Deployment infrastructure is everything that must exist for a build to become a running service: compute, network, identity, data stores, DNS, TLS. If it is not in code (or a documented exception), it will drift.
Layers
- Identity and secrets: managed identities, vaults. No long-lived keys in pipelines if the platform can issue short-lived ones.
- Network: private data plane, public edge, TLS termination, allow-lists. Do not confuse “VNet” with security by itself.
- Compute: VMs, App Service, containers, functions. Pick one default per workload class.
- Data: backups, restore tested, migration path. A disk is not a backup.
- Observability: logs and metrics leave the box. See metrics.
IaC
Bicep, Terraform, Pulumi, or cloud-native stacks — the tool matters less than: reviewable diffs, a state store you trust, and no click-ops in prod. Bootstrap the state backend once; do not chicken-egg it every time.
Example
The app uses a managed identity to read secrets from the vault. The pipeline identity can deploy this app and cannot read the whole subscription.
What breaks it
The connection string, password included, is in the pipeline file in git.
variables:
ConnectionStrings__Db: Server=prod.example;User Id=app;Password=stored-in-gitPitfalls
- Prod only exists as a VM someone named
web1in 2019. - Staging is a quarter the size and a different SKU, then you are surprised.
- Shared “dev” database for all pipelines.
Local stand-ins: local Kubernetes. Principles: deployment principles.