Category · 124 posts
azure
An AI gateway for your agents with Azure API Management
In my work for Cronos and MbarQ, more and more customers are taking their agents from proof of concept to production. One agent is easy to keep an eye on. Ten agents built by four teams are a different story: which models do they call, which tools can they reach, which other agents do they…
aiHybrid search without a vector database
Last week I added a low-cost chat assistant to this blog. It found posts with BM25, plain keyword search, and I admitted it had a weak spot: ask "How is this blog hosted?" and it misses the post about hosting, because that post never uses the word "hosted". The usual fix is embeddings, and the…
aiAdding a low-cost chat assistant to my blog
Building chatbots is a big part of my day job, so it was a bit odd that my own blog didn't have one. Now that baeke.info is a static site on Azure, adding one was easy. There was one requirement though: it should cost next to nothing. A chat box on a public website is…
aiAgent 365: who's keeping an eye on your agents?
Agents are popping up everywhere. Makers build them in Copilot Studio, developers ship them on Foundry, SharePoint sites come with a ready-made one, and partners sell them in the store. That's great, until someone asks a simple question: how many agents do we have, who owns them, and what are they allowed to touch?
aiFrom WordPress.com to a static site on Azure
baeke.info ran on WordPress.com since 2011. That worked fine for a long time, but lately I write every post in Markdown, in a git repo, with Claude Code next to me. Getting that Markdown into WordPress meant converting it to block markup, uploading images through the admin page and checking that every block was valid.…
azureBuilding an AI Agent Server with AG-UI and Microsoft Agent Framework
In this post, I want to talk about the Python backend I built for an AG-UI demo project. It is part of a larger project that also includes a frontend that uses CopilotKit: This post discusses the Python AG-UI server that is built with Microsoft Agent Framework. All code is on GitHub: https://github.com/gbaeke/agui. Most of…
aiGoogle’s A2A: taking a closer look
In the previous post, I talked about options to build multi-agent solutions. The last option used Google’s A2A. A2A provides a wrapper around your agent, basically a JSON-RPC API, that standardizes how you talk to your agent. In this post we take a closer look at the basics of A2A with simple synchronous message exchange.…
aiBuilding multi-agent solutions: what are your options?
When we meet with customers, the topic of a “multi-agent solution” often comes up. This isn’t surprising. There’s a lot of excitement around their potential to transform business processes, strengthen customer relationships, and more. The first question you have to ask yourself though is this: “Do I really need a multi-agent solution?”. Often, we find…
aiCreating an agent with Hugging Face smolagents and Azure OpenAI
Artificial Intelligence (AI) agents have garnered significant attention, with numerous posts discussing them on platforms such as LinkedIn and X/Twitter. In that sense, this post is not different. Instead of theory though, let’s look at building an agent that has a reasoning loop in a very simple way. Although you can build an agent from…
aiCreating a Copilot declarative agent with VS Code and the Teams Toolkit
If you are a Microsoft 365 Copilot user, you have probably seen that the words “agent” and “Copilot agent” are popping up here and there. For example, if you chat with Copilot there is an Agents section in the top right corner: Above, there is a Visual Creator agent that’s built-in. It’s an agent dedicated…
aiUsing your own message broker with Diagrid Catalyst
In a previous post, I wrote about Diagrid Catalyst. Catalyst provides services like pub/sub and state stores to support the developer in writing distributed applications. In the post, we discussed a sample application that processes documents and extracts fields with an LLM (gpt-4o structured extraction). Two services, upload and process, communicate via the pub/sub pattern.…
aiWriting an multi-service document extractor with the help of Diagrid’s Catalyst
Many enterprises have systems in place that take documents, possibly handwritten, that contain data that needs to be extracted. In this post, we will create an application that can extract data from documents that you upload. We will make use of an LLM, in this case gpt-4o. We will use model version 2024-08-06 and its…
aiLoad balancing OpenAI API calls with LiteLLM
If you have ever created an application that makes calls to Azure OpenAI models, you know there are limits to the amount of calls you can make per minute. Take a look at the settings of a GPT model below: Above, the tokens per minute (TPM) rate limit is set to 60 000 tokens. This…
aiUse Azure OpenAI on your data with Semantic Kernel
I have written before about Azure OpenAI on your data. For a refresher, see Microsoft Learn. In short, Azure OpenAI on your data tries to make it easy to create an Azure AI Search index that supports advanced search mechanisms like vector search, potentially enhanced with semantic reranking. On of the things you can do…
aiSuper fast bot creation with Copilot Studio and the Azure OpenAI Assistants API
In a previous post, I discussed the Microsoft Bot Framework SDK that provides a fast track to deploying intelligent bots with the help of the Assistants API. Yet, the journey doesn’t stop there. Copilot Studio, a low-code tool, introduces an even more efficient approach, eliminating the need for intricate bot coding. It empowers developers to…
aiFast chat bot creation with the OpenAI Assistants API and the Microsoft Bot Framework SDK
This post is part of a series of blog posts about the Azure OpenAI Assistants API. Here are the previous posts: Part 1: introduction Part 2: using tools Part 3: retrieval In all of those posts, we demonstrated the abilities of the Azure OpenAI Assistants API in a Python notebook. In this post, we will…
aiA look at the Azure OpenAI Assistants API
Introduction A while ago, I looked at the OpenAI Assistants API. In February of 2024, Microsoft have released their Assistants API in public preview. It works in the same way as the OpenAI Assistants API while being able to use it with Azure OpenAI models, deployed to a region of your choice. The goal of…
aiWorking with Recipes and Gateways in Microsoft’s Radius
In a previous post, we looked at the basics of deploying a multi-container app that uses Dapr with Radius. In this post, we will add two things: a recipe that deploys Redis a gateway: to make the app available to the outside world Find the full code and app.bicep in the following branch: https://github.com/gbaeke/raddemo/tree/radius-step1. Recipes…
automationGiving Microsoft’s Radius a spin
Microsoft recently announced Radius. As stated in their inaugural blog post, it is “a tool to describe, deploy, and manage your entire application”. With Radius, you describe your application in a bicep file. This can include containers, databases, the connections between those and much more. Radius is an open-source solution started from within Microsoft. The…
azureUse the Azure Add your data feature from code
In a previous post, we looked at Azure Add your data (preview) that can be configured from the Azure OpenAI Chat playground. In a couple of steps, you can point to or upload files of a supported file type (PDF, Word, …) and create an Azure Cognitive Search index. That index can subsequently be queried…
aiEnhancing Blog Post Search with Chunk-based Embeddings and Pinecone
In this blog post, we’ll show you a different approach to searching through a large database of blog posts. The previous approach involved creating a single embedding for the entire article and storing it in a vector database. The new approach is much more effective, and in this post, we’ll explain why and how to…
aiStoring and querying for embeddings with Redis
In a previous post, we wrote about using vectorized search and cosine similarity to quickly query a database of blog posts and retrieve the most relevant content to a natural language query. This is achieved using OpenAI’s embeddings API, Pinecone (a vector database), and OpenAI ChatCompletions. For reference, here’s the rough architecture: The steps above…
aiAuthenticate to Azure Resources with Azure Managed Identities
In this post, we will take a look at managed identities in general and system-assigned managed identity in particular. Managed identities can be used by your code to authenticate to Azure AD resources from Azure compute resources that support it, like virtual machines and containers. But first, let’s look at the other option and why…
azureAKS Workload Identity Revisited
A while ago, I blogged about Workload Identity. Since then, Microsoft simplified the configuration steps and enabled Managed Identity, in addition to app registrations. But first, let’s take a step back. Why do you need something like workload identity in the first place? Take a look at the diagram below. Workloads (deployed in a container…
azureA quick look at Azure App Configuration and the Python Provider
When developing an application, it is highly likely that it needs to be configured with all sorts of settings. A simple list of key/value pairs is usually all you need. Some of the values can be read by anyone (e.g., a public URL) while some values should be treated as secrets (e.g., a connection string).…
automationFirst steps with Crossplane
Image Source: crossplane.io Although Crossplane has been around for a while, I never got around to trying it. Crossplane has many capabilities. However, in this post, I will focus on the following aspects: Installing Crossplane on a Kubernetes cluster (AKS); you can install on a local cluster as well (e.g., k3s, kind, minikube, …) but…
automationPublish your AKS Ingress Controller over Azure Private Link
In a previous article, I wrote about the AKS Azure Cloud Provider and its support for Azure Private Link. In summary, the functionality allows for the following: creation of a Kubernetes service of type LoadBalancer via an annotation on the service, the Azure Cloud Provider creates an internal load balancer (ILB) instead of a public…
azureAzure Kubernetes Service and Azure Private Link Integration
If you have done any work with Azure, you have probably come across terms such as Azure Private Link Service (PLS) and Private Endpoints (PEs). To quickly illustrate what Azure PLS is, let’s look at a diagram from the Microsoft documentation for Azure SQL database: Above, Azure SQL Database uses Azure Private Link Service (PLS)…
azureDraft 2 and Ingress with Web Application Routing
If you read the previous article on Draft 2, we went from source code to deployed application in a few steps: az aks draft create: creates a Dockerfile and Kubernetes manifests (deployment and service manifests) az aks draft setup-gh: setup GitHub OIDC az aks draft generate-workflow: create a GitHub workflow that builds and pushes the…
azureQuick Guide to Flux v2 on AKS
Now that the Flux v2 extension for Azure Kubernetes Service and Azure Arc is generally available, let’s do a quick guide on the topic. A Quick Guide, at least on this site 😉, is a look at the topic from a command-line perspective for easy reproduction and evaluation. This Quick Guide is also on GitHub.…
azureQuick Guide to Azure Container Apps
Now that Azure Container Apps (ACA) is generally available, it is time for a quick guide. These quick guides illustrate how to work with a service from the command line and illustrate the main features. Prerequisites All commands are run from bash in WSL 2 (Windows Subsystem for Linux 2 on Windows 11) Azure CLI…
azureQuick Guide to the Secret Store CSI driver for Azure Key Vault on AKS
Yesterday, I posted the Quick Guide to Kubernetes Workload Identity on AKS. This post contains a similar guide to enabling and using the Secret Store CSI driver for Azure Key Vault on AKS. All commands assume bash. You should have the Azure CLI installed and logged in to the subscription as the owner (because you…
azureQuick Guide to Kubernetes Workload Identity on AKS
IMPORTANT: the steps below are not relevant anymore; the steps in the quick guide have been updated; see https://github.com/gbaeke/quick-guides/blob/main/workload-identity/README.md for the correct steps. Some things that have changed: you can now use managed identities instead of app registrations; federated token configuration is at the managed identity level you do not need to install the webhook…
azureA look at some of Azure Container App’s new features
A while ago, I created a YouTube playlist about Azure Container Apps. The videos were based on the first public preview. At the time, several features were missing or still needed to be improved (as expected with a preview release): An easy way to create a container app, similar to az webapp up Managed Identity…
azureKubernetes Workload Identity with AKS
When you run a workload, no matter how simple or complex, you often need to access protected resources in both a secure and manageable way. Often, a resource’s security is integrated with an identity store. Azure resources, for instance, can be secured with roles assigned to Azure Active Directory (AAD) users, groups, or service principals.…
azureTaking Azure Container Apps for a spin
At Ignite November 2021, Microsoft released Azure Container Apps as a public preview. It allows you to run containerized applications on a serverless platform, in the sense that you do not have to worry about the underlying infrastructure. The underlying infrastructure is Kubernetes (AKS) as the control plane with additional software such as: Dapr: distributed…
azureDNS Options for Private Azure Kubernetes Service
When you deploy Azure Kubernetes Service (AKS), by default the API server is publicly made available. That means it has a public IP address and an Azure-assigned name that’s resolvable by public DNS servers. To secure access, you can use authorized IP ranges. As an alternative, you can deploy a private AKS cluster. That means…
azureApproving a private endpoint connection with Azure CLI
In my previous post, I wrote about App Services with Private Link and used Azure Front Door to publish the web app. Azure Front Door Premium (in preview), can create a Private Endpoint and link it to your web app via Azure Private Link. When that happens, you need to approve the pending connection in…
automationAzure App Services with Private Link
In one of my videos on my YouTube channel, I discuss Azure App Services with Private Link. The video describes how it works and provides an example of deploying the infrastructure with Bicep. The Bicep templates are on GitHub. If you want to jump straight to the video, here it is: In the rest of…
automationA quick look at azure/kubelogin
I have talked about and demonstrated the use of kubelogin in previous posts and videos. Because I often get questions about logging on to Azure Kubernetes Services (AKS) integrated with Azure AD (AAD) in a non-interactive fashion, I decided to write this separate post about it. What is kubelogin? Kubelogin is a client-go credential plugin…
azureAzure Policy for Kubernetes: Contraints and ConstraintTemplates
In one on my videos on my YouTube channel, I talked about Kubernetes authentication and used the image below: To secure access to the Kubernetes API server, you need to be authenticated and properly authorized to do what you need to do. The third mechanism to secure access is admission control. Simply put, admission control…
azureAzure Kubernetes Service authentication with Azure AD
If you have ever installed Kubernetes on your own hardware or you have worked with Kubernetes on the desktop with a tool like kind, you probably know that you need a config file that tells the Kubernetes CLI (kubectl) how to talk to the Kubernetes API server. It contains the address of the API server,…
azureAzure Policy: Kubernetes pod security baseline explained
When you deploy Azure Kubernetes Service (AKS) in an enterprise context, you will probably be asked about policies that can be applied to AKS for compliance and security. In this post, we will discuss Azure Policy for Kubernetes briefly and then proceed to explaining a group of policies that implement baseline security settings. Azure Policy…
azureDeploying Helm Charts with Azure DevOps pipelines
I recently uploaded a video to my YouTube channel about this topic: In this post, I will provide some more information about the pipelines. Again, many thanks to this post on which the solution is based. The YAML pipelines can be found in my go-template repository. The application is basically a starter template to create…
azureA look at GitHub Actions for Azure and AKS deployments
In the past, I wrote about using Azure DevOps to deploy an AKS cluster and bootstrap it with Flux v2, a GitOps solution. In an older post, I also described bootstrapping the cluster with Helm deployments from the pipeline. In this post, we will take a look at doing the above with GitHub Actions. Along…
azureAKS Pod Identity with the Azure SDK for Go
In an earlier post, I wrote about the use of AKS Pod Identity (Preview) in combination with the Azure SDK for Python. Although that works fine, there are some issues with that solution: the container image is around 1GB, which is quite large (it is based on tiangolo/uvicorn-gunicorn-fastapi:python3.7) as expected, the image contains many vulnerabilities…
azureManaged Identity on Azure Arc Servers
When you install the Azure Arc agent on any physical or virtual server, either Windows or Linux, the machine suddenly starts living in a cloud world: it appears in the Azure Portal you can apply resource tags you can check for security and regulatory compliance with Azure Policy you can enable Update management and much,…
armAzure AD pod-managed identities in AKS revisited
A long time ago, I wrote a blog post about assigning managed identities to pods in Azure Kubernetes Services (AKS) to authenticate to Azure Storage. The implementation was based on the aad-pod-identity project on GitHub. You can look at the walkthrough to see how it worked. Microsoft recently released a preview that enables you to…
azureAzure Key Vault Provider for Secrets Store CSI Driver
In the previous post, I talked about akv2k8s. akv2k8s is a Kubernetes controller that synchronizes secrets and certificates from Key Vault. Besides synchronizing to a regular secret, it can also inject secrets into pods. Instead of akv2k8s, you can also use the secrets store CSI driver with the Azure Key Vault provider. As a CSI…
automationDeploy and bootstrap your Kubernetes cluster with Azure DevOps and GitOps
A while ago, I published a post about deploying AKS with Azure DevOps with extras like Nginx Ingress, cert-manager and several others. An Azure Resource Manager (ARM) template is used to deploy Azure Kubernetes Service (AKS). The extras are installed with Helm charts and Helm installer tasks. I mainly use it for demo purposes but…
automationDocker without Docker: a look at Podman
I have been working with Docker for quite some time. More and more however, I see people switching to tools like Podman and Buildah and decided to give that a go. I installed a virtual machine in Azure with the following Azure CLI command: Just replace RESOURCEGROUP, VMNAME and PASSWORD with the values you want…
azureAzure Application Gateway and Cloudflare
I often work with customers that build web applications on cloud platforms like Azure, AWS or Digital Ocean. The web application is usually built by a third party that specializes in e-Commerce, logistics or industrial applications in a wide range of industries. More often than not, these applications use CloudFlare for DNS, caching, and security.…
azureAzure Private Link and DNS
When you are just starting out with Azure Private Link, it can be hard figuring out how name resolution works and how DNS has to be configured. In this post, we will take a look at some of the internals and try to clear up some of the confusion. If you end up even more…
azureHow to delete an stubborn Azure Virtual Hub
A while ago, I created an Azure Virtual WAN (Standard) and added a virtual hub. For some reason, the virtual hub ended up in the state below: I tried to reset the router and virtual hub but to no avail. Next, I tried to delete the hub. In the portal, this resulted in a validating…
azureUsing the Dapr InfluxDB component
A while ago, I created a component that can write to InfluxDB 2.0 from Dapr. This component is now included in the 0.10 release. In this post, we will briefly look at how you can use it. If you do not know what Dapr is, take a look at https://dapr.io. I also have some videos…
azureDapr Service Invocation between an HTTP Python client and a GRPC Go server
Recently, I published several videos about Dapr on my Youtube channel. The videos cover the basics of state management, PubSub and service invocation. The Getting Started with state management and service invocation: Let’s take a closer look at service invocation with HTTP, Python and Node. Service Invocation with HTTP The services you write (here Service…
azureIntegrate an Azure Storage Account with Active Directory
A customer with a Windows Virtual Desktop deployment needed access to several file shares for one of their applications. The integration of Azure Storage Accounts with Active Directory allows us to provide this functionality without having to deploy and maintain file services on a virtual machine. A sketch of the environment looks something like this:…
azureAdding SMB1 protocol support to Windows Server 2019
I realize this is not a very exciting post, especially compared to my other wonderful musing on this site, but I felt I really had to write it to share the pain! A colleague I work with needed to enable this feature on an Azure Windows Server 2019 machine to communicate with some old system…
azureAdding Authentication and Authorization to an Azure Static Web App
In a previous post, we created a static web app that retrieves documents from Cosmos DB via an Azure Function. The Azure Function got deployed automatically and runs off the same domain as your app. In essence, that frees you from having to setup Azure Functions separately and configuring CORS in the process. Instead of…
apiFirst Look at Azure Static Web Apps
Note: part 2 looks at the authentication and authorization part. At Build 2020, Microsoft announced Azure Static Web Apps, a new way to host static web apps on Azure. In the past, static web apps, which are just a combination of HTML, JavaScript and CSS, could be hosted in a Storage Account or a regular…
apiGetting started with Consul on Kubernetes
Although I have heard a lot about Hashicorp’s Consul, I have not had the opportunity to work with it and get acquainted with the basics. In this post, I will share some of the basics I have learned, hopefully giving you a bit of a head start when you embark on this journey yourself. Want…
azureAzure SQL, Azure Active Directory and Seamless SSO: An Overview
Instead of pure lift-and-shift migrations to the cloud, we often encounter lift-shift-tinker migrations. In such a migration, you modify some of the application components to take advantage of cloud services. Often, that’s the database but it could also be your web servers (e.g. replaced by Azure Web App). When you replace SQL Server on-premises with…
azureTrying Windows Virtual Desktop
Update: Windows Virtual Desktop 2020 Spring Update brings an new fully ARM-based deployment method and portal experience. As of May 2020, these features are in public preview. Check the documentation. Links to the documentation in this article will also reflect the update. It was Sunday afternoon. I had some time. So I had this crazy…
azureUpdate to IoT Simulator
Quite a while ago, I wrote a small IoT Simulator in Go that creates or deletes multiple IoT devices in IoT Hub and sends telemetry at a preset interval. However, when you use version 0.4 of the simulator, you will encounter issues in the following cases: You create a route to store telemetry in an…
azureAzure Security Center and Azure Kubernetes Service
Quick post and note to self today… Azure Security Center checks many of your resources for vulnerabilities or attacks. For a while now, it also does so for Azure Kubernetes Service (AKS). In my portal, I saw the following: There are many possible alerts. These are the ones I got: The first one, for instance,…
azureGiving Argo CD a spin
If you have followed my blog a little, you have seen a few posts about GitOps with Flux CD. This time, I am taking a look at Argo CD which, like Flux CD, is a GitOps tool to deploy applications from manifests in a git repository. Don’t want to read this whole thing? There are…
automationKustomize and Flux
Flux has a feature called manifest generation that works together with Kustomize. Instead of just picking YAML files from a git repo and applying them, customisation is performed with the kustomize build command. The resulting YAML then gets applied to your cluster. If you don’t know how customisation works (without Flux), take a look at…
azureA quick tour of Kustomize
Image above from: https://kustomize.io/ When you have to deploy an application to multiple environments like dev, test and production there are many solutions available to you. You can manually deploy the app (Nooooooo! 😉), use a CI/CD system like Azure DevOps and its release pipelines (with or without Helm) or maybe even a “GitOps” approach…
automationCreating Kubernetes secrets from Key Vault
If you do any sort of development, you often have to deal with secrets. There are many ways to deal with secrets, one of them is retrieving the secrets from a secure system from your own code. When your application runs on Kubernetes and your code (or 3rd party code) cannot be configured to retrieve…
automationUse a Power Automate Button to start an Azure DevOps build on the go
In a previous post, we built a pipeline to deploy AKS using Azure DevOps. Because it can take while to deploy, it can be handy to start the deployment at any time without having to logon to Azure DevOps. There are many ways to achieve this, but one of the easiest ways is Power Automate.…
automationDeploy AKS with Nginx, External DNS, Helm Operator and Flux
A while ago, I blogged about an Azure YAML pipeline to deploy AKS together with Traefik. As a variation on that theme, this post talks about deploying AKS together with Nginx, External DNS, a Helm Operator and Flux CD. I blogged about Flux before if you want to know what it does. I added the…
azureFront Door with WordPress on Azure App Service
Here’s a quick overview of the steps you need to take to put Front Door in front of an Azure Web App. In this case, the web app runs a WordPress site. Step 1: DNS Suppose you deployed the Web App and its name is gebawptest.azurewebsites.net and you want to reach the site via wp.baeke.info.…
azureGitOps with Weaveworks Flux
If you have ever deployed applications to Kubernetes or other platforms, you are probably used to the following approach: developers check in code which triggers CI (continuous integration) and eventually results in deployable artifacts a release process deploys the artifacts to one or more environments such as a development and a production environment In the…
automationAKS Azure Monitor metrics and alerts
In today’s post, we will take a quick look at Azure Kubernetes Service (AKS) metrics and alerts for Azure Monitor. Out of the box, Microsoft offers two ways to obtain metrics: Metrics that can easily be used with Azure Monitor to generate alerts; these metrics are written to the Azure Monitor metrics store Metrics forwarded…
analyticsBack to basics: DNS ALIAS records
A few days ago, I had to map the domain inity.io to a Netlify domain. If you have only worked with DNS once in your life, you probably know about these two types of records: A: an A record maps a name to an IP address CNAME: a CNAME record maps a name to another…
azureThe basics of meshing Traefik 2.0 with Linkerd
A while ago, I blogged about Linkerd 2.x. In that post, I used a simple calculator API, reachable via an Azure Load Balancer. When you look at that traffic in Linkerd, you see the following: Above, you do not see this is Azure Load Balancer traffic. The traffic reaches the meshed service via the Azure…
apiToken checking at the API Management layer
In the previous blog post, I talked about the OAuth client credentials flow and how to implement it with Azure Active Directory. At the end of the post, I briefly talked about the need to validate the token in either your application or an intermediary layer. In this post, we will take a look at…
apiUsing the OAuth Client Credentials Flow
I often get questions about protecting applications like APIs using OAuth. I guess you know the drill: you have to obtain a token (typically a JWT or JSON Web Token) the client submits the token to your backend (via a Authorization HTTP header) the token needs to be verified (do you trust it?) you need…
apiGiving linkerd a spin
A while ago, I gave linkerd a spin. Due to vacations and a busy schedule, I was not able to write about my experience. I will briefly discuss how to setup linkerd and then deploy a sample service to illustrate what it can do out of the box. Let’s go! Wait! What is linkerd? linkerd…
apiQuick Tip: deploying multiple Traefik ingresses
For a customer that is developing a microservices application, the proposed architecture contains two Kubernetes ingresses: internal ingress: exposed via an Azure internal load balancer, deployed in a separate subnet in the customer’s VNET; no need for SSL external ingress: exposed via an external load balancer; SSL via Let’s Encrypt The internal ingress exposes API…
apiInspecting Web Application Firewall logs
In some of my previous posts, I talked about Azure Front Door and Web Application Firewall policies to protect a workload like one or more APIs running on Kubernetes or App Service. Although I enabled the Web Application Firewall policies, I did not show what happens when the rules are triggered. Let’s take a look…
apiPublishing and securing your API with Kong and Azure Front Door
In the post, Securing your API with Kong and CloudFlare, I exposed a dummy API on Kubernetes with Kong and published it securely with CloudFlare. The breadth of features and its ease of use made CloudFlare a joy to work with. It didn’t take long before I got the question: “can’t you do that with Azure…
apiSecuring your API with Kong and CloudFlare
In the previous post, we looked at API Management with Kong and the Kong Ingress Controller. We did not care about security and exposed a sample toy API over a public HTTP endpoint that also required an API key. All in the clear, no firewall, no WAF, nothing… 👎👎👎 In this post, we will expose…
apiAPI Management with Kong Ingress Controller on Kubernetes
In previous posts, I wrote about Azure API Management in combination with APIs hosted on Kubernetes: API Management with private APIs: requires API Management with virtual network integration because the APIs are reachable via an internal ingress on the Azure virtual network; use the premium tier 💰💰💰 API Management with public APIs: does not require…
apiAzure API Management and Azure Kubernetes Service
You have decided to host your APIs in Kubernetes in combination with an API management solution? You are surely not the only one! In an Azure context, one way of doing this is combining Azure API Management and Azure Kubernetes Service (AKS). This post describes one of the ways to get this done. We will…
apiUpdate on restricting egress traffic on Azure Kubernetes Service
In an earlier post, I discussed the combination of Azure Firewall and Azure Kubernetes Service (AKS) to secure ingress and egress AKS traffic. A few days ago, Microsoft added documentation that describes the ports and URLs to allow when you route traffic through Azure Firewall or a virtual appliance. Some of the allowed ports and…
azureCreating and deploying a model with Azure Machine Learning Service
In this post, we will take a look at creating a simple machine learning model for text classification and deploying it as a container with Azure Machine Learning service. This post is not intended to discuss the finer details of creating a text classification model. In fact, we will use the Keras library and its…
aiAzure Kubernetes Service and Azure Firewall
Deploying Azure Kubernetes Service (AKS) is, like most other Kubernetes-as-a-service offerings such as those from DigitalOcean and Google, very straightforward. It’s either a few clicks in the portal or one or two command lines and you are finished. Using these services properly and in a secure fashion is another matter though. I am often asked…
azureSecuring access to and from Azure Functions
I am often asked how to secure access to and from Azure Functions that are not running in an App Service Environment (ASE). An App Service Environment allows you to safeguard your apps in a subnet of your Azure Virtual Network. In a sense, it gives you a private deployment of Azure App Service that…
azureRevisiting Rancher
Several years ago, when we started our first adventures in the wonderful world of IoT, we created an application for visualizing real-time streams of sensor data. The sensor data came from custom-built devices that used 2G for connectivity. IoT networks and protocols such as SigFox, NB-IoT or Lora were not mainstream at that time. We…
azureImproving an Azure Function that writes IoT Hub data to TimescaleDB
In an earlier post, I used an Azure Function to write data from IoT Hub to a TimescaleDB hypertable on PostgreSQL. Although that function works for demo purposes, there are several issues. Two of those issues will be addressed in this post: the INSERT INTO statement used the NOW() function instead of the enqueuedTimeUtc field;…
analyticsMulti-Tier Bitnami Grafana Stack on Azure
After seeing some tweets about Bitnami’s multi-tier Grafana Stack, I decided to give it a go. On the page describing the Grafana stack, there are several deployment offerings: I decided to use the multi-tier deployment, which deploys multiple Grafana nodes and a shared Azure Database for MariaDB. On Azure, the Grafana stack is deployed via…
analyticsAzure Front Door Revisited
A while ago, I wrote a post about Azure Front Door. In that post, I wrote that http to https redirection was not possible. With Azure Front Door being GA, let’s take a look if that is still the case. In the previous post, I had the following configuration in Front Door Designer: The above…
azureAKS Managed Pod Identity and access to Azure Storage
When you need to access Azure Storage (or other Azure resources) from a container in AKS (Kubernetes on Azure), you have many options. You can put credentials in your code (nooooo!), pass credentials via environment variables, use Kubernetes secrets, obtain secrets from Key Vault and so on. Usually, the credentials are keys but you can…
automationVirtual Node support in Azure Kubernetes Service (AKS)
Although I am using Kubernetes a lot, I didn’t quite get to trying the virtual nodes support. Virtual nodes is basically the implementation on AKS of the virtual kubelet project. The virtual kubelet project allows Kubernetes nodes to be backed by other services that support containers such as AWS Fargate, IoT Edge, Hyper.sh or Microsoft’s…
aiMicrosoft Face API with a local container
A few days ago, I obtained access to the Face container. It provides access to the Face API via a container you can run where you want: on your pc, at the network edge or in your datacenter. You should allocate 6 GB or RAM and 2 cores for the container to run well. Note…
aiInfrastructure as Code: exploring Pulumi
Image: from the Pulumi website In my Twitter feed, I often come across Pulumi so I decided to try it out. Pulumi is an Infrastructure as Code solution that allows you to use familiar development languages such as JavaScript, Python and Go. The idea is that you define your infrastructure in the language that you…
automationAzure API Management Consumption Tier
In the previous post, I talked about a personal application I use to deploy Azure resources to my lab subscription. The architecture is pretty straightforward: After obtaining an id token from Azure Active directory (v1 endpoint), API calls go to API Management with the token in the authorization HTTP header. API Management is available in…
apiSimple Azure AD Authentication in a single page application (SPA)
Adding Azure AD integration to a website is often confusing if you are just getting started. Let’s face it, not everybody has the opportunity to dig deep into such topics. For https://deploy.baeke.info, I wanted to enable Azure AD authentication so that only a select group of users in our AD tenant can call the back-end…
apiAzure Front Door in front of a static website
In the previous post, I wrote about hosting a simple static website on an Azure Storage Account. To enable a custom URL such as https://geertbaeke.wordpress.com, you can add Azure CDN. If you use the Verizon Premium tier, you can configure rules such as a http to https redirect rule. This is similar to hosting static…
azureStatic site hosting on Azure Storage with a custom domain and TLS
A while ago, I blogged about webhookd. It is an application, written in Go, that can easily convert a folder structure with shell scripts into webhooks. With the help of CertMagic, I modified the application to support Let’s Encrypt certificates. The application is hosted on an Azure Linux VM that uses a managed identity to…
azureUsing the Microsoft Face API to detect emotions in photos and video
⚠️ IMPORTANT: the Face API container was retired early 2021. The container image is not available anymore. In a previous post, I blogged about detecting emotions with the ONNX FER+ model. As an alternative, you can use cloud models hosted by major cloud providers such as Microsoft, Amazon and Google. Besides those, there are many…
aiDetecting emotions with FER+
In an earlier post, I discussed classifying images with the ResNet50v2 model. Azure Machine Learning Service was used to create a container image that used the ONNX ResNet50v2 model and the ONNX Runtime for scoring. Continuing on that theme, I created a container image that uses the ONNX FER+ model that can detect emotions in…
aiCreating a GPU container image for scoring with Azure Machine Learning
In a previous post, I discussed how you can add an existing Kubernetes cluster to an Azure Machine Learning workspace. Adding an existing cluster is necessary when the workspace does not support auto creation of a cluster. That is the case when you want to use the Standard_NC6s_v3 virtual machine image. I also used a…
aiAttaching Kubernetes clusters with NVIDIA V100 GPUs to Azure Machine Learning Service
Azure Machine Learning Service allows you to easily deploy compute for training and inference via a machine learning workspace. Although one of the compute types is Kubernetes, the workspace is a bit picky about the node VM sizes. I wanted to use two Standard_NC6s_v3 instances with NVIDIA Tesla V100 GPUs but that was not allowed.…
aiDeploying Azure Cognitive Services Containers with IoT Edge
Introduction Azure Cognitive Services is a collection of APIs that make your applications smarter. Some of those APIs are listed below: Vision: image classification, face detection (including emotions), OCR Language: text analytics (e.g. key phrase or sentiment analysis), language detection and translation To use one of the APIs you need to provision it in an…
analyticsDeploying Azure resources using webhookd
In the previous blog post, I discussed adding SSL to webhookd. In this post, I will briefly show how to use this solution to deploy Azure resources. To run webhookd, I deployed a small Standard_B1s machine (1GB RAM, 1 vCPU) with a system assigned managed identity. After deployment, information about the managed identity is available…
apiUsing certmagic to add SSL to webhookd
A while ago, I stumbled upon https://github.com/ncarlier/webhookd. It is a simple webhook server, written in Go, that can execute shell scripts. To use it, simply install it on a Linux box and execute it. By default, the executable looks at the ./scripts folder and maps each shell script to a URL you can call. It…
apiDraft: a simpler way to deploy to Kubernetes during development
If you work with containers and work with Kubernetes, Draft makes it easier to deploy your code while you are in the earlier development stages. You use Draft while you are working on your code but before you commit it to version control. The idea is simple: You have some code written in something like…
apiAdaptable IoT
On May 24, 2017 I gave a short partner session at Techorama, a technology event in Belgium for both developers and IT Pros. You can find the slides on SlideShare: https://www.slideshare.net/gbaeke/adaptable-iot Since it was a short session and a short slide deck, this post provides a bit more background information. First, what do I mean…
analyticsIoT Hub Device Twin and MQTT
When you connect to IoT Hub with MQTT directly, you need to connect with a ClientId, username and password. Those three values need to be set according to Azure IoT Hub specificiations: ClientId: use the IoT Hub deviceId Username: use {iothubhostname}/{deviceId}/api-version=2016-11-14 Password: use a SAS token When you connect with MQTT, you will notice it…
apiIoT Hub and Azure Time Series Insights
Azure Time Series Insights is a new service that makes it very easy to store and visualize time series data. In this blog post, we will create a dashboard that looks like the one below (click to enlarge): The dashboard has four sections: Query1: a heat map of events per device; in this case there…
analyticsMicroservices on Kubernetes: a simple example in Go
In the previous post, Getting started with Kubernetes on Azure, we talked about creating a Kubernetes cluster and deploying a couple of services. There are basically two services: Data: a service that exposes an endpoint to pick up data for an IoT device; you call it with http://service_endpoint:8080/data/devicename Device: a service that can be used…
apiGetting started with Kubernetes on Azure
As you may or may not know, at Xylos we have developed an IoT platform to support sensor networks of any kind. The back-end components are microservices running as containers on Rancher, a powerful and easy to use container orchestration tool. In the meantime, we are constantly evaluating other ways of orchestrating containers and naturally,…
azureParticle and Azure IoT Hub: forward events for storage and analysis
In a previous post about Partice published events, you have seen how to publish custom events to the Particle Cloud. Other devices or applications can subscribe to these events and act upon them. What if you want to do more and connect these events to custom applications? In that case, Particle has a couple of…
armIoT Hub Scaling
When you work with Azure IoT Hub, it is not always easy to tell what will happen when you reach the limits of IoT Hub and what to do when you reach those limits. As a reminder, recall that the scale of IoT Hub is defined by its tier and the number of units in…
azureAdding natural language to your Bot
In the last post, Bots in an IoT context, I created a very simple bot to request the air quality in a room. To change the room, you had to type change room and then type the room name when requested. It would be much nicer to be able to give commands like change room…
azureBots in an IoT context
At ThingTank (@thingtankBE), we are constantly looking to expose IoT data in different ways. A chat bot can be a great way to ask for device measurements or even instruct devices to perform actions. In this post, I will describe a bot that gets air quality data for a meeting room with Slack. I chose…
azureAzure Automation and PowerApps
One of our applications in our “test playground” is running some code in an Azure WebApp that needs to be restarted once in a while. Rather than trying to fix the underlying problem (no fun in that right?), I decided to create a small mobile app to restart the WebApp when needed. To make it…
azureUsing Azure Cognitive Services from Logic Apps
Azure’s Cognitive Services are very easy to use from within your own applications or more “code-less” solutions such as Azure Logic Apps. In this post, I will show a simple example of a Logic App that does sentiment analysis on incoming tweets. When the sentiment score is very high, an SMS is sent. To perform…
aiAzure Resource Manager REST API from Node
In our video about Fault Domains in Azure IaaSv2, we mentioned Azure Resource Manager and the use of templates to deploy IaaSv2 resources such as virtual machines in a fault domain, a load balancer, a public IP address and more. Azure Resource Manager also has a REST API that can be used from any language. This…
azureFault Domains in Azure IaaSv2
With the availability of IaaSv2 in Microsoft Azure, several new features are available that dramatically change the way resources are deployed and maintained. One profound change is the introduction of three fault domains for IaaSv2 virtual machines as opposed to two fault domains for IaaSv1 virtual machines. In the case of Azure, a fault domain…
azureWindows Azure Point-to-Site Networking
If you are having trouble with the point-to-site VPN configuration in Windows Azure, here are some tips about the procedure: Follow the procedure located at http://msdn.microsoft.com/en-us/library/windowsazure/dn133792.aspx for creating the virtual network and the gateway. When configuring the certificates for the VPN connection, first create the self-signed root certificate with the following command: makecert -sky exchange…
azureA quick look at Windows Azure IaaS
I played around a bit with Windows Azure IaaS to see how it stacks up against Amazon EC2. We use Amazon EC2 internally for some test and demo setups that don’t always have to be running. As a practical test, I wanted to install a Windows Server 2012 domain controller in a subnet of my…
azure