Technology Geek

Batch processing is the wrong tool when you need to react to data as it arrives. A fraud detection system that processes transactions in hourly batches is not a fraud detection system. An analytics dashboard that updates once a day is not analytics. A recommendation engine that learns from user behavior on a 24-hour delay is already behind.

Kinesis Data Streams give...

Most AKS clusters I get called in to review were created with defaults and grown by accident. One node pool running everything, no availability zones, kubenet networking chosen years ago for reasons nobody remembers, and an upgrade story that amounts to hoping. Designing the cluster properly up front costs one afternoon. This is what that afternoon should produce.

A load balancer distributes traffic across instances in a single region. When that region has an outage, the load balancer goes down with it. DNS Traffic Management sits above the load balancer layer and distributes traffic across regions, data centers, or endpoints based on health, geography, or weight. It is the difference between a system that survives a regional failure a...

Standing up Azure Firewall is easy. Running it well is a different story. The difference shows up in three places: whether your rule base is structured or a flat pile of exceptions, whether you actually inspect encrypted traffic, and whether IDPS is tuned or just generating noise nobody reads. This post covers all three based on production deployments.

Every Azure PaaS service ships with a public endpoint by default. Your storage account, your SQL database, your Key Vault, all reachable from the internet with nothing but a firewall rule between your data and the world. For most enterprises that is unacceptable, and the answer is Private Link. It sounds simple: give the PaaS service a private IP inside your VNet. In practice...