Roadmap And Backlog

Roadmap And Backlog

This page tracks practical improvements for making the lab more secure, reliable, cost-aware, and production-aligned.

Current Priority

The current baseline is documented from the hardening branch:

• codex/landing-zone-safe-hardening
• PR 1

The active project boards are documented in GitHub Projects And Roadmap Operating Model:

Board	Link
Master Roadmap	Project 1
Secure Foundation	Project 2
CI/CD Validation	Project 3
Observability Operations	Project 4
Workload Scenarios	Project 5

Completed In The Current Baseline

Area	Improvement
RDP safety	Public RDP from 0.0.0.0/0 blocked unless explicit override is set
Workload exposure	Public Load Balancer RDP NAT rules disabled by default
Shared services	Key Vault, SQL, and Storage moved toward private-first defaults
CI authentication	GitHub Actions uses Azure OIDC instead of long-lived AZURE_CREDENTIALS
CI gates	tfsec, Checkov, Gitleaks, and OPA are enforced
Monitoring	Post-deployment diagnostics can receive real resource IDs
App Gateway	Backend pool is declarative instead of local-exec
Cost	cheap-lab profile added
State backup	Backup container creation and RBAC login behavior improved
Docs	Main README and Wiki were refreshed

Next Backlog

Priority	Category	Recommendation	Why it matters
P1	AKS security	Add private cluster, local account disable, network policy, Azure Policy for AKS	Makes AKS closer to production practice
P1	Monitoring	Add alert tests and workbook screenshots	Proves observability works after apply
P1	Tests	Expand Terratest to validate private endpoints, no public RDP, no LB RDP NAT	Prevents regressions in hardening controls
P1	Cost	Add Infracost threshold comments or failure rules	Makes cost impact visible in PRs
P2	Governance	Split lab audit policies from production deny policies	Avoids confusing lab behavior with production enforcement
P2	State	Add documented private endpoint option for state storage	Better production-like backend security
P2	Docs	Add screenshots of successful workflow runs and Azure Portal validation	Makes the lab easier to follow
P2	Workloads	Add sample app deployment or smoke test endpoint	Gives workload validation a real target
P3	DR	Add secondary-region network pattern documentation	Useful for architecture learning
P3	Naming	Add generated naming table per profile	Helps troubleshooting and tests

Suggested PR Sequence

1. Add Terratest coverage for hardening controls.
2. Improve AKS production-like profile options.
3. Add state storage private endpoint documentation and optional module support.
4. Add richer monitoring validation and dashboard evidence.
5. Add sample app smoke tests.

Definition Of Done For Future Changes

Every meaningful Terraform change should include:

• Updated variable docs if inputs change.
• Updated wiki page when behavior changes.
• terraform fmt -check -recursive -diff.
• terraform init -backend=false.
• terraform validate -no-color.
• A plan against at least cheap-lab.
• Security scan and OPA output.
• Cost review if resources are added.

Next page: GitHub Projects And Roadmap Operating Model