Year: 2022 14 posts
AKS Workload Identity Revisited
A while ago, I blogged about Workload Identity. Since then, Microsoft simplified the configuration steps and enabled Managed Identity, in addition to app registrations. But first, let’s take a step back. Why do you need something like workload identity in the first place? Take a look at the diagram below. Workloads (deployed in a container…
A quick look at Azure App Configuration and the Python Provider
When developing an application, it is highly likely that it needs to be configured with all sorts of settings. A simple list of key/value pairs is usually all you need. Some of the values can be read by anyone (e.g., a public URL) while some values should be treated as secrets (e.g., a connection string).…
First steps with Crossplane
Image Source: crossplane.io Although Crossplane has been around for a while, I never got around to trying it. Crossplane has many capabilities. However, in this post, I will focus on the following aspects: Installing Crossplane on a Kubernetes cluster (AKS); you can install on a local cluster as well (e.g., k3s, kind, minikube, …) but…
Learn to use the Dapr authorization middleware
Based on a customer conversation, I decided to look into the Dapr middleware components. More specifically, I wanted to understand how the OAuth 2.0 middleware works that enables the Authorization Code flow. In the Authorization Code flow, an authorization code is a temporary code that a client obtains after being redirected to an authorization URL…
Publish your AKS Ingress Controller over Azure Private Link
In a previous article, I wrote about the AKS Azure Cloud Provider and its support for Azure Private Link. In summary, the functionality allows for the following: creation of a Kubernetes service of type LoadBalancer via an annotation on the service, the Azure Cloud Provider creates an internal load balancer (ILB) instead of a public…
Azure Kubernetes Service and Azure Private Link Integration
If you have done any work with Azure, you have probably come across terms such as Azure Private Link Service (PLS) and Private Endpoints (PEs). To quickly illustrate what Azure PLS is, let’s look at a diagram from the Microsoft documentation for Azure SQL database: Above, Azure SQL Database uses Azure Private Link Service (PLS)…
Draft 2 and Ingress with Web Application Routing
If you read the previous article on Draft 2, we went from source code to deployed application in a few steps: az aks draft create: creates a Dockerfile and Kubernetes manifests (deployment and service manifests) az aks draft setup-gh: setup GitHub OIDC az aks draft generate-workflow: create a GitHub workflow that builds and pushes the…
Trying out Draft 2 on AKS
Sadly no post about good Belgian beer 🍺. Draft 2 is an open-source project that aims 🎯 to make things easier for developers that build Kubernetes applications. It can improve the inner dev loop, where the developers code and test their apps, in the following ways: Automate the creation of a Dockerfile Automate the creation…
Quick Guide to Flux v2 on AKS
Now that the Flux v2 extension for Azure Kubernetes Service and Azure Arc is generally available, let’s do a quick guide on the topic. A Quick Guide, at least on this site 😉, is a look at the topic from a command-line perspective for easy reproduction and evaluation. This Quick Guide is also on GitHub.…
Quick Guide to Azure Container Apps
Now that Azure Container Apps (ACA) is generally available, it is time for a quick guide. These quick guides illustrate how to work with a service from the command line and illustrate the main features. Prerequisites All commands are run from bash in WSL 2 (Windows Subsystem for Linux 2 on Windows 11) Azure CLI…
Quick Guide to the Secret Store CSI driver for Azure Key Vault on AKS
Yesterday, I posted the Quick Guide to Kubernetes Workload Identity on AKS. This post contains a similar guide to enabling and using the Secret Store CSI driver for Azure Key Vault on AKS. All commands assume bash. You should have the Azure CLI installed and logged in to the subscription as the owner (because you…
Quick Guide to Kubernetes Workload Identity on AKS
IMPORTANT: the steps below are not relevant anymore; the steps in the quick guide have been updated; see https://github.com/gbaeke/quick-guides/blob/main/workload-identity/README.md for the correct steps. Some things that have changed: you can now use managed identities instead of app registrations; federated token configuration is at the managed identity level you do not need to install the webhook…
A look at some of Azure Container App’s new features
A while ago, I created a YouTube playlist about Azure Container Apps. The videos were based on the first public preview. At the time, several features were missing or still needed to be improved (as expected with a preview release): An easy way to create a container app, similar to az webapp up Managed Identity…
Kubernetes Workload Identity with AKS
When you run a workload, no matter how simple or complex, you often need to access protected resources in both a secure and manageable way. Often, a resource’s security is integrated with an identity store. Azure resources, for instance, can be secured with roles assigned to Azure Active Directory (AAD) users, groups, or service principals.…
