FPT SoftwareFHNCertificationsReference architectures
Talk to NGT
Microsoft Azure · 02 of 4

Architecture

A private AKS cluster, machine learning in six steps, what changes after lift and shift, and gated Terraform changes.

Private AKS with Hub Firewall and Bastion
01

A private AKS cluster behind the hub firewall

No public address on the cluster: Azure Firewall controls traffic in and out, admins come through Bastion.

Private AKS with Hub Firewall and Bastion
public IPDNATegress via UDRHTTPSSSHVNet linkslogsMicrosoft AzureHub virtual networkSpoke virtual network · private AKSPaaS over Private LinkPlatform adminsInternet usersallow-listed networksAzure FirewallDNAT and egress rulesAzure Bastionbrowser SSH, RDPInternal loadbalancerPrivate AKS clustersystem and user poolsPrivate endpointsAPI server, PaaSJumpbox VMkubectl, admin toolsAzure Key VaultAzure Blob StorageContainer RegistryPrivate DNS zonesblob, vault, ACR, AKSLog Analyticsfirewall, AKS logsMicrosoft Sentinel

Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.

Point at a component to see what it does; select it for the best practice.Open the architecture
02

Applying Azure Machine Learning in six steps

1 of 6

Identify objectives

The business decision the model should improve, and how to measure it.

03

Lift and shift, then optimise

Moving is step one; Azure's shared responsibility then takes layers off the team.

On premises: your team runs every layer On Azure: the platform takes layers over
Hardware and networkBought, racked and refreshed by your teamRun by Azure; virtual networks defined as code
OS and middlewarePatched by hand in change windowsUpdate Manager on VMs; patched by Azure on PaaS
ScalingCapacity bought for the peakAutoscale with demand
Backup and continuityTapes and a second siteAzure Backup and Site Recovery policies
MonitoringA different tool per teamAzure Monitor and Log Analytics everywhere
FeesLicences, hardware and operationsSubscription and operation fees, optimised over time
04

An approval gate and a cost estimate on every Terraform change

Automation keeps deploying; people approve, and the cost is known before anything is created.

  • Manual approvalAzure DevOps Environments with named approvers per environment.
  • Every approval auditedWho approved what and when, traced in Azure Monitor Logs.
  • Cost before creationAn Infracost estimate on every Terraform plan.
  • Automation keptTerraform still deploys; people only approve.
Approval-Gated Terraform with Cost Estimates
commitplan + costsign-offapplycreate, destroystateauditmetricsAzure Pipelines · IaC pipelineMicrosoft AzureMain environment · resource groupLoad-test resource group · temporaryCost visibilityApproversper environmentTerraform codemodules per environmentAzure Repospull requestCode reviewlint, policy checksterraform plansaved plan fileInfracostcost of the planManual approvalAzure DevOps environmentterraform applythe approved planLog Analyticsapproval and run auditTerraform stateBlob Storage, lockedVM scale setsautoscaleAKSautoscaleAzure Load Testingsimulated trafficSpot VMstemporary test computeTest dataStandard storageResource tagsenv, project, phaseBudgetsalerts to ownersCost Managementcost per resource groupAzure AdvisorrightsizingAzure Monitortest metrics

Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.

Point at a component to see what it does; select it for the best practice.Open the architecture
SourcesNGT Azure Service Offering v1.0 (Dec 2024)NGT Service Offering v2.0 (Mar 2025)FPT Software Hanoi certification register (Nov 2024; 2025 records)NGT engineer profiles, a sample of 38 (Nov 2024 – Mar 2026)Microsoft Cloud Adoption Framework for AzureAzure Well-Architected Framework