Up to here, the Kladde has asked its models on your machine. That costs nothing per token and needs no subscription. But an office that uses the Kladde day to day runs it in Azure, as you learned in K3, and there it talks to a model in Microsoft Foundry. With this module, operations begin: In this lesson, you create the infrastructure for it as Bicep, sign the Kladde in without keys and switch it between local and cloud through configuration alone. The next lessons make it visible (tracing), limit its costs (cap) and switch models without the quality suffering.
Everything in this lesson except Exercise 3 works without an Azure subscription: You translate Bicep on your machine with az bicep build, and the
tests run against the fake client. Exercise 3 is the optional cloud part in your own subscription, with the budget alert from K3.
| Tool or package | Version | what for |
|---|---|---|
| Azure CLI with Bicep | az bicep version shows the version, az bicep upgrade fetches the newest |
translating and checking Bicep |
Azure.Identity |
1.21.0 (in Kladde.Ai since T2.1) |
sign-in with managed identity |
Resource, project, deployment
Foundry has three levels. Telling them apart saves a lot of searching later, because permissions, costs and limits each hang on a different one:
| Level | Resource type in Azure | what lives there |
|---|---|---|
| Foundry resource | Microsoft.CognitiveServices/accounts with kind: 'AIServices' |
the endpoint, the network rules, the sign-in (with or without keys), the model deployments and their quotas |
| Project | Microsoft.CognitiveServices/accounts/projects |
a workspace under the resource: access, data and costs separated per team or application; later, agents, evaluations and the connection to Application Insights hang there |
| Deployment | Microsoft.CognitiveServices/accounts/deployments |
a model in a particular version, with a deployment type and a capacity, under a name you choose |
The Kladde never calls a model by its manufacturer's name, but always a deployment by its name. If your deployment is called
assessment, Ai:Model of the Kladde says assessment, no matter which model currently sits behind it. That is the lever for safe
switches in T10.4: A new model first gets a deployment of its own, and the Kladde switches only once it has proven itself.
The endpoint the Kladde talks to belongs to the resource: https://<name of the resource>.openai.azure.com/openai/v1. That is the same
OpenAI-compatible interface that Foundry Local offers on your machine. That is why nothing changes in the Kladde's code, only in the
configuration.