deploy/azure: README truth pass (follow-up to #139) #141

Merged

trevato merged 1 commit from docs/azure-readme-truth into main

2026-08-19 16:08:12 +00:00

trevato commented

2026-08-19 16:07:11 +00:00

Owner

Fresh-context review of the Azure guide shipped in #139, fixed in one pass. Docs only (plus two @description/comment strings); main.bicep still compiles with 0 errors and the ARM is unchanged apart from the parameter description.

Truth fixes

domain is always required — auto is the vms-mode alternative, not "optional" (the prerequisites contradicted the parameter table).
Cost: Standard_B4ms is ~$121/mo ($0.166/h) vs D4as_v7 ~$133/mo ($0.182/h) — not "≈ half" — and its ~0.9-core sustained CPU is below the platform's measured idle load (1.5–1.8 cores), so it throttles. Now says "tests only" in deploy/azure/README.md, deploy/README.md, the vmSize @description, and main.bicepparam.example. Prices sourced to aks-cost-experiment.md (2026-08-18).
Key Vault / mitosis-flux-sops identity marked reserved, not wired at germination.
Unsourced "≈ 2 minutes" for the image mirror → "a few minutes".
Quota wording no longer claims exactly which families a new subscription gets.

Reader-readiness

aks prerequisites: Owner / User Access Administrator on the RG (the template creates role assignments); a clone of this repo; app-registration rights for the optional Entra step.
vms: NOTE on the self-signed CA (browser warning; trust the CA or Cloudflare proxy + SSL "Full").
Glossary: build crew, HA, platform card (incl. that the aks card is printed, not saved), kubeconfig, sops/age ≡ sovereign key.
"What is different" / "Known limits" marked operator-level.
Outputs row caption fixed; table alignment.

🤖 Generated with Claude Code

Fresh-context review of the Azure guide shipped in #139, fixed in one pass. Docs only (plus two `@description`/comment strings); `main.bicep` still compiles with 0 errors and the ARM is unchanged apart from the parameter description. **Truth fixes** - `domain` is always required — `auto` is the `vms`-mode alternative, not "optional" (the prerequisites contradicted the parameter table). - Cost: `Standard_B4ms` is ~$121/mo ($0.166/h) vs `D4as_v7` ~$133/mo ($0.182/h) — **not** "≈ half" — and its ~0.9-core sustained CPU is below the platform's measured idle load (1.5–1.8 cores), so it throttles. Now says "tests only" in `deploy/azure/README.md`, `deploy/README.md`, the `vmSize` `@description`, and `main.bicepparam.example`. Prices sourced to `aks-cost-experiment.md` (2026-08-18). - Key Vault / `mitosis-flux-sops` identity marked *reserved, not wired at germination*. - Unsourced "≈ 2 minutes" for the image mirror → "a few minutes". - Quota wording no longer claims exactly which families a new subscription gets. **Reader-readiness** - `aks` prerequisites: Owner / User Access Administrator on the RG (the template creates role assignments); a clone of this repo; app-registration rights for the optional Entra step. - `vms`: NOTE on the self-signed CA (browser warning; trust the CA or Cloudflare proxy + SSL "Full"). - Glossary: build crew, HA, platform card (incl. that the `aks` card is printed, not saved), kubeconfig, sops/age ≡ sovereign key. - "What is different" / "Known limits" marked operator-level. - Outputs row caption fixed; table alignment. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

trevato added 1 commit

2026-08-19 16:07:11 +00:00

deploy/azure: README truth pass — fix domain/optional contradiction, B4ms cost, permissions, missing steps

guard-ppt / no-ppt (push) Successful in 15s

Details

guard-ppt / no-ppt (pull_request) Successful in 15s

Details

6b3d3bdeb2

From a fresh-context review of the shipped guide:
- `domain` is always required; `auto` is the vms-mode alternative (was "optional")
- aks needs Owner/User Access Administrator (role assignments) + a repo clone
- vms: NOTE on the self-signed CA / Cloudflare Full; glossary gains build crew,
  HA, platform card, kubeconfig, sops/age
- Cost: B4ms is ~$121/mo vs D4as_v7 ~$133 (not "half") and throttles under
  the platform's idle load — tests only; same truth in deploy/README.md,
  main.bicep @description, bicepparam example
- Key Vault / flux-sops identity marked reserved (not wired at germination)
- outputs row, unsourced "2 minutes", operator-only section marker

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

trevato merged commit 50a23f90b8 into main

2026-08-19 16:08:12 +00:00

trevato referenced this pull request from a commit

2026-08-19 16:08:12 +00:00

deploy/azure: README truth pass (follow-up to #139) (#141)