Deployment Variant M2 · azure-oidc · 21 September 2026 · Verified live from the AKS API server

One cluster,
no Microsoft,
same platform.

The same codebase as the on-premises estate, deployed as M2 — Azure AKS instead of a LAN, and an in-cluster Keycloak instead of Entra ID. Nothing in the application was forked to get here: a variant is data plus two code seams, so everything below is the Base0 platform reading a different profiles/azure-oidc/profile.env. Every service box on the map is a live link.

1
AKS cluster
3
Nodes
90
Pods running
23
TLS hostnames
17/17
Scrape targets up
39
Alert rules
23
Policy modules
0
Lines forked
01

The estate

One picture of what runs where. The enclosure is the AKS cluster, each plate a namespace, each chip a service — and every chip carrying a hostname is a link to it. Colour is an encoding held consistent across the document. Compare it with the on-premises map and the differences are the whole point: one cluster rather than two, Keycloak where Entra was, Azure Files where Ceph was, and no GPU data plane at all.

OUTSIDE AZURE Anthropic API Claude · native /v1/messages Model routers HF · OpenRouter Bulutistan · Foundry Azure DNS · Let's Encrypt ACME DNS-01 only — no sign-in here every token is bought here platform keys 23 certificates, all READY ENCODING the platform identity · Keycloak Azure storage Cilium network outside Azure e-learning AZURE · germanywestcentral · vnet 10.224.0.0/16 AKS CLUSTER aks-gpupool-platform-oidc · 3 NODES k8s v1.35.6 · Azure CNI Overlay + Cilium dataplane · 90 pods running · 23 namespaces · control-plane ×2 replicas INGRESS-NGINX + CERT-MANAGER Azure LB → 4.182.11.105 · Let's Encrypt DNS-01 · 23 certificates READY gpupool · gpupool-api · aimo · rag · dsh · ollama · agents · expenses · auth · map · elearn + 12 course hosts — all *.oidc.az.morten.com.tr ns keycloak THE IDENTITY PROVIDER keycloak realm gpupool ↗ keycloak-postgres its own database 7 clients · 5 groups · scope gpupool-api Every front door signs in HERE. On Base0 this plate is absent; the arrow points at Entra ID. ns gpu-pool THE AI GATEWAY control-plane ×2 · https ↗ gateway (Go) /v1 · facades ↗ hub agent WS opa 23 modules redis limiter state postgres platform DB prometheus 17/17 targets grafana 22 boards alertmanager 39 rules opa-sandbox loopback only Prometheus and Grafana have NO public address here — port-forward only. On the LAN they are NodePorts. ns aimo THE CHAT WORKSPACE open-webui https ↗ aimo-postgres chats + pgvector docling ×3 · extraction jupyter · searxng code · web search RAG embeddings go via the gateway, as on Base0. ns rag-admin · agentdesk · dsh · expense THE APPLICATIONS rag-admin collections ↗ agentdesk agents ↗ dsh coding harness ↗ expense-web expenses ↗ agentdesk jupyter sandboxed, no net expense-mcp 13 tools expense-postgres approval record ollama facade ollama host ↗ Teams, Outlook and the Azure Relay ingress are ABSENT: capability m365 is not in this profile. ns skills · markitdown · docsearch · weather · places · maritime · gpupool-support · elearn-mcp · expense 9 MCP SERVERS · NO POD IS REACHABLE skills 10 tools platform 5 tools expense 13 tools elearn 11 tools markitdown 1 tool docsearch 4 · granted weather 3 · granted places 3 · granted maritime 7 · granted Every one is ClusterIP with a NetworkPolicy — the address above is the GOVERNED RELAY, not the pod, so each call is OPA-scanned, audited and size-capped. calendar · outlook · teams need capability m365, and junos needs lan — all four are correctly absent from this variant. ns elearn · elearn-labs THE TRAINING ESTATE — SAME CLUSTER HERE, A SEPARATE ONE ON BASE0 elearn-platform ×2 · https ↗ 12 course sites *.elearn ↗ elearn-lab-gateway ×2 · lab pods elearn-mcp search + monitor Its own bcrypt account store — NOT Keycloak; one of the three separate password stores on this variant. ns kube-system cilium ×3 + cilium-operator ×2 — the AKS-MANAGED dataplane; deploy/cilium/ is not applied here no hubble-relay · no Hubble UI on this variant AZURE STORAGE Files Premium · NFS · RWX StorageClass cephfs-poc Named after Base0's Ceph class ON PURPOSE: every manifest then applies with no edit at all. StorageClass local-path RWO volumes, same trick. There is NO Ceph cluster here — no OSDs, no MDS, no monitors. NO DATA PLANE Base0 pools Mac agents that dial OUT over WebSocket, plus on-prem vLLM boxes on its own hardware. M2 has neither. Inference here is EXTERNAL PROVIDERS ONLY — an explicit decision recorded in the profile, not an omission. THE TWO SEAMS A variant is DATA plus two code seams — never a branch. identity → lib/oidc.ts platform → scripts/lib/profile.sh Everything else on this page is the SAME image that runs on the LAN, reading another profile.env.
Read live from the aks-gpupool-platform-oidc API server on 21 September 2026. The on-premises estate draws two clusters, a Ceph cluster and a pool of Macs; this one draws a single AKS cluster and buys every token from a provider. The application code is identical.
02

What happens to one request

Byte for byte the same pipeline as the on-premises estate — this is the part a variant must not change. Every call, from the chat workspace, from Claude Code, from an agentdesk run or the coding harness, passes the same five gates before a token is bought, and lands in the same audit trail afterwards. Only the ends differ: sign-in arrives from Keycloak, and there is no Mac pool to dispatch to.

clients aimo · Claude Code agentdesk · dsh GPU POOL GATEWAY control-plane ×2 · ns gpu-pool 1 · AUTH platform key, WebUI JWT or Keycloak 2 · POLICY OPA · 23 modules, 16 enabled 3 · BUDGET team token spend ceiling 4 · LIMITS RPM / TPM per key and per user · Redis 5 · ADMISSION priority queue with anti-starvation aging Any gate can deny. A denial is a decision, and a decision is always audited — so “why did that fail?” is answerable for refusals, not only for successes. Anthropic native messages · prompt caching HF · OpenRouter · BT · Foundry router picks the serving provider no Mac pool · no on-prem vLLM the one gap against Base0, by decision ON THE WAY BACK AuditLog full request + response · RequestLog + USD cost · Prometheus histograms · optional post-call response scan 92 audited
Five gates, then dispatch, then the record — unchanged. The audit count is small because this variant is young, not because it records less: the schema, the gates and the order are the same code. What a variant is allowed to change is the ends — who signs you in, and who sells you the tokens.
03

Every front door

The same services as on the map, as click targets. Every one of them is an HTTPS hostname under one wildcard, behind one load balancer — there are no NodePorts on this variant, because AKS nodes carry no public address. Rows without a hostname are reachable only from inside the cluster and are listed so nobody hunts for a URL that does not exist.

04

Run sheet

How to show this variant in twenty minutes. The story is not “here is a platform” — they have already seen that one. It is here is the same platform, on somebody else's cloud, with somebody else's identity provider, and nothing was forked to do it.

01
Open with the sign-in, not the dashboard
Go to the dashboard and let it bounce you to Keycloak. That redirect is the whole M2 thesis in one screen: the application did not learn a new identity provider, it reads a generic OIDC issuer out of its profile. Same image as the LAN runs.
02
Show the estate is genuinely one cluster
This page, section 01. One AKS enclosure, three nodes, Azure Files where Ceph was, and a plate for Keycloak where Base0 has an arrow to Entra. Say out loud what is missing — no Ceph, no lab cluster, no Macs — because an honest map is the one they will trust later.
03
Prove the gateway is the same gateway
Open Activity and run one chat in aimo. The audit row carries the same fields as on-premises: full request, full response, the model, the decision, the cost. The gates ran in the same order for the same reasons.
04
Show a governed tool call
In aimo ask for a forecast or a document conversion. The call leaves as an MCP request through the relay, so it lands on Activity as mcp:weather or mcp:markitdown — scanned, audited and capped exactly like an inference call. Nine servers, and not one of them is reachable directly.
05
Show the training estate on the same cluster
elearn and twelve course hosts. Worth a minute because it makes the variant concrete: on the LAN this is a second Kubernetes cluster; here the profile put it in one, and no course changed.
06
Name the two differences honestly
There is no GPU data plane here, so every token is bought from a provider; and Microsoft 365 features — Teams, Outlook, the calendar — are absent because capability m365 is not in this profile. Both are decisions recorded in profile.env, not gaps discovered on stage.
07
Close on what it cost to get here
Zero application lines. A variant is profiles/azure-oidc/profile.env, a handful of manifest patches, and two code seams — lib/oidc.ts for identity and scripts/lib/profile.sh for platform. That is the reusable claim, and it is the one worth making.
aks-gpupool-platform-oidc · 3 nodes keycloak · realm gpupool azure files premium azure cni overlay + cilium Figures read live from the AKS API server, 21 September 2026. Base0 twin: the on-premises estate map.
Turkce