Cloud Native Club – Kubernetes Policies

Last week I had the pleasure of being the guest of the fifth episode of the Cloud Native Club run by my former colleague Robin-Manuel Thiel. We talked about the topic Kubernetes policies covering the Open Policy Agent, Gatekeeper and Azure Policy for Kubernetes. The Cloud Native Club format is in German and hence no English version of the recording is available. -> Folge 5: Kubernetes Policies Read more [...]

Evaluating Gatekeeper policies with the Rego Playground

Writing and evaluating Gatekeeper policies can be hard sometimes. Especially the testing part of a newly created policy. There are different approaches to tackle this like having a dedicated test Kubernetes cluster for it. An alternative we used was a script starting a single node KinD cluster on Docker for Mac and installing Gatekeeper onto it. The advantage of this approach you see how the Read more [...]

Increase your application availability with pod anti-affinity settings in Azure Kubernetes Service

This is the second blog post of a series of posts covering the topic about increasing the application availability on Azure Kubernetes Services / Kubernetes. Today we cover the pod anti-affinity setting. What is the pod anti-affinity? In the first post of the series, I talked about the PodDisruptionBudget. The PDB guarantees that a certain amount of your application pods is available. Defining Read more [...]

Azure Kubernetes Service – Azure RBAC for Kubernetes authorization

At this year’s Ignite conference Microsoft announced the next major step of integrating Azure functionality into AKS: Azure RBAC for Kubernetes authorization. -> https://docs.microsoft.com/en-us/azure/aks/manage-azure-rbac Azure RBAC for Kubernetes authorization lets you assign built-in or custom roles onto the Azure Kubernetes Service object in Azure. So, you do not have to create Kubernetes Read more [...]

Increase your application availability with a PodDisruptionBudget on Azure Kubernetes Service

This is the first blog post of a series of posts covering the topic about increasing the application availability on Azure Kubernetes Service / Kubernetes. Today we cover the PodDisruptionBudget. What is a PodDisruptionBudget? A PDB is an additional Kubernetes object that is deployed beside your Deployment, ReplicaSet or StatefulSet increasing your application’s availability. This is done by Read more [...]

Azure Reservations and the RBAC dilemma

Cloud computing underlies a constant change. Things you take today for granted are different tomorrow. Surprisingly, even designs and implementations on the same platform can be different. Welcome to today’s topic of Azure Reservations and the RBAC dilemma. As I have written in my brief introduction, designs and implementations can be different. Azure RBAC is one example here. Being the owner Read more [...]

Troubleshooting Azure Kubernetes Service tunnel component issues

In Azure Kubernetes Service Microsoft manages the AKS control plane (Kubernetes API server, scheduler, etcd, etc.) for you. The AKS control plane interacts with the AKS nodes in your subscription via a secure connection that is established through the tunnelfront / aks-link component. -> https://docs.microsoft.com/en-us/azure/aks/concepts-clusters-workloads#kubernetes-cluster-architecture As Read more [...]

Automate taking backups from Azure disks attached to Azure Kubernetes Service

At the beginning of 2019 I wrote a blog post about taking backups from Azure disks attached to an Azure Kubernetes Service cluster. -> https://www.danielstechblog.io/taking-backups-from-azure-disks-attached-to-aks-via-azure-automation/ Since then, some things changed. Azure Function PowerShell support went into public preview in April 2019 and the AzTable (AzureRmStorageTable) module I use Read more [...]

Azure Policy for Azure Kubernetes Service

In June I already covered Azure Policy for Kubernetes in a blog post. -> https://www.danielstechblog.io/using-azure-policy-for-kubernetes/ Back then Azure Policy for AKS was in public preview. At this year’s Microsoft Ignite Azure Policy for AKS went GA. -> https://azure.microsoft.com/en-us/updates/ga-policy-addon-for-azure-kubernetes-service/ There have been some significant changes Read more [...]

Unix time format in Azure Resource Manager templates

The Unix time format is represented in seconds elapsed since 01.01.1970 UTC. So, it is different from the standard time format we are used to. Depending on the Azure service some attributes in the Azure API / ARM template require the Unix time format especially Azure Key Vault keys and secrets. Those ones have two attributes the not before (nbf) and expiry (exp) date requiring the Unix time format. -> Read more [...]