Year: 2021 16 posts
Taking Azure Container Apps for a spin
At Ignite November 2021, Microsoft released Azure Container Apps as a public preview. It allows you to run containerized applications on a serverless platform, in the sense that you do not have to worry about the underlying infrastructure. The underlying infrastructure is Kubernetes (AKS) as the control plane with additional software such as: Dapr: distributed…
Kubernetes Blue-Green deployments with Argo Rollouts
In this post, we will take a look at 🟦/🟩 blue-green deployments in Kubernetes. With blue-green deployments, you deploy a new version of an application or service next to the live and stable version. After manual or automatic checks, you promote the new version to become the live version. Switching between versions is simply a…
Trying out WebAssembly on Azure Kubernetes Service
Introduction In October 2021, Microsoft announced the public preview of AKS support for deploying WebAssembly System Interface (WASI) workloads in Kubernetes. You can read the announcement here. In short, that means we can run another type of workload on Kubernetes, besides containers! WebAssembly is maybe best known for the ability to write code with languages…
DNS Options for Private Azure Kubernetes Service
When you deploy Azure Kubernetes Service (AKS), by default the API server is publicly made available. That means it has a public IP address and an Azure-assigned name that’s resolvable by public DNS servers. To secure access, you can use authorized IP ranges. As an alternative, you can deploy a private AKS cluster. That means…
Approving a private endpoint connection with Azure CLI
In my previous post, I wrote about App Services with Private Link and used Azure Front Door to publish the web app. Azure Front Door Premium (in preview), can create a Private Endpoint and link it to your web app via Azure Private Link. When that happens, you need to approve the pending connection in…
Azure App Services with Private Link
In one of my videos on my YouTube channel, I discuss Azure App Services with Private Link. The video describes how it works and provides an example of deploying the infrastructure with Bicep. The Bicep templates are on GitHub. If you want to jump straight to the video, here it is: In the rest of…
A quick look at azure/kubelogin
I have talked about and demonstrated the use of kubelogin in previous posts and videos. Because I often get questions about logging on to Azure Kubernetes Services (AKS) integrated with Azure AD (AAD) in a non-interactive fashion, I decided to write this separate post about it. What is kubelogin? Kubelogin is a client-go credential plugin…
Building a GitHub Action with Docker
While I was investigating Kyverno, I wanted to check my Kubernetes deployments for compliance with Kyverno policies. The Kyverno CLI can be used to do that with the following command: kyverno apply ./policies –resource=./deploy/deployment.yaml To do this easily from a GitHub workflow, I created an action called gbaeke/kyverno-cli. The action uses a Docker container. It…
Using Kyverno for Kubernetes Policies
In an earlier blogpost, I wrote about Kubernetes Policies on Azure Kubernetes Service with the Azure Policy add-on. The add-on installs Gatekeeper v3 on AKS, which relies on Open Policy Agent to define your policies. Open Policy Agent is a general cloud-native solution for policy-based control, which goes beyond Kubernetes. Defining custom policies for OPA…
Distroless or scratch for Go apps?
Business photo created by aopsan – http://www.freepik.com When I create docker images for a Go application, I often use the scratch image. Scratch is an empty image, so it is ideal for statically linked binaries that do not require libc. Go, Rust and other languages can compile to such binaries. Because I like the pattern…
Azure Policy for Kubernetes: Contraints and ConstraintTemplates
In one on my videos on my YouTube channel, I talked about Kubernetes authentication and used the image below: To secure access to the Kubernetes API server, you need to be authenticated and properly authorized to do what you need to do. The third mechanism to secure access is admission control. Simply put, admission control…
Azure Kubernetes Service authentication with Azure AD
If you have ever installed Kubernetes on your own hardware or you have worked with Kubernetes on the desktop with a tool like kind, you probably know that you need a config file that tells the Kubernetes CLI (kubectl) how to talk to the Kubernetes API server. It contains the address of the API server,…
Azure Policy: Kubernetes pod security baseline explained
When you deploy Azure Kubernetes Service (AKS) in an enterprise context, you will probably be asked about policies that can be applied to AKS for compliance and security. In this post, we will discuss Azure Policy for Kubernetes briefly and then proceed to explaining a group of policies that implement baseline security settings. Azure Policy…
Deploying Helm Charts with Azure DevOps pipelines
I recently uploaded a video to my YouTube channel about this topic: In this post, I will provide some more information about the pipelines. Again, many thanks to this post on which the solution is based. The YAML pipelines can be found in my go-template repository. The application is basically a starter template to create…
Kubernetes Canary Deployments with GitHub Actions
In the previous post, we looked at some of the GitHub Actions you can use with Microsoft Azure. One of those actions is the azure/k8s-deploy action which is currently at v1.4 (January 2021). To use that action, include the following snippet in your workflow: The above snippet uses baked manifests from an earlier azure/k8s-bake action…
A look at GitHub Actions for Azure and AKS deployments
In the past, I wrote about using Azure DevOps to deploy an AKS cluster and bootstrap it with Flux v2, a GitOps solution. In an older post, I also described bootstrapping the cluster with Helm deployments from the pipeline. In this post, we will take a look at doing the above with GitHub Actions. Along…
