Enterprise Cloud Migration to Azure AKS · case study
The brief
The customer ran a 30-service .NET estate on Orange-hosted Windows Server behind F5, with production peaks above 33 million requests per day on betting days. The customer wanted onto Azure with AKS, in a microservice architecture they could operate themselves over time. They rewrote the application code as part of the move. Orange's job was the platform, landing the new architecture in Azure, getting traffic over without disrupting production at that scale, and then handing it cleanly to Managed Services. A big-bang cutover was never an option at this load profile, so service-by-service migration was the route, leaving each predecessor service in place until its successor was verified in production.
What I did
I came in as a Cloud engineer on a three-person Orange-side team. The previous architect set the direction; I owned most of the code that changed. When that architect rolled off in April 2026, I took over architect responsibility on the Orange side, and every technical decision on the account went through me from then on.
The platform runs on AKS with a Terraform module library covering everything from vWAN spokes to private endpoints. ArgoCD reconciles workloads through ApplicationSets, mixing Helm, Kustomize and raw manifests where each fits. Core services are External Secrets Operator, cert-manager, OpenTelemetry Collector and Traefik. I rewrote large parts of the module library as the architecture evolved (AKS, vWAN, Front Door, ACR, Log Analytics, Managed Grafana, ArgoCD core services), and built the observability stack from scratch.
Traffic comes in through Front Door with the WAF in front, hits an internal load balancer, then Traefik ingress on AKS. Backend connectivity rides vWAN with a managed firewall and ExpressRoute back to the Orange data centre, plus a point-to-site VPN for operator access. The customer moved off NGINX Ingress Controller onto Traefik with Gateway API as part of the migration.
The monitoring stack is mine end-to-end. Azure Monitor Workspace and Log Analytics, plus Azure Managed Grafana. All production alerts are Terraform code against the AMBA baseline rather than click-ops in the portal. Alarms route through Orange's Operations Centre and escalate to the customer team when first-line triage hits a wall.
Post-takeover, I drove the post-migration architecture across ServiceBus migration into the customer's new subscription, the move of the customer's main domain onto Azure DNS, and a cold-redeploy DR plan for Azure region failure with runbooks for first-line. Policy-as-code via EPAC did not land inside the engagement window. I wrote it up as an architecture decision record for the customer's CISO instead, so the incoming team has the decision rather than an abandoned half-implementation. Worked alongside the customer's team to stabilise production after migration, where a recurring .NET thread-pool starvation pattern was surfaced via observability, reproduced in a replication harness built from the customer's components, and resolved through an async refactor led by the customer's developers.
Two open-source spin-offs from the engagement are written up as separate case studies. An upstream patch to Traefik that taught Gateway API to support multiple TLS certificates on one listener, merged and released in v3.7.0 (see traefik-gateway-api-pr). And the .NET thread-pool root-cause analysis (see dotnet-thread-pool-rca).
Why it mattered
A clean exit from Orange-hosted Windows and .NET onto a cloud-native Azure architecture the customer can grow into. The engagement closed in August 2026 with the platform handed to Managed Services and the customer's technical account manager, who run it without me.