Tag Archives: Security

Azure Policy for Kubernetes – custom policies on Azure Arc enabled Kubernetes

On September 1st Microsoft announced the public preview of the custom policy support for Azure Policy for AKS. -> https://azure.microsoft.com/en-us/updates/custom-aks-policy-support-now-public-preview/ I am already using the public preview on my AKS cluster and was curious about if this would work as well with Azure Arc enabled Kubernetes. The short answer is yes, but with some minor adjustments. Configuration First Read more [...]

Cloud Native Club – Kubernetes Policies

Last week I had the pleasure of being the guest of the fifth episode of the Cloud Native Club run by my former colleague Robin-Manuel Thiel. We talked about the topic Kubernetes policies covering the Open Policy Agent, Gatekeeper and Azure Policy for Kubernetes. The Cloud Native Club format is in German and hence no English version of the recording is available. -> Folge 5: Kubernetes Policies Read more [...]

Evaluating Gatekeeper policies with the Rego Playground

Writing and evaluating Gatekeeper policies can be hard sometimes. Especially the testing part of a newly created policy. There are different approaches to tackle this like having a dedicated test Kubernetes cluster for it. An alternative we used was a script starting a single node KinD cluster on Docker for Mac and installing Gatekeeper onto it. The advantage of this approach you see how the Read more [...]

Azure Kubernetes Service – Azure RBAC for Kubernetes authorization

At this year’s Ignite conference Microsoft announced the next major step of integrating Azure functionality into AKS: Azure RBAC for Kubernetes authorization. -> https://docs.microsoft.com/en-us/azure/aks/manage-azure-rbac Azure RBAC for Kubernetes authorization lets you assign built-in or custom roles onto the Azure Kubernetes Service object in Azure. So, you do not have to create Kubernetes Read more [...]

Azure Policy for Azure Kubernetes Service

In June I already covered Azure Policy for Kubernetes in a blog post. -> https://www.danielstechblog.io/using-azure-policy-for-kubernetes/ Back then Azure Policy for AKS was in public preview. At this year’s Microsoft Ignite Azure Policy for AKS went GA. -> https://azure.microsoft.com/en-us/updates/ga-policy-addon-for-azure-kubernetes-service/ There have been some significant changes Read more [...]

Trigger an on-demand Azure Policy compliance evaluation scan

Azure Policy evaluates resource compliance automatically every 24 hours for already assigned policies or initiatives. New policy or initiative assignments start the evaluation after the assignment has been applied to the defined scope which might take up to 30 minutes. What might be a hidden gem to some of you is the case that you can trigger an on-demand compliance evaluation scan whenever Read more [...]

Using distroless images in Istio on Azure Kubernetes Service

Looking at Docker Hub Istio provides the option using distroless images since version 1.3.0. As it is always a good idea on a Kubernetes cluster to reduce the attack surface, especially when running a managed Kubernetes cluster like Azure Kubernetes Service, using distroless images is one option of it. Per default Istio does not use the distroless image versions. So, you need to opt in for Read more [...]

Upgrading the node image of an Azure Kubernetes Service cluster

Last year I have written a shell script to update the VMSS base image of an Azure Kubernetes Service cluster. -> https://www.danielstechblog.io/updating-the-base-image-of-a-vmss-based-aks-cluster/ -> https://www.danielstechblog.io/aks-vmss-base-image-update-script-multiple-node-pool-support/ As I am using the VMSS API and not the AKS API it was not an officially supported way to update Read more [...]

Using Azure Policy for Kubernetes

In my last blog post I mentioned that the next topic is about Azure Policy in combination with Azure Arc enabled Kubernetes. I decided to write about Azure Policy for Kubernetes instead covering Azure Kubernetes Service and Azure Arc enabled Kubernetes. As Azure Policy for Kubernetes is based on the Open Policy Agent Gatekeeper implementation, I will also highlight the difference between the Read more [...]

Using Azure Resource Graph to show ASC container image scan findings

In my previous blog post I showed you how to connect your Azure Container Registries with Azure Security Center. -> https://www.danielstechblog.io/connecting-azure-container-registry-with-azure-security-center/ Today we talk about how to receive the scan results via Azure Resource Graph instead of using the Security Center UI path. You can submit your queries against the Resource Graph Read more [...]