From an in-house environment to the public cloud
PPL CZ, part of the DHL group, is moving its applications from an internal environment to Microsoft Azure. This involves adapting applications to a cloud architecture and bringing infrastructure deployment into the DevOps practices used for application code.
Since 2021 we have been helping PPL adapt its application architecture for the public cloud and migrate the applications. The collaboration runs in successive phases alongside PPL’s internal team, so the knowledge stays inside the company.
From application assessment to production environments
The work started with an assessment of selected applications and a design for their deployment on Azure, validated in a proof of concept. Infrastructure for the mobile-app backend and other systems followed: containers on AKS, App Service and Function Apps, Azure SQL with elastic pools, Service Bus and Key Vault.
Every environment is created from Bicep templates and deployed through Azure DevOps pipelines. The same process applies to test and production environments, including alerts and monitoring. We introduced GitOps with Argo CD for Kubernetes deployments and later moved the build infrastructure to Managed DevOps Pools.
Simplified functional diagram. It does not show network topology or specific environment configuration.
Working with the PPL team
A large part of the work is solving tasks together with the PPL team. We review infrastructure templates, design pipeline changes in a lab environment and hand them over to operations, tune application and database performance, and help with incidents. As a result, the PPL team develops infrastructure as code on its own, and we step in where deeper Azure experience is needed.
Customer sign-in and security
Alongside the migration, we built customer sign-in for PPL on Azure AD B2C. Custom policies cover registration, phone and e-mail verification, invitations, password reset, localisation and single sign-on to the customer zone and the mobile app.
On the security side, we delivered a Microsoft Sentinel proof of concept with analytics rules and workbooks. We also support PPL in defining security-monitoring use cases and log-collection recommendations for operational systems.
Technologies and our role
| Area | Technologies | What we deliver |
|---|---|---|
| Runtime | AKS, App Service, Function Apps, Azure SQL | Design and preparation of environments for migrated applications |
| Infrastructure as code | Bicep, Azure DevOps, Managed DevOps Pools | Templates, pipelines and their integration into DevOps |
| Deployment | Argo CD, Azure Container Registry | GitOps for applications on Kubernetes |
| Identity | Azure AD B2C | Customer sign-in and custom policies |
| Security | Key Vault, RBAC, Microsoft Sentinel | Secret protection, access control and security monitoring |
What the collaboration delivers
PPL has Azure infrastructure managed as code and a team that can develop it independently. The migration proceeds in phases, and each new application builds on templates and practices proven on the previous ones.
“The Cloudfield team helps us adapt our application architecture from an in-house environment to the public cloud. Beyond the application migration itself, we value their mentoring of our team in infrastructure as code and in integrating cloud infrastructure deployment into DevOps practices.”
— Petr Houška, Enterprise Architect & Information Security Officer, PPL CZ / DHL eCommerce Solutions