Azure Hub-and-Spoke Architecture Explained and Automated with OpenTofu

by

This is my first blog of the new year (2026)! Since being re-awarded as a Microsoft MVP, Microsoft provided me with a fresh set of Azure credits. One of the first things I wanted to do was rebuild my Azure lab environment. This time, I wanted to do it the right way. I wanted it to mirror how I would design and deploy a real enterprise environment, including running fully on private endpoints and following a proper hub-and-spoke network model.

Just as importantly, I wanted everything defined in Infrastructure as Code (IaC) so I could spin environments up and down whenever I needed. That also aligns perfectly with what my team at Jamf is working on right now. We are making some changes to our underlying Azure architecture, including deeper network isolation, security controls, intergration with Jamf security cloud security products, and a shift from Bicep to OpenTofu. We will also be using AI agents to do a lot of the heavy lifting in that refactor. I will be sharing more about that in future blogs and talks as much as I am able to publicly.

Because OpenTofu is at the center of that work, I decided to build my entire Azure lab using OpenTofu and a full hub-and-spoke architecture. This gives my team a real, working reference base implementation that we can build on for production designs. I also want to share this with the larger tech community.

If you are note familiar with OpenTofu it is an open source infrastructure-as-code engine based on Terraform that lets you define, deploy, and manage cloud infrastructure using declarative configuration files, and you can learn more at https://opentofu.org.

You can access the GitHub Repository of my “OpenTofu Azure Hub and Spoke” solution here: https://github.com/Buchatech/OpenTofu-Azure-HubSpoke-public

Lets break down whats in the solution I built.

Solution Architecture

The solution deploys a production-style Azure network and platform foundation that includes:

  • Hub VNet with Azure Firewall, VPN Gateway, and DNS Private Resolver
  • Spoke VNet with peering and default routes through the firewall
  • Key Vault and Azure Container Registry using private endpoints
  • Optional Jumpbox VM for secure management access
  • GitHub Actions CI/CD pipeline using OIDC authentication

How the Automation Works

This is a multi-part solution built around a bootstrap Bash script (bootstrap.sh) and a fully generated OpenTofu repository.

The bootstrap script creates everything you need to get started:

  1. It creates an Azure Storage Account to store your OpenTofu remote state.
  2. It generates a complete OpenTofu project, including modules, variables, and environment structure.
  3. It configures the backend so OpenTofu uses Azure Storage for state.
  4. It creates a ready-to-use GitHub Actions pipeline for CI/CD.

Once the repository is generated, you can deploy your Azure environment by running OpenTofu locally or by pushing the repo to GitHub and letting the pipeline handle deployments for you. Within minutes, you can have a fully functional Azure hub-and-spoke environment up and running, and you can customize the generated modules to fit your own requirements.

Deployment Modes

The bootstrap bash script supports two deployment modes depending on how advanced and locked-down you want the environment to be.

FULL Mode (Default)
This is the enterprise-grade option.

  • Hub VNet with Azure Firewall, VPN Gateway, and DNS Private Resolver
  • Spoke VNet with peering and default route through the firewall
  • Private endpoints for Key Vault and Azure Container Registry
  • Optional Jumpbox VM for secure management
  • GitHub Actions CI/CD pipeline with OIDC authentication

BASIC Mode
This is a simpler version for learning or labs.

  • Hub VNet with Azure Firewall only
  • Spoke VNet with peering and default route through the firewall
  • Public access for Key Vault and Azure Container Registry
  • No Jumpbox, VPN Gateway, or DNS Private Resolver
  • GitHub Actions CI/CD pipeline with OIDC authentication

What the bootstrap.sh Script Does

When you run the bootstrap script, it will:

  1. Prompt you to select FULL or BASIC deployment mode
  2. Create an Azure Storage Account for OpenTofu remote state in rg-tfstate
  3. Generate the full OpenTofu repository structure based on your choice
  4. Configure the OpenTofu backend to use the storage account
  5. Create GitHub Actions workflow files for CI/CD
  6. Output the storage account details and the GitHub secrets you need to configure

From there, you are ready to deploy and customize the script and OpenTofu based on your Azure hub-and-spoke environment entirely through code.

Here is the Readme from the repo. It goes even more in depth into my “OpenTofu Azure Hub and Spoke” solution. I hope you find it useful!

********************************************************************************

Azure Hub-Spoke with OpenTofu

Azure base network architecture solution

This repository contains a production-ready, modular OpenTofu configuration that deploys Azure hub-spoke network topology with two deployment modes (private or public) to match your requirements and budget.

Architecture Overview

This solution deploys a hub-and-spoke network architecture (visual shows full-private deployment):

Enterprise-grade Azure network architecture lab environment with Site-to-Site VPN, Azure Firewall, DNS Private Resolver, and core services

This repository contains a production-ready, modular OpenTofu (Terraform) configuration that deploys a complete Azure hub-spoke network topology designed for hybrid cloud scenarios, connecting your on-premises network (e.g., UniFi network) to Azure.

Architecture Overview

This lab deploys a hub-and-spoke network architecture following Azure best practices (visual shows full private deployment):

┌──────────────────────────────────────────────────────────────────────┐
│                            AZURE CLOUD                                │
│                                                                        │
│  ┌─── HUB VNet (rg-lab-hub-network) ────────────────────────┐        │
│  │ 10.10.0.0/16                                              │        │
│  │                                                            │        │
│  │  ┌──────────┐  ┌───────────┐  ┌────────────┐  ┌───────┐ │        │
│  │  │  Azure   │  │    VPN    │  │    DNS     │  │Jumpbox│ │        │
│  │  │ Firewall │  │  Gateway  │  │  Private   │  │  VM   │ │        │
│  │  │(10.10.1.0│  │(10.10.2.0)│  │  Resolver  │  │(Mgmt) │ │        │
│  │  │)+ DNAT   │  │           │  │(10.10.4-5.0│  │subnet │ │        │
│  │  │SSH:2222  │  │           │  │)           │  │       │ │        │
│  │  └─────┬────┘  └─────┬─────┘  └────────────┘  └───────┘ │        │
│  │        │             │                                     │        │
│  │        │             │  Site-to-Site VPN                  │        │
│  └────────┼─────────────┼─────────────────────────────────────┘        │
│           │             │                                               │
│           │  VNet Peering + Gateway Transit                            │
│           │             │                                               │
│  ┌────────▼─ SPOKE VNet (rg-lab-spoke1-network) ──────┐               │
│  │ 10.20.0.0/16                                        │               │
│  │                                                      │               │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────────────┐ │               │
│  │  │   Apps   │  │   APIs   │  │   Data/Services  │ │               │
│  │  │ Subnet   │  │ Subnet   │  │     Subnet       │ │               │
│  │  │          │  │          │  │  - ACR (Private) │ │               │
│  │  │          │  │          │  │  - Key Vault     │ │               │
│  │  └──────────┘  └──────────┘  └──────────────────┘ │               │
│  │                                                      │               │
│  │  Traffic routed through Azure Firewall ─────────────┘               │
│  └──────────────────────────────────────────────────────               │
│                                                                         │
│  ┌─── Management RG (rg-lab-management) ────────────┐                 │
│  │  - Azure Container Registry (ACR)                 │                 │
│  │  - Azure Key Vault                                 │                 │
│  │  - Private Endpoints in Spoke Data subnet         │                 │
│  └────────────────────────────────────────────────────┘                 │
│                                                                         │
└─────────────────────────────┬───────────────────────────────────────────┘
                              │
                      S2S VPN Tunnel (IPsec)
                              │
              ┌───────────────▼──────────────┐
              │   ON-PREMISES NETWORK        │
              │   (e.g., UniFi Router)       │
              │   192.168.1.0/24             │
              │                              │
              │   SSH → Azure Firewall:2222  │
              │   → DNAT → Jumpbox:22        │
              └──────────────────────────────┘

Read more

Docker Hardened Images Are Now Free: What This Means for Developers and Platform Teams

by

Last week Docker made a big move for the container ecosystem. Docker Hardened Images (DHI) are now free and open source, making secure container foundations accessible to everyone.

If you build, deploy, or operate containerized workloads, this is one of those changes that quietly but meaningfully improves day to day security and reliability.

Let’s break down what Docker Hardened Images are, why they matter, and how you can start using them today.

What Are Docker Hardened Images?

Docker Hardened Images are base container images that come pre-hardened for security and transparency. Instead of starting from a generic base image and layering on your own security practices, DHI gives you a safer starting point out of the box.

They are designed to reduce common container risks without adding operational overhead or complexity.

In practical terms, this means Docker has already done the work many teams struggle to keep up with.

What You Get Out of the Box

When you use Docker Hardened Images, your base images now:

  • Include automated security metadata
  • Are minimalist and optimized for faster builds and startup times
  • Contain significantly fewer known vulnerabilities (CVEs) from the start
  • Are fully free and open source

This shifts container security left, right to the foundation of your application images.

There still is a paid version of Docker Hardened Images for those that have enterprise needs. Here is a breakdown of what you get with the Free Docker Hardened Images and the Paid version.

Why This Is a Big Deal

Most container vulnerabilities originate from base images. Teams often inherit outdated packages, unused libraries, or poorly maintained dependencies without realizing it.

Docker Hardened Images help address that by:

  • Reducing the attack surface before you write any application code
  • Improving transparency into what is inside your images
  • Lowering the burden on platform and security teams
  • Making secure defaults accessible even to small teams and solo developers

Security becomes the baseline rather than an afterthought.

Read more

“Building Apps with OpenAI” my 29th Pluralsight Course!

by

I am excited to share that my 29th Pluralsight course is now live titled Building Applications with OpenAI. This course guides developers through creating modern AI powered applications using OpenAI APIs. Whether you are just getting started with generative AI or looking to integrate it into real projects, you will walk away with practical skills you can use right away.

This was a fun course to build. In this course you will learn how to integrate OpenAI into real world applications from end to end. We begin by setting up the OpenAI API, handling authentication, and designing effective prompts. Then we build a full stack web app that uses AI to analyze and classify data while exploring best practices for deployment, performance monitoring, and error handling. By the end you will have the confidence to build, deploy, and scale your own AI driven solutions.

🧠 Why This Course Matters

Generative AI is reshaping how software gets built and developers are expected to know how to integrate these capabilities into applications. This course gives you the foundational and practical knowledge to do that. You will see how to handle prompt refinement, token limits, deployment tradeoffs, and optimization strategies.

📘 Official Course Description

“Generative AI is changing how software is developed, and developers are now expected to integrate AI features into modern applications. In this course, Building Applications with OpenAI, you’ll gain the skills to build, deploy, and maintain AI-powered web applications. First, you’ll explore how to configure the OpenAI API, manage authentication, and craft effective prompts. Next, you’ll build a full-stack expense tracking app that uses OpenAI to analyze and categorize expenses. Finally, you’ll learn how to deploy your app using platforms like Render or Google Cloud, monitor performance, and handle challenges such as token limits, error handling, and prompt optimization. When you’re finished with this course, you’ll have the knowledge and tools to confidently integrate OpenAI into your own applications and bring AI capabilities to your development projects.“

This course is a part of the “OpenAI for Developers Path” on Pluralsight. The path can be found here: https://app.pluralsight.com/paths/skills/openai-for-developers and has many courses that will teach you various aspects of bringing OpenAI into your applications.


If you’re building applications and need to add AI, this course will help you. Check out the course here:

https://www.pluralsight.com/courses/building-applications-openai

I hope this course serves as a valuable resource in your AI journey. Thank you for your continued support, and Be sure to follow my profile on Pluralsight so you will be notified as I release new courses! 

Here is the link to my Pluralsight profile to follow me:

https://www.pluralsight.com/authors/steve-buchanan

Read more

My First Docker Captain Summit Experience

by

As many of you know, I was honored to be named a Docker Captain earlier this year (2025). This week, I had the incredible opportunity to attend my very first Docker Captain Summit, and what an experience it was.

The event reminded me a bit of the Microsoft MVP Summit, but with even closer access to the Docker product teams across multiple areas. Every year, the Captain Summit takes place in a different location, bringing together Docker staff from product groups, community management, marketing, and DevRel, along with fellow Docker Captains from around the world.

At the summit, we got an inside look at Docker’s roadmap and were among the first to learn about upcoming products and initiatives. We also had the opportunity to provide direct feedback to the product teams, helping shape the future of Docker from the community’s perspective.

This year’s summit was held in Istanbul, and it was a fantastic few days of connecting with so many brilliant people. I finally met in person several Docker staff members and Captains I’ve been collaborating with online. It was also a chance to reunite with friends from Microsoft and the MVP community.

Of course, not everything we discussed can be shared publicly because of NDAs, but I can tell you that we all walked away with some exciting insights and some awesome Docker swag.

Read more

Presenting at Applied AI 2025 Conf

by

I’m excited to announce that in a couple of weeks I’ll be speaking at the upcoming Applied AI Conference, an event bringing together innovators, researchers, and industry leaders who are shaping the future of Artificial Intelligence.

The Applied AI Conference is all about actionable insights where ideas meet execution. I’m looking forward to sharing lessons learned from my AI journey, hearing from other brilliant minds in the community, and connecting with attendees who are just as passionate about AI innovation.

Why This Conference Matters

The AI landscape is evolving fast, and events like the Applied AI Conference create space for meaningful conversations about what’s next. It’s not just about tools and models it’s about empowering people, teams, and organizations to make smarter, faster decisions with AI.

This year, I’ll be giving two sessions, one being a session and the other being a fireside chat with Mike Jackson. Here is more information about my sessions:

My Sessions at Applied AI Conference

The Easiest Way to Run LLMs Locally: Meet Docker Model Runner

Curious about running large language models (LLMs) on your own machine without wrestling with complicated setups? In this session, I’ll introduce Docker Model Runner, a new feature in Docker Desktop that makes it incredibly easy to run LLMs locally.

Whether you’re a developer experimenting with AI, building offline applications, or simply looking for more control over your models, this session will show you how to get started in minutes. We’ll explore real examples and walk through what makes Docker Model Runner such a powerful addition for anyone working with AI tools.

This is perfect for anyone who wants to move fast with local AI experimentation, without needing to manage complex infrastructure or cloud dependencies.

Fireside Chat: Beyond the Hype – Practical AI Integration in Business

In this fireside chat titled “Beyond the Hype: Practical AI Integration in Business,” I’ll join Mike Jackson for a moderated discussion focused on how organizations can effectively adopt AI in the real world.

We’ll move past buzzwords to talk about real challenges, lessons learned, and success stories from our jouerneys working with AI so far. I’ll be drawing from my experience as an enterprise cloud leader, Microsoft MVP, author, and startup advisor, I’ll share how companies can strategically approach AI adoption from proof of concept to production use.

If you’re interested in how AI can truly add business value (not just headlines), this conversation will offer insights you can take back to your organization.

I’m honored to be presenting here and can’t wait to connect with the broader AI and developer community during the event.

If you’re attending, I’d love to see you there.
Check out the full speaker lineup here: appliedaiconf.com/speaker-directory

Read more

It’s Been a Year – Microsoft MVP for the 11th Time!

by

What a ride this year has been. Back in May, my entire team was eliminated and I was laid off from Microsoft. Not long after, I was honored to be named a Docker Captain, and soon after that I landed a new role leading Azure and AKS at Jamf, helping run their SaaS products in the cloud.

And yesterday, I found out that I’ve been re-awarded as a Microsoft MVP! This marks my 11th year as an MVP, all in the span of just a few months of major ups and downs. After a short detour (just under four years) working at the mothership, I’m excited to be back in the MVP community.

I never take this recognition for granted. It’s an honor to return to the MVP ranks and continue contributing as a community champion in the worlds of Microsoft, Azure, Azure Kubernetes Service, AI, and Open Source.

To all the other MVPs who were renewed—and to the new awardees announced on October 1—congratulations!

Stay tuned!

Read more

Guest on Code To Cloud Podcast – AI, Cloud, Career Resilience, and Farming

by

I’m excited to share that I recently sat down again with former colleuage at Microsoft Kevin Evans on the “Code to Cloud” podcast for a conversation titled “AI, Cloud, and Career Resilience.” It has been a couple of years since I was on as a guest on his podcast. This discussion was super fun and goes all over the place from personal finance (Dave Ramsey we are coming for the top spot!), leaving tech to farm, to the recent layoffs at Microsoft, what AI means for all of us, and more.

You can listen on Spotify, Apple Podcasts, or watch the full episode on YouTube.

Spotify: https://open.spotify.com/episode/1jMf7mRZNxew6trsWt8e96

Apple Podcasts link: https://podcasts.apple.com/us/podcast/ai-cloud-and-career-resilience-with-steve-buchanan/id1788423999?i=1000729123487

YouTube: https://www.youtube.com/watch?v=vmo7MdmGj-s

In this post, I wanted to share some of the highlights, key takeaways, and a few behind-the-scenes thoughts from recording.

On the podcast, Kevin and I dug into several topics, especially in today’s rapidly evolving tech landscape. Some of the themes we touched on are:

Leadership & owning your narrative
I shared lessons I’ve learned in leadership like how to set vision, how to manage through change, and how leaders can help their teams navigate ambiguity.
We also talked about taking control of your narrative rather than letting circumstances or others define it for you.

My journey in tech
We walked through my career path over the years. The ups, the challenges, the moments of uncertainty. And I shared about recently being laid off from Microsoft, pivoting roles, and how those moments shaped and continue to shape my approach to owning my career.

Career resilience and mindset
One of the things I emphasized is that resilience is not just bouncing back, it’s proactively preparing, adapting, and taking charge of your trajectory. We talked about strategies to stay relevant: continuous learning, building a network, personal branding, and leaning into uncertainty instead of resisting it.

AI + Cloud: Opportunities and disruption
We explored how AI is weaving into cloud-native infrastructure and application stacks, and what that means for technologists.
We also addressed how to stay grounded amidst hype and understanding what’s real, what’s emerging, and how to plug into it in a practical, impactful way.

Key Takeaways and Advice for You

If you are reading this, here are a few of the ideas I hope will stick with you:

Do not wait for perfect context. The ideal job or environment might not exist yet. Instead, start shaping it yourself. Build the skills, forge relationships, and create momentum where you are.

Be purposeful in how you show up. Your personal brand is not about vanity. It is a vector for opportunities, trust, and alignment. Share your journey, your thinking, your work, even when it feels vulnerable.

Stay curious with humility. In fields like AI and cloud, change is constant. Curiosity keeps you relevant and humility keeps you open to learning when you do not know the answer.

Focus on bridges, not walls. Whether you are navigating careers, organization changes, or technical disruption, build bridges between peers, between domains, and across teams. Avoid insulating yourself.

Your resilience is in your habits. It is not just how you react in a crisis. It is how you cultivate consistency, reflection, incremental growth, and adaptability.

Behind the Mic; A Few Reflections

Recording with Kevin is always fun. His questions push guests to think more deeply than just the “what happened” stories. It was gratifying to revisit earlier chapters in my career after recently being laid off and exploring themes like uncertainty, adaptation, and ownership recurred over time.
I always find it special when conversations like these inspire me as much as I hope they inspire listeners and the host as well! Preparing, sharing, and telling stories helps us all get a little more confident in this unknown tech market.

If you have 45 to 60 minutes to spare, I encourage you to give the episode a listen! You will find not just stories from me but hopefully a few ideas or sparks you can take into your own path!

You can also watch the episode right here:

Read more

Im Speaking at BITCON 2025 – Easiest Way to Run LLMs Locally: Meet Docker Model Runner

by

🎤 I’m excited to share that I’ll be returning to BITCON in a week! I will be speaking at BITCON 2025, a gathering focused on Black voices in technology, innovation, and community. You can check out the full speaker lineup here: BITCON 2025 Speakers. The conference this year is virtual and its free. You can check out the site here: https://bitcon.blacksintechnology.net

The conference has a ton of great speakers lined up from some of the largest tech companies such as Google, Microsoft, and more. And to top it off the keynote this year is Kelsey Hightower! You dont want to miss this one.

My Session: “The Easiest Way to Run LLMs Locally: Meet Docker Model Runner”
Docker Captain: Steve Buchanan DMR session

At BITCON, I’ll be presenting “The Easiest Way to Run LLMs Locally: Meet Docker Model Runner”. In this session, I’ll look at:

  • Why run LLMs locally? The benefits in terms of cost, privacy, latency, and control
  • How Docker Model Runner simplifies things — containerizing large models, managing dependencies, and lowering friction
  • Demo and walkthrough — showing you step by step how to get a model up and running on your own machine or server
  • Best practices, pitfalls, and tips — what I’ve learned building and deploying these systems
  • Q&A / hands-on help — to get you started with your own setup

My goal is that attendees leave with a concrete, reproducible process they can apply right away.

Why It Matters

Large language models (LLMs) are powerful, but running them locally has often felt out of reach for smaller teams, indie devs, or people in resource-constrained environments. With the right tooling (like Docker Model Runner), we can lower that barrier—unlocking more experimentation, more privacy, and more control over where and how inference happens.

I believe this aligns well with the mission of BITCON: elevating voices, demystifying advanced tech, and making it accessible. I hope this talk helps bridge a gap for folks who want to explore AI locally without getting lost in infrastructure.

I am excited to be speaking at BITCON again. To learn more about my session check it out here:

BITCon Session: The Easiest Way to Run LLMs Locally: Meet Docker Model Runner

BITCON is free! Be sure to register today: HERE

Read more

Recent Blog Posts: MCP Servers, Dev, Multi-cloud Mastery, and Cloud Engineer Resumes

by

This is a shorter post, but I wanted to take a moment to share what I’ve been working on lately. Over the past few months I’ve been publishing a steady stream of blog posts on Pluralsight, covering topics across cloud, AI, JavaScript, and beyond. There’s a lot happening in tech right now, and I’ve been fortunate to collaborate with the Pluralsight team to dive into some of these exciting areas:

Check out an overview the blog posts and use the the following links to read more:

Behind the Buzzword: What is MCP (MCP Server)?
A breakdown of MCP servers and why they matter in the evolving landscape of AI.
👉 Read the post

How to Run an LLM Locally on Your Desktop
Exploring why and how you might want to run a large language model on your own machine, with a closer look at Docker Model Runner.
👉 Read the post

What to Emphasize on Your Resume as a Cloud Engineer
Tips on showcasing the skills that make cloud engineers stand out in today’s job market.
👉 Read the post

Multicloud Mastery: How to Train Teams in AWS, Azure, and GCP
Practical advice on enabling engineering teams to work across multiple clouds with confidence.
👉 Read the post

6 Cloud Cost Optimization Strategies and Tools for AWS, Azure, and GCP
A set of proven strategies and tools to help control and reduce cloud spend.
👉 Read the post

How to Add User Authentication to Your JavaScript App
A straightforward guide to securing your JavaScript applications with simple authentication techniques.
👉 Read the post

I’ll be continuing to publish more content in the months ahead, so stay tuned for future posts on cloud-native engineering, AI, and practical developer skills. If you found these articles useful, I’d love for you to check them out and share them with your network.

Read more

Docker Model Runner Blog Post

by

I’ve been spending a lot of time blogging on Pluralsight lately, and one of my recent posts covered a topic I’m genuinely excited about: running large language models (LLMs) locally. Specifically, I explored a tool called Docker Model Runner that makes this process more accessible for developers.

In the post, I broke down a few key ideas.

Why Run an LLM Locally

There’s a lot of momentum around cloud-hosted AI services, but running models locally still has its place. For many developers it means more control, quicker experimentation, and the ability to work outside of a cloud provider’s ecosystem.

Tools in This Space

Before zeroing in on Docker Model Runner, I broke down other ways developers are running models locally. The landscape is quickly evolving, and each tool has trade-offs in terms of usability, performance, and compatibility with different models.

Why Docker Model Runner

What really stood out to me with Docker Model Runner is how it lowers the barrier to entry. Instead of wrestling with environment setup, dependencies, and GPU drivers, you can pull down a container and get straight to experimenting. It leans into Docker’s strengths of portability and consistency, so whether you’re on a desktop, laptop, or even testing in a lab environment, the experience is smooth and repeatable.

For developers who are curious about LLMs but don’t want to get bogged down in infrastructure, this tool is a great starting point.

If you want the full breakdown and step-by-step details, you can check out my Pluralsight blog here:
👉 https://www.pluralsight.com/resources/blog/ai-and-data/how-run-llm-locally-desktop

Read more