing enterprise traffic through Azure Firewall
3. Azure AI Studio: hubs, projects, connections, and the compute infrastructure behind model deployments
4. Azure AI Search: provisioning the enterprise vector search service — indexes, indexers, skillsets, and semantic ranking
5. Azure Machine Learning workspace: compute clusters, compute instances, datastores, environments, and MLflow tracking integration
6. AML compute targets: CPU and GPU compute clusters — NC-series and ND-series VMs, autoscaling, and low-priority (spot) nodes
7. AML pipelines and components: building reusable ML pipeline steps as Docker containers — the infrastructure side of MLOps
8. Model deployment infrastructure: AML Online Endpoints and Batch Endpoints — blue/green model deployments with traffic mirroring
9. Azure Data Factory: managed ETL — pipelines, datasets, linked services, and integration runtimes for on-premises data
10. Azure Synapse Analytics infrastructure: Spark pools, SQL pools, integration runtimes, and workspace networking with Managed VNet
11. Azure Databricks infrastructure: workspace provisioning with Terraform, Unity Catalog, instance pools, and cluster policies for cost control
12. Data platform security: Azure Purview data governance, row-level security in Synapse, and Unity Catalog fine-grained access control
13. MLOps CI/CD: deploying AML pipelines and model endpoints from Azure DevOps Pipelines

SRE principles applied to Azure — defining SLOs backed by Application Insights data, automating toil with Azure Automation, building chaos experiments with Azure Chaos Studio, and operating production Azure at enterprise scale.

1. Azure Monitor Logs in depth: workspace design (centralised vs decentralised), data collection rules (DCR), table retention tiers, and cost management
2. KQL mastery: advanced patterns — time series analysis, series_decompose_anomalies(), machine learning functions, and exporting to Power BI
3. Azure Managed Grafana: managed Grafana with Azure Monitor, Prometheus, and Log Analytics data sources — operational dashboards without managing Grafana infrastructure
4. Azure Monitor Managed Service for Prometheus: scraping AKS metrics into a managed Prometheus-compatible store — PromQL and Grafana integration
5. OpenTelemetry Collector on Azure: deploying as a DaemonSet on AKS or as a Container App — telemetry pipelines to Azure Monitor and Prometheus
6. Application Insights in depth: custom events, custom metrics, availability tests (URL ping, multi-step), user flow analysis
7. Azure Monitor Workbooks: interactive, parameterised reports — SLO dashboards and incident review workbooks
8. Azure Monitor alerts at scale: alert processing rules for maintenance windows, programmatic alert management with Terraform

1. SLIs, SLOs, and error budgets on Azure: defining SLIs from Application Insights data — building SLO dashboards with KQL and Azure Monitor Workbooks
2. Multi-window multi-burn-rate alerting: the Google SRE alerting approach with Azure Monitor metric alerts
3. Azure Chaos Studio: managed chaos engineering — fault library (VM shutdown, AKS pod delete, network latency, Service Bus outage), experiment design, and safety guards
4. Resilience testing: validating Container Apps scale-out, AKS node pool failover, Azure SQL failover group switchover under chaos
5. Azure Automation: runbooks (PowerShell/Python), update management for VMs, and automated remediation triggered by Azure Monitor alerts
6. Azure Logic Apps for incident management: automated response — alerting PagerDuty, creating Azure DevOps work items, and Teams notifications
7. Toil reduction on Azure: automating repetitive operations with Azure Functions, Logic Apps, and Event Grid-triggered automation
8. Blameless post-mortems: Azure incident timeline reconstruction using Activity Logs, Application Insights, and Sentinel — action items in Azure DevOps Boards
9. Azure Service Health: configuring alerts for regional outages, planned maintenance, and health advisories — embedding in SRE dashboards