Year: 2020 28 posts
AKS Pod Identity with the Azure SDK for Go
In an earlier post, I wrote about the use of AKS Pod Identity (Preview) in combination with the Azure SDK for Python. Although that works fine, there are some issues with that solution: the container image is around 1GB, which is quite large (it is based on tiangolo/uvicorn-gunicorn-fastapi:python3.7) as expected, the image contains many vulnerabilities…
Managed Identity on Azure Arc Servers
When you install the Azure Arc agent on any physical or virtual server, either Windows or Linux, the machine suddenly starts living in a cloud world: it appears in the Azure Portal you can apply resource tags you can check for security and regulatory compliance with Azure Policy you can enable Update management and much,…
Azure AD pod-managed identities in AKS revisited
A long time ago, I wrote a blog post about assigning managed identities to pods in Azure Kubernetes Services (AKS) to authenticate to Azure Storage. The implementation was based on the aad-pod-identity project on GitHub. You can look at the walkthrough to see how it worked. Microsoft recently released a preview that enables you to…
Azure Key Vault Provider for Secrets Store CSI Driver
In the previous post, I talked about akv2k8s. akv2k8s is a Kubernetes controller that synchronizes secrets and certificates from Key Vault. Besides synchronizing to a regular secret, it can also inject secrets into pods. Instead of akv2k8s, you can also use the secrets store CSI driver with the Azure Key Vault provider. As a CSI…
Certificates with Azure Key Vault and Nginx Ingress Controller
Let’s face it. If you deploy web applications and APIs of any sort, you need certificates. If you have been long enough in IT, there’s just no escape! In this article, we will take a look at getting a certificate from Azure Key Vault to Azure Kubernetes service. Next, we will use that certificate with…
Deploy and bootstrap your Kubernetes cluster with Azure DevOps and GitOps
A while ago, I published a post about deploying AKS with Azure DevOps with extras like Nginx Ingress, cert-manager and several others. An Azure Resource Manager (ARM) template is used to deploy Azure Kubernetes Service (AKS). The extras are installed with Helm charts and Helm installer tasks. I mainly use it for demo purposes but…
An introduction to Flux v2
If you have read my blog and watched my Youtube channel, you know I have worked with Flux in the past. Flux, by weaveworks, is a GitOps Kubernetes Operator that ensures that your cluster state matches the desired state described in a git repository. There are other solutions as well, such as Argo CD. With…
Docker without Docker: a look at Podman
I have been working with Docker for quite some time. More and more however, I see people switching to tools like Podman and Buildah and decided to give that a go. I installed a virtual machine in Azure with the following Azure CLI command: Just replace RESOURCEGROUP, VMNAME and PASSWORD with the values you want…
Azure Application Gateway and Cloudflare
I often work with customers that build web applications on cloud platforms like Azure, AWS or Digital Ocean. The web application is usually built by a third party that specializes in e-Commerce, logistics or industrial applications in a wide range of industries. More often than not, these applications use CloudFlare for DNS, caching, and security.…
HashiCorp Waypoint Image Tagging
Recently (October, 2020) I posted an introduction to HashiCorp Waypoint on my YouTube channel. It shows how to build, push, deploy and release applications to Kubernetes with a single waypoint up command. If you want to check out that video first, see below ⬇⬇⬇ After watching that video, it should be clear that you drive…
Azure Private Link and DNS
When you are just starting out with Azure Private Link, it can be hard figuring out how name resolution works and how DNS has to be configured. In this post, we will take a look at some of the internals and try to clear up some of the confusion. If you end up even more…
How to delete an stubborn Azure Virtual Hub
A while ago, I created an Azure Virtual WAN (Standard) and added a virtual hub. For some reason, the virtual hub ended up in the state below: I tried to reset the router and virtual hub but to no avail. Next, I tried to delete the hub. In the portal, this resulted in a validating…
From MQTT to InfluxDB with Dapr
In a previous post, we looked at using the Dapr InfluxDB component to write data to InfluxDB Cloud. In this post, we will take a look at reading data from an MQTT topic and storing it in InfluxDB. We will use Dapr 0.10, which includes both components. To get up to speed with Dapr, please…
Using the Dapr InfluxDB component
A while ago, I created a component that can write to InfluxDB 2.0 from Dapr. This component is now included in the 0.10 release. In this post, we will briefly look at how you can use it. If you do not know what Dapr is, take a look at https://dapr.io. I also have some videos…
Dapr Service Invocation between an HTTP Python client and a GRPC Go server
Recently, I published several videos about Dapr on my Youtube channel. The videos cover the basics of state management, PubSub and service invocation. The Getting Started with state management and service invocation: Let’s take a closer look at service invocation with HTTP, Python and Node. Service Invocation with HTTP The services you write (here Service…
Integrate an Azure Storage Account with Active Directory
A customer with a Windows Virtual Desktop deployment needed access to several file shares for one of their applications. The integration of Azure Storage Accounts with Active Directory allows us to provide this functionality without having to deploy and maintain file services on a virtual machine. A sketch of the environment looks something like this:…
Adding SMB1 protocol support to Windows Server 2019
I realize this is not a very exciting post, especially compared to my other wonderful musing on this site, but I felt I really had to write it to share the pain! A colleague I work with needed to enable this feature on an Azure Windows Server 2019 machine to communicate with some old system…
Adding Authentication and Authorization to an Azure Static Web App
In a previous post, we created a static web app that retrieves documents from Cosmos DB via an Azure Function. The Azure Function got deployed automatically and runs off the same domain as your app. In essence, that frees you from having to setup Azure Functions separately and configuring CORS in the process. Instead of…
First Look at Azure Static Web Apps
Note: part 2 looks at the authentication and authorization part. At Build 2020, Microsoft announced Azure Static Web Apps, a new way to host static web apps on Azure. In the past, static web apps, which are just a combination of HTML, JavaScript and CSS, could be hosted in a Storage Account or a regular…
Trying Consul Connect on your local machine
In a previous post, I talked about installing Consul on Kubernetes and using some of its features. In that post, I did not look at the service mesh functionality. Before looking at that, it is beneficial to try out the service mesh features on your local machine. You can easily install Consul on your local…
Getting started with Consul on Kubernetes
Although I have heard a lot about Hashicorp’s Consul, I have not had the opportunity to work with it and get acquainted with the basics. In this post, I will share some of the basics I have learned, hopefully giving you a bit of a head start when you embark on this journey yourself. Want…
Azure SQL, Azure Active Directory and Seamless SSO: An Overview
Instead of pure lift-and-shift migrations to the cloud, we often encounter lift-shift-tinker migrations. In such a migration, you modify some of the application components to take advantage of cloud services. Often, that’s the database but it could also be your web servers (e.g. replaced by Azure Web App). When you replace SQL Server on-premises with…
Progressive Delivery on Kubernetes: what are your options?
If you have ever deployed an application to Kubernetes, even a simple one, you are probably familiar with deployments. A deployment describes the pods to run, how many of them to run and how they should be upgraded. That last point is especially important because the strategy you select has an impact on the availability…
Trying Windows Virtual Desktop
Update: Windows Virtual Desktop 2020 Spring Update brings an new fully ARM-based deployment method and portal experience. As of May 2020, these features are in public preview. Check the documentation. Links to the documentation in this article will also reflect the update. It was Sunday afternoon. I had some time. So I had this crazy…
Update to IoT Simulator
Quite a while ago, I wrote a small IoT Simulator in Go that creates or deletes multiple IoT devices in IoT Hub and sends telemetry at a preset interval. However, when you use version 0.4 of the simulator, you will encounter issues in the following cases: You create a route to store telemetry in an…
GitOps with Kubernetes: a better way to deploy?
I recently gave a talk at TechTrain, a monthly event in Mechelen (Belgium), hosted by Cronos. The talk is called “GitOps with Kubernetes: a better way to deploy” and is an introduction to GitOps with Weaveworks Flux as an example. You can find a re-recording of the presentation on Youtube:
Writing a Kubernetes operator with Kopf
In today’s post, we will write a simple operator with Kopf, which is a Python framework created by Zalando. A Kubernetes operator is a piece of software, running in Kubernetes, that does something application specific. To see some examples of what operators are used for, check out operatorhub.io. Our operator will do something simple in…
Azure Security Center and Azure Kubernetes Service
Quick post and note to self today… Azure Security Center checks many of your resources for vulnerabilities or attacks. For a while now, it also does so for Azure Kubernetes Service (AKS). In my portal, I saw the following: There are many possible alerts. These are the ones I got: The first one, for instance,…
