Tag: Container
-
Switching to Istio CNI plugin on Azure Kubernetes Service
You might question yourself, why the switch to the Istio CNI plugin might be useful? Istio uses, and other services meshes too, an init container to adjust the iptables rules for redirecting network traffic to/from the sidecar proxy container. The init container uses NET_ADMIN and NET_RAW capabilities to do the iptables changes and thus has…
-
Using Azure Resource Graph to show ASC container image scan findings
In my previous blog post I showed you how to connect your Azure Container Registries with Azure Security Center. -> https://www.danielstechblog.io/connecting-azure-container-registry-with-azure-security-center/ Today we talk about how to receive the scan results via Azure Resource Graph instead of using the Security Center UI path. You can submit your queries against the Resource Graph via the Azure…
-
Connecting Azure Container Registry with Azure Security Center
Back in March Microsoft released the container image scanning solution in the Azure Security Center for the Azure Container Registry. -> https://azure.microsoft.com/en-us/updates/vulnerability-scanning-for-images-in-azure-container-registry-is-now-generally-available/ The container image scanning solution is powered by Qualys and seamlessly integrated into the Security Center UI. Connecting your Azure Container Registries with the Security Center requires ASC running in the Standard Tier.…
-
High available control plane with Istio 1.5 on Azure Kubernetes Service
Back in January I have written a blog post about installing the Istio control plane on AKS in HA mode. -> https://www.danielstechblog.io/install-a-high-available-istio-control-plane-on-azure-kubernetes-service/ Since the release of Istio 1.5 this month the overall architecture of the Istio control plane has changed. -> https://istio.io/news/releases/1.5.x/announcing-1.5/#introducing-istiod With the introduction of Istiod the number of deployed pods get dramatically reduced,…
-
Updated maximum nodes limit – Azure Function App – AKS Azure CNI IP address calculation
Just a short information about the update I have done for the Azure Function App doing the AKS Azure CNI IP address calculation. Since the last update there has been a change to the maximum nodes per cluster limit supported by AKS. Maximum nodes per cluster (only with multiple node pools and VMSS): 1000 ->…
-
Combine istioctl commands with kubectl-select
Since working with Istio I stumbled a couple of times over some of the istioctl commands that require to select a specific pod or service. Some of these commands are istioctl… …dashboard controlz {Istio pilot pod name} …dashboard envoy {pod name} …experimental describe service {service name} …experimental metrics {service name} …proxy-config bootstrap {pod name} For…