FoggyKitchen Landing Zone Orchestrator

FoggyKitchen Landing Zone Orchestrator is a reference architecture layer built on top of public Terraform / OpenTofu modules from the FoggyKitchen ecosystem for Azure and OCI.

It demonstrates how reusable infrastructure modules can be composed into opinionated landing zone patterns: hub-and-spoke networking, private-first compute, private endpoints, Azure private AKS basics, Azure private database access, Azure Front Door multiregion failover, DRG cross-region remote peering, local peering, private DNS, firewall-based transit, and OCI multiregion failover. It also shows how the same orchestration model can be extended into OCI ADB private access, Azure DevOps build-and-deploy AKS, OCI DevOps delivery patterns, and OCI Functions patterns built from reusable FoggyKitchen modules.

This repository is a reference implementation and educational architecture pattern.
It is not a drop-in enterprise landing zone product.
Review security, governance, compliance, identity, networking, and operational requirements before using it in production.

Support expectations are documented in SUPPORT.md.

The goal of this repository is to provide a clear, educational, and architecture-aware orchestration layer for landing zone composition:

• YAML-driven Architecture-as-Payload
• Static, reviewable Terraform / OpenTofu module composition
• Thin orchestration instead of a giant generic supermodule
• Reusable patterns across Azure and OCI
• A clean reference base for courses, demos, and future examples

This repository is not trying to replace Azure CAF or full enterprise landing zone frameworks.
It is a learning-first, composition-first reference implementation.

Depending on the selected pattern and payload, the repository can compose:

• Azure hub-and-spoke landing zones
• Azure private endpoint landing zones
• Azure firewall transit landing zones
• Azure private AKS basic landing zones
• Azure private AKS plus private ACR landing zones
• Azure DevOps CI/CD to private AKS and ACR, with OIDC and a self-hosted Build agent
• Azure Functions event-driven data landing zones with API Management, Event Hubs, and PostgreSQL
• Azure Functions bulk ingestion landing zones with Blob Storage, Event Grid, Event Hubs, and PostgreSQL
• Azure multiregion compute failover patterns with Front Door and regional Load Balancers
• Azure PostgreSQL Flexible Server private-access landing zones with delegated subnet or Private Endpoint
• Azure Database for MySQL Flexible Server private-access landing zones with delegated subnet or Private Endpoint
• Azure SQL Database private-access landing zones with Private Endpoint
• Azure Cosmos DB SQL API private-access landing zones with Private Endpoint
• OCI DRG cross-region landing zones
• OCI same-region LPG local peering landing zones
• OCI multiregion compute failover patterns
• OCI private Autonomous Database patterns
• OCI DevOps build and deploy patterns
• OCI OKE deployment target patterns
• OCI authenticated serverless API patterns
• OCI Functions-based event-driven data patterns
• OCI bulk ingestion pipelines
• Private-first compute placement
• Private DNS integration
• Internal load balancing
• Storage plus private endpoint service exposure

The repository intentionally does not aim to provide:

• a giant multi-cloud supermodule
• dynamic module source selection from YAML
• enterprise governance, policy, or RBAC frameworks
• production-readiness guarantees without review

Each architecture remains explicit, static, and understandable.

The core idea is simple:

1. A YAML payload describes architecture intent.
2. Terraform / OpenTofu decodes that payload.
3. Static FoggyKitchen module calls implement the selected pattern.

The payload controls naming, topology, feature flags, CIDR ranges, subnet intent, routing intent, and workload placement. Module sources remain explicit and static in HCL.

Minimal example:

landing_zone:
  name: fk-azure-lz-dev
  environment: dev

cloud:
  provider: azure
  location: westeurope

architecture:
  topology: hub_spoke
  access_model: private_first
  routing_model: none
  security_model: deny_by_default

features:
  vnet_peering: true
  nsg: true
  compute: false

networking:
  hub:
    name: vnet-fk-hub-dev
    address_space:
      - 10.10.0.0/16
    subnets:
      shared:
        name: snet-fk-shared-services
        cidr: 10.10.1.0/24
  spokes:
    app:
      name: vnet-fk-app-dev
      address_space:
        - 10.20.0.0/16
      subnets:
        backend:
          name: snet-fk-app-backend
          cidr: 10.20.2.0/24

See the runnable payloads under examples/ for complete provider, variable, and validation context.

foggykitchen-landing-zone-orchestrator/
├── docs/
├── examples/
│   ├── azure/
│   │   ├── README.md
│   │   ├── aks/
│   │   │   ├── basic/
│   │   │   ├── private_acr/
│   │   │   └── firewall_transit_basic/
│   │   ├── database/
│   │   │   ├── postgresql/
│   │   │   │   └── private_access/
│   │   │   │       ├── delegated_subnet/
│   │   │   │       └── private_endpoint/
│   │   │   ├── mysql/
│   │   │   │   └── private_access/
│   │   │   │       ├── delegated_subnet/
│   │   │   │       └── private_endpoint/
│   │   │   ├── cosmosdb/
│   │   │   │   └── private_access/
│   │   │   │       └── private_endpoint/
│   │   │   └── sql/
│   │   │       └── private_access/
│   │   │           └── private_endpoint/
│   │   ├── devops/
│   │   │   └── build_and_deploy_aks/
│   │   │       └── basic/
│   │   ├── functions/
│   │   │   ├── bulk_ingestion_pipeline/
│   │   │   │   └── basic/
│   │   │   └── event_driven_data_pipeline/
│   │   │       └── basic/
│   │   ├── multiregion/
│   │   │   └── compute_failover/
│   │   │       └── basic/
│   │   └── networking/
│   │       ├── README.md
│   │       ├── firewall_transit/
│   │       │   └── basic/
│   │       ├── hub_spoke/
│   │       │   ├── README.md
│   │       │   ├── basic/
│   │       │   └── routing/
│   │       └── private_endpoint/
│   │           └── storage_private_link/
│   ├── oci/
│   │   ├── README.md
│   │   ├── adb/
│   │   │   └── private_access/
│   │   │       └── basic/
│   │   ├── devops/
│   │   │   ├── build_and_deploy_oke/
│   │   │   │   └── basic/
│   │   │   └── build_only/
│   │   │       └── basic/
│   │   ├── functions/
│   │   │   ├── authenticated_serverless_api/
│   │   │   │   └── basic/
│   │   │   ├── bulk_ingestion_pipeline/
│   │   │   │   └── basic/
│   │   │   └── event_driven_data_pipeline/
│   │   │       └── basic/
│   │   ├── multiregion/
│   │   │   └── compute_failover/
│   │   │       └── basic/
│   │   └── networking/
│   │       ├── README.md
│   │       ├── drg_cross_region/
│   │       │   └── basic/
│   │       └── lpg_local_peering/
│   │           └── basic/
│   └── multicloud/
│       ├── README.md
│       └── interconnect/
│           └── README.md
├── patterns/
│   ├── azure/
│   │   ├── aks_basic/
│   │   ├── aks_private_acr/
│   │   ├── devops_build_and_deploy_aks/
│   │   ├── postgresql_private_access/
│   │   ├── mysql_private_access/
│   │   ├── cosmosdb_private_access/
│   │   ├── sql_private_access/
│   │   ├── bulk_ingestion_pipeline/
│   │   ├── event_driven_data_pipeline/
│   │   ├── firewall_transit/
│   │   ├── hub_spoke/
│   │   ├── multiregion_compute_failover/
│   │   └── private_endpoint/
│   ├── oci/
│       ├── adb_private_access/
│       ├── authenticated_serverless_api/
│       ├── devops_build_and_deploy_oke/
│       ├── devops_build_only/
│       ├── bulk_ingestion_pipeline/
│       ├── event_driven_data_pipeline/
│       ├── drg_cross_region/
│       ├── lpg_local_peering/
│       └── multiregion_compute_failover/
│   └── multicloud/
│       └── README.md
├── scripts/
├── LICENSE
└── README.md

Currently implemented:

• examples/azure/networking/hub_spoke/basic
• examples/azure/networking/hub_spoke/routing
• examples/azure/networking/firewall_transit/basic
• examples/azure/networking/private_endpoint/storage_private_link
• examples/azure/aks/basic
• examples/azure/aks/private_acr
• examples/azure/devops/build_and_deploy_aks/basic
• examples/azure/functions/bulk_ingestion_pipeline/basic
• examples/azure/functions/event_driven_data_pipeline/basic
• examples/azure/multiregion/compute_failover/basic
• examples/azure/database/postgresql/private_access/delegated_subnet
• examples/azure/database/postgresql/private_access/private_endpoint
• examples/azure/database/mysql/private_access/delegated_subnet
• examples/azure/database/cosmosdb/private_access/private_endpoint
• examples/azure/database/sql/private_access/private_endpoint
• examples/oci/networking/drg_cross_region/basic
• examples/oci/networking/lpg_local_peering/basic
• examples/oci/multiregion/compute_failover/basic
• examples/oci/adb/private_access/basic
• examples/oci/devops/build_only/basic
• examples/oci/devops/build_and_deploy_oke/basic
• examples/oci/functions/authenticated_serverless_api/basic
• examples/oci/functions/bulk_ingestion_pipeline/basic
• examples/oci/functions/event_driven_data_pipeline/basic

Shared orchestration patterns:

• patterns/README.md
• patterns/azure/hub_spoke
• patterns/azure/firewall_transit
• patterns/azure/private_endpoint
• patterns/azure/aks_basic
• patterns/azure/aks_private_acr
• patterns/azure/devops_build_and_deploy_aks
• patterns/azure/bulk_ingestion_pipeline
• patterns/azure/event_driven_data_pipeline
• patterns/azure/multiregion_compute_failover
• patterns/azure/postgresql_private_access
• patterns/azure/mysql_private_access
• patterns/azure/cosmosdb_private_access
• patterns/azure/sql_private_access
• patterns/oci/drg_cross_region
• patterns/oci/lpg_local_peering
• patterns/oci/multiregion_compute_failover
• patterns/oci/adb_private_access
• patterns/oci/devops_build_only
• patterns/oci/devops_build_and_deploy_oke
• patterns/oci/authenticated_serverless_api
• patterns/oci/bulk_ingestion_pipeline
• patterns/oci/event_driven_data_pipeline

The public orchestrator includes focused Azure AKS teaser-tier patterns for single-region private clusters and a separate DevOps pattern for image build, push and deployment. It keeps the network self-contained instead of reusing the broader hub-spoke or firewall-transit patterns.

Current Azure AKS examples:

• Private AKS basic baseline with Azure Bastion operator access and NAT Gateway egress: examples/azure/aks/basic
• Private AKS plus private ACR baseline with ACR Private Endpoint access: examples/azure/aks/private_acr
• Azure DevOps build and deploy to private AKS: examples/azure/devops/build_and_deploy_aks/basic

The CI/CD example has live evidence for apply, successful image push and rollout, negative RBAC trials, application HTTP access through port-forward, and complete teardown. See its README for commands and screenshots. The service remains internal (ClusterIP).

These public patterns deliberately exclude Azure Firewall transit, customer-managed keys, additional node pools, autoscaling, diagnostics, multi-region, and DR. Those concerns belong in the premium aks_firewall_transit blueprint tier.

The public examples tree includes a placeholder for the premium AKS firewall-transit blueprint at examples/azure/aks/firewall_transit_basic. The implementation lives in the private foggykitchen-landing-zone-blueprint repository and requires a FoggyKitchen Professional+ subscription.

The public orchestrator includes focused, single-region Azure private database landing-zone patterns. Each pattern keeps networking self-contained instead of reusing the full hub-spoke pattern, and uses Azure Bastion for operator access to a private validation host.

Current Azure database examples:

• PostgreSQL Flexible Server with delegated-subnet private access: examples/azure/database/postgresql/private_access/delegated_subnet
• PostgreSQL Flexible Server with Private Endpoint access: examples/azure/database/postgresql/private_access/private_endpoint
• MySQL Flexible Server with delegated-subnet private access: examples/azure/database/mysql/private_access/delegated_subnet
• MySQL Flexible Server with Private Endpoint access: examples/azure/database/mysql/private_access/private_endpoint
• Azure SQL Database with Private Endpoint access: examples/azure/database/sql/private_access/private_endpoint
• Cosmos DB SQL API with Private Endpoint access: examples/azure/database/cosmosdb/private_access/private_endpoint

These patterns compose the database module with only the infrastructure required for private validation:

• terraform-az-fk-vnet
• terraform-az-fk-private-dns
• terraform-az-fk-nsg
• terraform-az-fk-bastion
• terraform-az-fk-compute
• terraform-az-fk-private-endpoint where the engine uses Private Endpoint mode
• the engine-specific database module: terraform-az-fk-pg, terraform-az-fk-mysql, terraform-az-fk-sql, or terraform-az-fk-cosmosdb

Secure variants, additional engine modes, multi-region replication or failover, app-to-data hub-spoke topologies, centralized inspection, schema bootstrap, and governance are intentionally outside this public pattern tier.

The public orchestrator repository is intentionally focused on single-cloud reference patterns.

Advanced multicloud implementations, including OCI-Azure interconnect scenarios, are being moved to the private:

• foggykitchen-landing-zone-blueprint

repository.

That code is not part of the free public distribution of this repository. The goal is to keep the open repo clean and educational while reserving the most advanced cross-cloud scenarios for future monetization.

The repository composes FoggyKitchen building blocks such as:

• terraform-az-fk-vnet
• terraform-az-fk-vnet-peering
• terraform-az-fk-routing
• terraform-az-fk-nsg
• terraform-az-fk-public-ip
• terraform-az-fk-natgw
• terraform-az-fk-bastion
• terraform-az-fk-private-dns
• terraform-az-fk-compute
• terraform-az-fk-loadbalancer
• terraform-az-fk-frontdoor
• terraform-az-fk-storage
• terraform-az-fk-private-endpoint
• terraform-az-fk-firewall
• terraform-az-fk-aks
• terraform-az-fk-acr
• terraform-az-fk-devops
• terraform-az-fk-devops-pipeline
• terraform-az-fk-function
• terraform-az-fk-event-grid
• terraform-az-fk-event-hub
• terraform-az-fk-api-management
• terraform-az-fk-managed-identity
• terraform-az-fk-rbac
• terraform-az-fk-pg
• terraform-az-fk-sql
• terraform-az-fk-mysql
• terraform-az-fk-cosmosdb
• terraform-oci-fk-vcn
• terraform-oci-fk-nsg
• terraform-oci-fk-lpg
• terraform-oci-fk-drg
• terraform-oci-fk-compute
• terraform-oci-fk-loadbalancer
• terraform-oci-fk-dns-steering
• terraform-oci-fk-ocir
• terraform-oci-fk-oke
• terraform-oci-fk-policy
• terraform-oci-fk-devops
• terraform-oci-fk-devops-pipeline
• terraform-oci-fk-api-gateway
• terraform-oci-fk-function
• terraform-oci-fk-objectstorage
• terraform-oci-fk-event
• terraform-oci-fk-streaming
• terraform-oci-fk-sch
• terraform-oci-fk-adb

Start with:

• docs/README.md
• docs/architecture.md
• docs/payload-contract.md
• docs/module-map.md

Then choose one of the example payloads under examples/.

• Add more payload variants under examples/azure and examples/oci
• Harden module source pinning to explicit tags
• Extend Azure private endpoint coverage beyond Storage
• Expand OCI examples with more service integrations
• Expand OCI DevOps patterns beyond build-only into deploy, trigger, canary, and blue-green flows

• Azure Database Modules with Terraform: SQL, MySQL and PostgreSQL — Compare SQL, MySQL and PostgreSQL module composition and private connectivity options.
• Private AKS Architecture with Terraform: ACR and Firewall — Follow the progression from private AKS and private ACR to centralized firewall egress.
• Azure Data Pipelines with Terraform: From API and Blob Events to PostgreSQL — Trace API-driven and Blob-triggered ingestion through Functions and Event Hubs to PostgreSQL, including retry and idempotency boundaries.

Licensed under the Universal Permissive License (UPL), Version 1.0.
See LICENSE for details.

© 2026 FoggyKitchen.com - Cloud. Code. Clarity.