Building Secure Alibaba Cloud ACK Platforms
Build private Alibaba Cloud ACK clusters with OpenTofu, secure node pools, Spot autoscaling, OSS state locking and private Argo CD.
Cloud architecture and FinOps from production work
Guides, runbooks and code from AWS, Alibaba Cloud and Kubernetes engagements, written by the VigilesHQ engineering team.
Start with the ACK series Generative AI on Alibaba Cloud Runbooks Discuss a requirement
Build a secure Alibaba Cloud ACK cluster with OpenTofu
The example is a private API in ap-southeast-1, three zones, and pod egress that leaves nodes without a public address. The complete OpenTofu example is available in the VigilesHQ Alibaba Cloud ACK repository. VPC 172.21.0.0/16 and names such as vpc-example are stand-ins. A real apply uses the account GetCallerIdentity returns.
Alibaba Cloud ACK node pools: subscription, Spot and autoscaling
CoreDNS, the Terway daemon and the cluster autoscaler components have a different failure budget from the application. If a Spot node disappears, the API should reschedule. If the only node running CoreDNS disappears, every lookup in the cluster fails until a replacement is Ready. This page splits those two budgets for the private ACK cluster described in Build a secure Alibaba Cloud ACK cluster with OpenTofu.
OpenTofu remote state and private GitOps on Alibaba Cloud
Two people applying the same stack from two laptops will eventually both think they hold the latest state. One apply refreshes, the other writes an older serial, and a node pool disappears because the second plan never saw it. The fix is a private OSS object per stack and a TableStore row that only one OpenTofu process can hold. Do that before the migration. The first collision is too late.
What a Cross-Cloud Security Incident Changed in Our Kubernetes Rebuild
The response team found evidence that cloud identities and compute resources could no longer be trusted. The affected estate spanned AWS and Alibaba Cloud. Workloads were still running.
Generative AI on Alibaba Cloud
A chapter-by-chapter series that applies Generative AI on AWS to Alibaba Cloud Model Studio, PAI and Qwen, with runnable demos and token cost for each step.
How Qwen models work: tokens, embeddings, attention and scaling laws
Chapter 3 of Generative AI on AWS explains tokenizers, embeddings, the transformer and scaling laws. This part measures the Qwen tokenizer across five languages, sizes text-embedding-v4 vectors for a search index, and shows where each internal step shows up on a Model Studio bill, with scripts you can run to check the numbers yourself.
Alibaba Cloud architecture for APAC workloads
Provider-scoped consulting on this control plane is Alibaba Cloud architecture consulting. Region comparison with other providers is AWS vs Azure vs Google Cloud vs Alibaba Cloud for APAC.
Choosing a Primary Cloud Region for APAC Workloads
A US workshop account often lands in us-east-1 or eastus because the lab image and quota already exist there. Production users and regulated data in Singapore, Jakarta, Tokyo, Sydney or Hong Kong then inherit that default. Confirm the current regional service list for the provider you run before you treat a city name as available.
Cross-region disaster recovery
Write the numbers first in the recovery objective planner. Rehearsal steps sit in region failover. Failure-domain vocabulary is in regions, availability zones and failure domains.
Egress cost planning
Use the egress cost estimator for a formula pass. It is not an invoice. The operational path for a sudden jump is cross-region traffic cost. Treat each hop as a meter:
GPU and AI workload cost governance
The planning worksheet is the AI and GPU workload cost estimator. The practice name is What is AI FinOps?. Every row is a burning GPU-hour meter. LaunchTime older than the last completed job, with no serving traffic, is idle. Instance families differ by region. p5 in us-east-1 does not mean ap-southeast-1 has the same quota or price.
Hub-and-spoke cloud networking
Background terms sit in cloud networking fundamentals. Egress money sits in egress cost planning. The hub is the place you put things you do not want copied in every application network:
Kubernetes cost allocation
The worksheet on this site is the Kubernetes cost allocation calculator. A spend jump on the cluster is Kubernetes cluster cost increase. The provider bills: It cannot see that namespace/payments used 30% of a node's CPU unless you export in-cluster usage and join it to the node SKU price. That join is cost allocation. The FinOps Framework calls this allocation. It is not the same as a discount.
Cloud migration readiness assessment
The checklist form of this work is the cloud migration assessment checklist. Scoped help is cloud migration assessment. The foundation you migrate into is a landing zone.
Multi-account and multi-subscription structure
The production landing-zone decisions that sit on top of this tree are in Designing a production landing zone. An AWS account is a resource, IAM and billing boundary. A member account belongs to one organization. SCPs attached to an OU limit principals in those member accounts. They do not limit principals in the management account. Azure subscriptions inherit Azure Policy from management groups.
Designing multi-cloud identity
The single-cloud baseline is IAM fundamentals. Whether a second cloud is justified at all is single cloud vs multi-cloud. AWS IAM Identity Center (used by Control Tower) maps IdP groups to permission sets, then to accounts in Organizations. Azure RBAC maps Entra groups to roles on management groups, subscriptions and resource groups.
Designing a production landing zone
If you need the concept without provider mapping, start with What is a landing zone?. This guide covers the decisions a production platform actually has to record.
Cloud tagging and cost allocation
The concept layer is cloud cost allocation fundamentals. The FinOps operating definition is What is FinOps?. Required keys that earn their place: Optional keys (compliance, data-class) help security reviews. They rarely help the monthly allocate meeting. AWS tag policies and Azure Policy can deny creates that omit the required set. Google Cloud organization policies can require labels on selected resource types.
Finding unexpected cloud cost increases
The hour-by-hour operational checklist is unexpected cloud cost spike. Optimization after you know the meter is cloud cost optimization. Pick a baseline window (last month, or the same weekdays last week) and the spike window. Use the same granularity and the same metric.