Workloads

Workloads

The workload module supports production and development spokes using the same Terraform implementation.

Source:

• landing-zones/management/workload
• modules/compute/web-server
• modules/networking/load-balancer
• modules/aks

Workload Spoke Layout

Each workload spoke can include:

Tier	Default subnet	Purpose
Web	10.10.1.0/24 prod, 10.11.1.0/24 dev	Web VMs and public ingress backend
App	10.10.2.0/24 prod, 10.11.2.0/24 dev	Application tier
Data	10.10.3.0/24 prod, 10.11.3.0/24 dev	Database/data tier
AKS	Profile-dependent	Optional Kubernetes subnet

Network Security

Each tier gets an NSG:

• Web NSG
• App NSG
• Data NSG
• Optional AKS NSG

Source:

• landing-zones/management/workload/main.tf
• modules/networking/nsg

Expected pattern:

• Public HTTP/HTTPS should come through Application Gateway or Load Balancer only when enabled.
• RDP should not be exposed through Load Balancer NAT by default.
• App and data tiers should only allow required traffic from upstream tiers and private platform services.
• Egress can route to Azure Firewall when deployed.

Public Load Balancer And IIS Web VMs

Toggle: deploy_load_balancer

Source:

• modules/networking/load-balancer
• modules/compute/web-server

When enabled:

• A public Load Balancer can expose HTTP.
• IIS web server VMs can be created.
• Backend IPs are exported as web_server_ips.
• App Gateway can consume those IPs declaratively.

RDP NAT rules:

• Controlled by enable_lb_rdp_nat_rules.
• Default is false.
• Only enable for short-lived testing with strict source controls.

Application Gateway

Toggle: deploy_application_gateway

Source:

• modules/application-gateway
• main.tf root application_gateway module

The current implementation passes workload web server private IPs into App Gateway as Terraform-managed backend addresses. This avoids imperative local-exec updates.

AKS

Toggle: deploy_aks

Source: modules/aks

Profile examples:

• cheap-lab: AKS disabled
• dev: AKS enabled with one node
• prod: AKS enabled with two nodes

Recommended production-like improvements:

• Private cluster
• Azure Policy for AKS
• Disable local accounts
• Managed identity
• Defender for Containers where licensed
• Network policy
• Separate system and user node pools

PaaS Workload Services

The workload module can optionally deploy:

Service	Module	Toggle
Azure Functions	modules/functions	deploy_functions
Static Web App	modules/static-web-app	deploy_static_web_app
Logic Apps	modules/logic-apps	deploy_logic_apps
Event Grid	modules/event-grid	deploy_event_grid
Service Bus	modules/service-bus	deploy_service_bus
App Service	modules/app-service	deploy_app_service
Cosmos DB	modules/cosmos-db	deploy_cosmos_db

Outputs

Important workload outputs:

• vnet_id
• web_subnet_id
• app_subnet_id
• data_subnet_id
• web_nsg_id
• app_nsg_id
• data_nsg_id
• aks_id
• aks_name
• lb_id
• web_server_ips
• web_server_vm_ids
• PaaS service IDs and names

Source: landing-zones/management/workload/outputs.tf

Validation

After apply:

• Confirm workload VNet peering to hub.
• Confirm tier NSGs are associated.
• Confirm route table sends egress to firewall when firewall is enabled.
• Confirm no RDP NAT rules when enable_lb_rdp_nat_rules = false.
• Confirm App Gateway backend health when App Gateway and web VMs are enabled.
• Confirm AKS cluster state when deploy_aks = true.

Workload Readiness Checklist

Before presenting the workload profile as ready:

• Web subnet exists and has expected NSG.
• App subnet exists and has expected NSG.
• Data subnet exists and has expected NSG.
• Route table behavior matches Firewall/NAT profile.
• Public ingress is through the intended service.
• App Gateway backend health is green when enabled.
• No RDP NAT rules exist unless explicitly approved.
• PaaS service outputs are available when toggles are enabled.