Code, masking policy, and publication scope
These downloadable examples accompany the six chapters. They are not an unattended deployment of your Azure environment.
Downloadable code
- install-vm-web.sh — review locally before running; examples do not contain the original environment credentials.
- nginx.yaml — review locally before running; examples do not contain the original environment credentials.
Editable L400 architecture
Six-page draw.io file with embedded Azure icons · Six-page PDF · All six editable vector SVGs · Embedded SVG views, narrative and control mapping. Open the draw.io file or an SVG locally; no cloud resource is deployed when opening it.
Fields are retained; actual sensitive values are not published
| Category | Visible public representation |
|---|---|
| Subscription / tenant / cloud resource identifiers | [MASKED: identifier] in narrative fields; runtime input in commands; solid masks in screenshots. |
| Account and administrator details | [MASKED: account]; use your authorized identity locally. |
| Password, private key and tokens | [MASKED: credential]. The credential field remains explained, but no original value, encrypted cache, credential XML or private-key file is distributed. |
| Billing | [MASKED: billing information]. Cost-control steps and cost components are retained. Actual spend and entitlement values are not public. |
Screenshot processing
All 21 original evidence images are represented by flattened redacted copies. Browser URLs, account/directory context, subscription fields, visible unique IDs, billing values and unrelated public addresses are covered with solid rectangles before new PNGs are encoded. Original images and local OCR data are outside the publication folder.
Cost and credential controls
The retained resource types can continue charging: compute, disks, Bastion, NAT, monitoring and applicable Azure Local services. Alerts are not a hard spending cap. A tag such as CostControl=Ignore is an explicitly authorized internal-lab exception, not a general Azure requirement or a security control. The guide does not publish actual subscription billing data.
The demonstration lab used a shared administrator password across some Windows targets. Do not reproduce shared administrator credentials in production; use separate, least-privilege, managed administrative identities. Azure portal identity, Windows local/domain sign-in and Ubuntu SSH authentication are different trust boundaries.
What is not claimed
- The nested lab is not a production topology or an independent physical failure domain.
- Examples are version-sensitive. Discover supported Kubernetes versions and VM sizes rather than assuming an old version remains available.
- A menu screenshot is not a completed-migration result; one-second browser polling cannot prove absolute zero downtime.
- The existing guide repository and its Pages homepage are not changed by this separate site's publication.
This public edition is prepared for the dedicated ibranibeny/azure-local-landing-zone-l400 repository and https://ibranibeny.github.io/azure-local-landing-zone-l400/. Public screenshots are explicitly labeled as redacted evidence; architecture references are separately attributed.