Category · 69 posts
kubernetes
Load balancing OpenAI API calls with LiteLLM
If you have ever created an application that makes calls to Azure OpenAI models, you know there are limits to the amount of calls you can make per minute. Take a look at the settings of a GPT model below: Above, the tokens per minute (TPM) rate limit is set to 60 000 tokens. This…
aiAKS Workload Identity Revisited
A while ago, I blogged about Workload Identity. Since then, Microsoft simplified the configuration steps and enabled Managed Identity, in addition to app registrations. But first, let’s take a step back. Why do you need something like workload identity in the first place? Take a look at the diagram below. Workloads (deployed in a container…
azureFirst steps with Crossplane
Image Source: crossplane.io Although Crossplane has been around for a while, I never got around to trying it. Crossplane has many capabilities. However, in this post, I will focus on the following aspects: Installing Crossplane on a Kubernetes cluster (AKS); you can install on a local cluster as well (e.g., k3s, kind, minikube, …) but…
automationLearn to use the Dapr authorization middleware
Based on a customer conversation, I decided to look into the Dapr middleware components. More specifically, I wanted to understand how the OAuth 2.0 middleware works that enables the Authorization Code flow. In the Authorization Code flow, an authorization code is a temporary code that a client obtains after being redirected to an authorization URL…
cloudPublish your AKS Ingress Controller over Azure Private Link
In a previous article, I wrote about the AKS Azure Cloud Provider and its support for Azure Private Link. In summary, the functionality allows for the following: creation of a Kubernetes service of type LoadBalancer via an annotation on the service, the Azure Cloud Provider creates an internal load balancer (ILB) instead of a public…
azureAzure Kubernetes Service and Azure Private Link Integration
If you have done any work with Azure, you have probably come across terms such as Azure Private Link Service (PLS) and Private Endpoints (PEs). To quickly illustrate what Azure PLS is, let’s look at a diagram from the Microsoft documentation for Azure SQL database: Above, Azure SQL Database uses Azure Private Link Service (PLS)…
azureDraft 2 and Ingress with Web Application Routing
If you read the previous article on Draft 2, we went from source code to deployed application in a few steps: az aks draft create: creates a Dockerfile and Kubernetes manifests (deployment and service manifests) az aks draft setup-gh: setup GitHub OIDC az aks draft generate-workflow: create a GitHub workflow that builds and pushes the…
azureTrying out Draft 2 on AKS
Sadly no post about good Belgian beer 🍺. Draft 2 is an open-source project that aims 🎯 to make things easier for developers that build Kubernetes applications. It can improve the inner dev loop, where the developers code and test their apps, in the following ways: Automate the creation of a Dockerfile Automate the creation…
cloudQuick Guide to Azure Container Apps
Now that Azure Container Apps (ACA) is generally available, it is time for a quick guide. These quick guides illustrate how to work with a service from the command line and illustrate the main features. Prerequisites All commands are run from bash in WSL 2 (Windows Subsystem for Linux 2 on Windows 11) Azure CLI…
azureQuick Guide to the Secret Store CSI driver for Azure Key Vault on AKS
Yesterday, I posted the Quick Guide to Kubernetes Workload Identity on AKS. This post contains a similar guide to enabling and using the Secret Store CSI driver for Azure Key Vault on AKS. All commands assume bash. You should have the Azure CLI installed and logged in to the subscription as the owner (because you…
azureQuick Guide to Kubernetes Workload Identity on AKS
IMPORTANT: the steps below are not relevant anymore; the steps in the quick guide have been updated; see https://github.com/gbaeke/quick-guides/blob/main/workload-identity/README.md for the correct steps. Some things that have changed: you can now use managed identities instead of app registrations; federated token configuration is at the managed identity level you do not need to install the webhook…
azureKubernetes Workload Identity with AKS
When you run a workload, no matter how simple or complex, you often need to access protected resources in both a secure and manageable way. Often, a resource’s security is integrated with an identity store. Azure resources, for instance, can be secured with roles assigned to Azure Active Directory (AAD) users, groups, or service principals.…
azureTaking Azure Container Apps for a spin
At Ignite November 2021, Microsoft released Azure Container Apps as a public preview. It allows you to run containerized applications on a serverless platform, in the sense that you do not have to worry about the underlying infrastructure. The underlying infrastructure is Kubernetes (AKS) as the control plane with additional software such as: Dapr: distributed…
azureKubernetes Blue-Green deployments with Argo Rollouts
In this post, we will take a look at 🟦/🟩 blue-green deployments in Kubernetes. With blue-green deployments, you deploy a new version of an application or service next to the live and stable version. After manual or automatic checks, you promote the new version to become the live version. Switching between versions is simply a…
cloudTrying out WebAssembly on Azure Kubernetes Service
Introduction In October 2021, Microsoft announced the public preview of AKS support for deploying WebAssembly System Interface (WASI) workloads in Kubernetes. You can read the announcement here. In short, that means we can run another type of workload on Kubernetes, besides containers! WebAssembly is maybe best known for the ability to write code with languages…
cloudDNS Options for Private Azure Kubernetes Service
When you deploy Azure Kubernetes Service (AKS), by default the API server is publicly made available. That means it has a public IP address and an Azure-assigned name that’s resolvable by public DNS servers. To secure access, you can use authorized IP ranges. As an alternative, you can deploy a private AKS cluster. That means…
azureA quick look at azure/kubelogin
I have talked about and demonstrated the use of kubelogin in previous posts and videos. Because I often get questions about logging on to Azure Kubernetes Services (AKS) integrated with Azure AD (AAD) in a non-interactive fashion, I decided to write this separate post about it. What is kubelogin? Kubelogin is a client-go credential plugin…
azureUsing Kyverno for Kubernetes Policies
In an earlier blogpost, I wrote about Kubernetes Policies on Azure Kubernetes Service with the Azure Policy add-on. The add-on installs Gatekeeper v3 on AKS, which relies on Open Policy Agent to define your policies. Open Policy Agent is a general cloud-native solution for policy-based control, which goes beyond Kubernetes. Defining custom policies for OPA…
containersAzure Policy for Kubernetes: Contraints and ConstraintTemplates
In one on my videos on my YouTube channel, I talked about Kubernetes authentication and used the image below: To secure access to the Kubernetes API server, you need to be authenticated and properly authorized to do what you need to do. The third mechanism to secure access is admission control. Simply put, admission control…
azureAzure Kubernetes Service authentication with Azure AD
If you have ever installed Kubernetes on your own hardware or you have worked with Kubernetes on the desktop with a tool like kind, you probably know that you need a config file that tells the Kubernetes CLI (kubectl) how to talk to the Kubernetes API server. It contains the address of the API server,…
azureAzure Policy: Kubernetes pod security baseline explained
When you deploy Azure Kubernetes Service (AKS) in an enterprise context, you will probably be asked about policies that can be applied to AKS for compliance and security. In this post, we will discuss Azure Policy for Kubernetes briefly and then proceed to explaining a group of policies that implement baseline security settings. Azure Policy…
azureDeploying Helm Charts with Azure DevOps pipelines
I recently uploaded a video to my YouTube channel about this topic: In this post, I will provide some more information about the pipelines. Again, many thanks to this post on which the solution is based. The YAML pipelines can be found in my go-template repository. The application is basically a starter template to create…
azureKubernetes Canary Deployments with GitHub Actions
In the previous post, we looked at some of the GitHub Actions you can use with Microsoft Azure. One of those actions is the azure/k8s-deploy action which is currently at v1.4 (January 2021). To use that action, include the following snippet in your workflow: The above snippet uses baked manifests from an earlier azure/k8s-bake action…
cicdA look at GitHub Actions for Azure and AKS deployments
In the past, I wrote about using Azure DevOps to deploy an AKS cluster and bootstrap it with Flux v2, a GitOps solution. In an older post, I also described bootstrapping the cluster with Helm deployments from the pipeline. In this post, we will take a look at doing the above with GitHub Actions. Along…
azureAKS Pod Identity with the Azure SDK for Go
In an earlier post, I wrote about the use of AKS Pod Identity (Preview) in combination with the Azure SDK for Python. Although that works fine, there are some issues with that solution: the container image is around 1GB, which is quite large (it is based on tiangolo/uvicorn-gunicorn-fastapi:python3.7) as expected, the image contains many vulnerabilities…
azureAzure AD pod-managed identities in AKS revisited
A long time ago, I wrote a blog post about assigning managed identities to pods in Azure Kubernetes Services (AKS) to authenticate to Azure Storage. The implementation was based on the aad-pod-identity project on GitHub. You can look at the walkthrough to see how it worked. Microsoft recently released a preview that enables you to…
azureAzure Key Vault Provider for Secrets Store CSI Driver
In the previous post, I talked about akv2k8s. akv2k8s is a Kubernetes controller that synchronizes secrets and certificates from Key Vault. Besides synchronizing to a regular secret, it can also inject secrets into pods. Instead of akv2k8s, you can also use the secrets store CSI driver with the Azure Key Vault provider. As a CSI…
automationCertificates with Azure Key Vault and Nginx Ingress Controller
Let’s face it. If you deploy web applications and APIs of any sort, you need certificates. If you have been long enough in IT, there’s just no escape! In this article, we will take a look at getting a certificate from Azure Key Vault to Azure Kubernetes service. Next, we will use that certificate with…
containersDeploy and bootstrap your Kubernetes cluster with Azure DevOps and GitOps
A while ago, I published a post about deploying AKS with Azure DevOps with extras like Nginx Ingress, cert-manager and several others. An Azure Resource Manager (ARM) template is used to deploy Azure Kubernetes Service (AKS). The extras are installed with Helm charts and Helm installer tasks. I mainly use it for demo purposes but…
automationAn introduction to Flux v2
If you have read my blog and watched my Youtube channel, you know I have worked with Flux in the past. Flux, by weaveworks, is a GitOps Kubernetes Operator that ensures that your cluster state matches the desired state described in a git repository. There are other solutions as well, such as Argo CD. With…
automationDocker without Docker: a look at Podman
I have been working with Docker for quite some time. More and more however, I see people switching to tools like Podman and Buildah and decided to give that a go. I installed a virtual machine in Azure with the following Azure CLI command: Just replace RESOURCEGROUP, VMNAME and PASSWORD with the values you want…
azureAzure Application Gateway and Cloudflare
I often work with customers that build web applications on cloud platforms like Azure, AWS or Digital Ocean. The web application is usually built by a third party that specializes in e-Commerce, logistics or industrial applications in a wide range of industries. More often than not, these applications use CloudFlare for DNS, caching, and security.…
azureHashiCorp Waypoint Image Tagging
Recently (October, 2020) I posted an introduction to HashiCorp Waypoint on my YouTube channel. It shows how to build, push, deploy and release applications to Kubernetes with a single waypoint up command. If you want to check out that video first, see below ⬇⬇⬇ After watching that video, it should be clear that you drive…
cicdUsing the Dapr InfluxDB component
A while ago, I created a component that can write to InfluxDB 2.0 from Dapr. This component is now included in the 0.10 release. In this post, we will briefly look at how you can use it. If you do not know what Dapr is, take a look at https://dapr.io. I also have some videos…
azureDapr Service Invocation between an HTTP Python client and a GRPC Go server
Recently, I published several videos about Dapr on my Youtube channel. The videos cover the basics of state management, PubSub and service invocation. The Getting Started with state management and service invocation: Let’s take a closer look at service invocation with HTTP, Python and Node. Service Invocation with HTTP The services you write (here Service…
azureGetting started with Consul on Kubernetes
Although I have heard a lot about Hashicorp’s Consul, I have not had the opportunity to work with it and get acquainted with the basics. In this post, I will share some of the basics I have learned, hopefully giving you a bit of a head start when you embark on this journey yourself. Want…
azureProgressive Delivery on Kubernetes: what are your options?
If you have ever deployed an application to Kubernetes, even a simple one, you are probably familiar with deployments. A deployment describes the pods to run, how many of them to run and how they should be upgraded. That last point is especially important because the strategy you select has an impact on the availability…
cloudAzure Security Center and Azure Kubernetes Service
Quick post and note to self today… Azure Security Center checks many of your resources for vulnerabilities or attacks. For a while now, it also does so for Azure Kubernetes Service (AKS). In my portal, I saw the following: There are many possible alerts. These are the ones I got: The first one, for instance,…
azureGiving Argo CD a spin
If you have followed my blog a little, you have seen a few posts about GitOps with Flux CD. This time, I am taking a look at Argo CD which, like Flux CD, is a GitOps tool to deploy applications from manifests in a git repository. Don’t want to read this whole thing? There are…
automationKustomize and Flux
Flux has a feature called manifest generation that works together with Kustomize. Instead of just picking YAML files from a git repo and applying them, customisation is performed with the kustomize build command. The resulting YAML then gets applied to your cluster. If you don’t know how customisation works (without Flux), take a look at…
azureA quick tour of Kustomize
Image above from: https://kustomize.io/ When you have to deploy an application to multiple environments like dev, test and production there are many solutions available to you. You can manually deploy the app (Nooooooo! 😉), use a CI/CD system like Azure DevOps and its release pipelines (with or without Helm) or maybe even a “GitOps” approach…
automationCreating a Kubernetes operator on Windows and WSL
I have always wanted to create a Kubernetes operator with the operator framework and tried to give that a go on my Windows 10 system. Note that the emphasis is on creating an operator, not necessarily writing a useful one 😁. All I am doing is using the boilerplate that is generated by the framework.…
containersCheck your yaml files with kubeval and GitHub Actions
In the previous post, I deployed AKS, Nginx, External DNS, Helm Operator and Flux with a YAML pipeline in Azure DevOps. Flux got linked to a git repo that contains a bunch of yaml files that deploy applications to the cluster but also configures Azure Monitor. Flux essentially synchronizes your cluster with the configuration in…
containersDeploy AKS with Nginx, External DNS, Helm Operator and Flux
A while ago, I blogged about an Azure YAML pipeline to deploy AKS together with Traefik. As a variation on that theme, this post talks about deploying AKS together with Nginx, External DNS, a Helm Operator and Flux CD. I blogged about Flux before if you want to know what it does. I added the…
azureTrying Civo’s Kubernetes Service
In a previous post I talked about k3sup, a tool to easily install k3s on any system available over SSH. If you don’t know what k3s is, it’s a lightweight version of Kubernetes. It also runs on ARMv7 and ARM64 processors. That means it’s also compatible with a Raspberry Pi. If I am not mistaken,…
containersTrying out k3sup
k3sup is a utility created by Alex Ellis to easily deploy k3s to any local or remote VM. In this post, I am giving the tool a try on a Civo cloud Ubuntu VM. You can of course pick any cloud provider you want or use a local system. Deploying a VM on Civo Cloud…
containersGitOps with Weaveworks Flux – Installing and Updating Applications
In a previous post, we installed Weaveworks Flux. Flux synchronizes the contents of a git repository with your Kubernetes cluster. Flux can easily be installed via a Helm chart. As an example, we installed Traefik by adding the following yaml to the synced repository: apiVersion: helm.fluxcd.io/v1 kind: HelmRelease metadata: name: traefik namespace: default annotations: fluxcd.io/ignore:…
containersGitOps with Weaveworks Flux
If you have ever deployed applications to Kubernetes or other platforms, you are probably used to the following approach: developers check in code which triggers CI (continuous integration) and eventually results in deployable artifacts a release process deploys the artifacts to one or more environments such as a development and a production environment In the…
automationThe basics of meshing Traefik 2.0 with Linkerd
A while ago, I blogged about Linkerd 2.x. In that post, I used a simple calculator API, reachable via an Azure Load Balancer. When you look at that traffic in Linkerd, you see the following: Above, you do not see this is Azure Load Balancer traffic. The traffic reaches the meshed service via the Azure…
apiGiving linkerd a spin
A while ago, I gave linkerd a spin. Due to vacations and a busy schedule, I was not able to write about my experience. I will briefly discuss how to setup linkerd and then deploy a sample service to illustrate what it can do out of the box. Let’s go! Wait! What is linkerd? linkerd…
apiDeploy AKS and Traefik with an Azure DevOps YAML pipeline
This post is a companion to the following GitHub repository: https://github.com/gbaeke/aks-traefik-azure-deploy. The repository contains ARM templates to deploy an AD integrated Kubernetes cluster and an IP address plus a Helm chart to deploy Traefik. Traefik is configured to use the deployed IP address. In addition to those files, the repository also contains the YAML pipeline,…
cloudInspecting Web Application Firewall logs
In some of my previous posts, I talked about Azure Front Door and Web Application Firewall policies to protect a workload like one or more APIs running on Kubernetes or App Service. Although I enabled the Web Application Firewall policies, I did not show what happens when the rules are triggered. Let’s take a look…
apiSecuring your API with Kong and CloudFlare
In the previous post, we looked at API Management with Kong and the Kong Ingress Controller. We did not care about security and exposed a sample toy API over a public HTTP endpoint that also required an API key. All in the clear, no firewall, no WAF, nothing… 👎👎👎 In this post, we will expose…
apiAPI Management with Kong Ingress Controller on Kubernetes
In previous posts, I wrote about Azure API Management in combination with APIs hosted on Kubernetes: API Management with private APIs: requires API Management with virtual network integration because the APIs are reachable via an internal ingress on the Azure virtual network; use the premium tier 💰💰💰 API Management with public APIs: does not require…
apiAzure API Management with public APIs on Kubernetes
In my previous blog post, I looked at Azure API Management in combination with private APIs hosted on Kubernetes. The APIs were exposed via Traefik and an internal load balancer. To make that scenario work, the Azure API Management premium SKU is required, which is quite costly. This post describes another approach where the APIs…
apiQuick overview of Traefik Ingress Controller Installation
This post is mainly a note to self 📝📝📝 that describes a quick way to deploy a Kubernetes Ingress Controller with Traefik. There is also a video version: We will install Traefik with Helm and I assume the cluster has rbac enabled. If you deploy clusters with AKS, that is the default although you can…
containersA look at Windows containers on AKS
Now that the public preview of Windows containers on AKS is available, let’s look at the basics. You need a couple of things to get started, including a couple of subscription-wide settings. I recommend using a subscription that is not used to roll out production AKS clusters. Make sure the Azure CLI (az) is homed…
containersA first look at Rancher Rio
As explained on https://github.com/rancher/rio, Rancher Rio is a MicroPaaS that can be layered on top of any standard Kubernetes cluster. It makes it easier to deploy, scale, version and expose services. In this post, we will take a quick look at some of its basic capabilities. To follow along, make sure you have a Kubernetes…
cloudStreamlined Kubernetes Development with Draft
A longer time ago, I wrote a post about draft. Draft is a tool to streamline your Kubernetes development experience. It basically automates, based on your code, the creation of a container image, storing the image in a registry and installing a container based on that image using a Helm chart. Draft is meant to…
apiUpdate on restricting egress traffic on Azure Kubernetes Service
In an earlier post, I discussed the combination of Azure Firewall and Azure Kubernetes Service (AKS) to secure ingress and egress AKS traffic. A few days ago, Microsoft added documentation that describes the ports and URLs to allow when you route traffic through Azure Firewall or a virtual appliance. Some of the allowed ports and…
azureAzure Kubernetes Service and Azure Firewall
Deploying Azure Kubernetes Service (AKS) is, like most other Kubernetes-as-a-service offerings such as those from DigitalOcean and Google, very straightforward. It’s either a few clicks in the portal or one or two command lines and you are finished. Using these services properly and in a secure fashion is another matter though. I am often asked…
azureCloud Run on Google Kubernetes Engine
In this short post, we will take a look at Cloud Run on Google Kubernetes Engine (GKE). To get this to work, you will need to deploy a Kubernetes cluster. Make sure you use nodes with at least 2 vCPUs and 7.5 GB of memory. Take a look here for more details. You will notice…
containersHosting an Angular app in Kubernetes
We recently had to deploy an Angular application to Kubernetes in three different environments: development, acceptance and production. The application is not accessed via the browser directly. Instead, it’s accessed via a Microsoft Office add-in. The next sections will provide you with some tips to make this work. In practice, I do not recommend hosting…
apiKubernetes on DigitalOcean
Image: from DigitalOcean’s website Yesterday, I decided to try out DigitalOcean’s Kubernetes. As always with DigitalOcean, the solution is straightforward and easy to use. Similarly to Azure, their managed Kubernetes product is free. You only pay for the compute of the agent nodes, persistent block storage and load balancers. The minimum price is 10$ per…
automationAttaching Kubernetes clusters with NVIDIA V100 GPUs to Azure Machine Learning Service
Azure Machine Learning Service allows you to easily deploy compute for training and inference via a machine learning workspace. Although one of the compute types is Kubernetes, the workspace is a bit picky about the node VM sizes. I wanted to use two Standard_NC6s_v3 instances with NVIDIA Tesla V100 GPUs but that was not allowed.…
aiDraft: a simpler way to deploy to Kubernetes during development
If you work with containers and work with Kubernetes, Draft makes it easier to deploy your code while you are in the earlier development stages. You use Draft while you are working on your code but before you commit it to version control. The idea is simple: You have some code written in something like…
apiCommunication between microservices in Kubernetes with Go Micro
In this post, we continue the story we started with two earlier posts: Getting started with Kubernetes on Azure Microservices on Kubernetes: a simple example in Go In the previous post, I described a very simple service written with the help of Go Micro. It exposes an RPC call Get that retrieves a device from a…
apiMicroservices on Kubernetes: a simple example in Go
In the previous post, Getting started with Kubernetes on Azure, we talked about creating a Kubernetes cluster and deploying a couple of services. There are basically two services: Data: a service that exposes an endpoint to pick up data for an IoT device; you call it with http://service_endpoint:8080/data/devicename Device: a service that can be used…
apiGetting started with Kubernetes on Azure
As you may or may not know, at Xylos we have developed an IoT platform to support sensor networks of any kind. The back-end components are microservices running as containers on Rancher, a powerful and easy to use container orchestration tool. In the meantime, we are constantly evaluating other ways of orchestrating containers and naturally,…
azure