Unofficial Azure Club (Page 2)

Subscribe

Azure Hub-Spoke, Hub-Hub Setup

Azure Hub-Spoke, Hub-Hub Setup

Thsoe setups are servered as architecture reference for network design in Azure. A simple hub spoke setup with NVA Another hub spoke setup with virtual network gateway Hub-hub vnet setup with NVA Hub-hub plus on-premise network setup with VPN gateway

Azure load balancer SNAT behavior explained - Annotations to tcp port numbers reused, ACK with wrong sequence number plus RST from 3-way handshake and SNAT port exhaustion

Load Balancer Featured

Azure load balancer SNAT behavior explained - Annotations to tcp port numbers reused, ACK with wrong sequence number plus RST from 3-way handshake and SNAT port exhaustion

This article will address azure external load balancer and focus on SNAT, explains a few of behaviors seen from network trace, provides a few of suggestions for application when it is behind of load balancer and requires SNAT.

Cheap Visual Studio Code(VSCode) Online Solution

VSCode Featured

Cheap Visual Studio Code(VSCode) Online Solution

Cheap Visual Studio Code(VSCode) Online Solution

Script to Trace Iptables Packet Flow

Script to Trace Iptables Packet Flow

Script to trace iptables packet flow

Ubuntu Generate Core Dump On Fly

Ubuntu Generate Core Dump On Fly

systemctl disable apport.service /etc/security/limits.conf * soft core unlimited * hard core unlimited /etc/sysctl.conf kernel.core_pattern=/cores/core.%e.%p.%h.%t mkdir /cores chmod a+rwx /cores sysctl -p int main() { int *p; return *p; } gcc -o t t.c .\t Coredump will be generated

Nginx Ingress Controller Debugging - Print Http Raw Header

Nginx Ingress Controller Debugging - Print Http Raw Header

1. kubectl exec YOUR_NGINX_INGRESS_CONTROLLER_POD -it -- cat /etc/nginx/template/nginx.tmpl > nginx.tmpl 2. Open nginx.tmpl, add below code block after location {{ $path }} { header_filter_by_lua_block { local h = ngx.req.get_headers() local request_headers_all = "" for k, v in pairs(h)

Useful Kubernetes Tricks

Kubernetes Featured

Useful Kubernetes Tricks

Find which RoleBinding/ClusterRoleBinding is related to a ServiceAccount kubectl get clusterrolebindings -o json | jq -r ' .items[] | select( .subjects // [] | .[] | [.kind,.namespace,.name] == ["ServiceAccount","kube-system","node-controller"] ) | .metadata.name' kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.subjects // [] | .[] | [.name] == [""] ) | .metadata.name' kubectl get rolebindings --all-namespaces -o

Kubernetes Cloud Native Monitoring with TICK & Prometheus - Up and Running

Kubernetes Cloud Native Monitoring with TICK & Prometheus - Up and Running

0 Introduction This post doesn't intend to introduce prometheus or influxdb, it serves as a reference for building up a monitoring/logging system in kubernetes with open source softwares. The monitoring/logging/alerting system composes of 4 open sources softwares, refer to diagram below 1. Fluentbit [https://fluentbit.io/] is

Articles I Collected

Articles I Collected

Articles * Analyzing .NET Core memory on Linux with LLDB [http://codeblog.dotsandbrackets.com/net-core-memory-linux/] * iptables Tips & Tricks [https://serverfault.com/questions/245711/iptables-tips-tricks] * Using nginx-ingress controller to restrict access by IP (ip whitelisting) for a service deployed to a Kubernetes (AKS) cluster [https://medium.com/@maninder.bindra/using-nginx-ingress-controller-to-restrict-access-by-ip-ip-whitelisting-for-a-service-deployed-to-bd5c86dc66d

Kubernetes Services and Iptables

Kubernetes Featured

Kubernetes Services and Iptables

0 Prerequisites and Prework This post only focuses on how kubernetes leverages iptables to implement its service mode. Per official doc Services [https://kubernetes.io/docs/concepts/services-networking/service/] > A Kubernetes Service is an abstraction which defines a logical set of Pods and a policy by which to access them

Kubernetes Horizontal Pod Autoscaler

Kubernetes Horizontal Pod Autoscaler

This post just serves as a quickstart for kubernetes horizontal pod autosacler testing purpose, here are the steps git clone https://github.com/Azure-Samples/azure-voting-app-redis.git cd azure-voting-app-redis kubectl apply -f azure-vote-all-in-one-redis.yaml kubectl autoscale deployment azure-vote-front --cpu-percent=10 --min=1 --max=10 After finish above commands, you should have

Implement Azure Role Assignment by AAD Application with Powershell Script

Implement Azure Role Assignment by AAD Application with Powershell Script

Implement Azure Role Assignment by AAD Application with Powershell Script

Pod Security Policy Explained By Examples

Kubernetes Featured

Pod Security Policy Explained By Examples

Pod security policy enables fine-grained authorization of pod creation and updates but it also has some mysterious things behind, this article gives more insight about how it works.

Protect Kubernetes Webapps with Azure Active Directory(AAD) Authentication by Using oauth2_proxy

Protect Kubernetes Webapps with Azure Active Directory(AAD) Authentication by Using oauth2_proxy

Adding authentication to webapps sometimes is a challenging task, requires knowledge and coding for user registration, login and authentication. Specially if you are a kubernetes cluster admin, you need to take extremely care of publishing your website/web service to internet since any malicious users can access the frontend and

Kubernetes Verbose Logging

Kubernetes Verbose Logging

Kubectl Verbose Logging kubectl -v=10 get pod Kubernetes Core Components Logging From /etc/kubernetes/manifests, edit *.yaml files, add -v=10 switch

Running a K8S Cluster in Multiple Zones on Azure with Calico and IPVS

Kubernetes Featured

Running a K8S Cluster in Multiple Zones on Azure with Calico and IPVS

This post will explain how to deploy a kubernetes cluster in multiple zones on Azure with detailed steps, together with enabling IPVS for high performance and Calico network policy for secure network connectivity. We will explore some concepts in multiple zones cluter and show how they work as well.

Yet another way to troubleshoot K8S applications

Kubernetes Featured

Yet another way to troubleshoot K8S applications

There are plenty of articles explains how to debug K8S applications, for example * Troubleshoot Applications [https://kubernetes.io/docs/tasks/debug-application-cluster/debug-application/] * Connect with SSH to Azure Kubernetes Service (AKS) cluster nodes for maintenance or troubleshooting [https://docs.microsoft.com/en-us/azure/aks/ssh] Due to the nature of container's

How do I host this website in Azure K8S cluster

How do I host this website in Azure K8S cluster

Explain how I built up my website from Azure hosted K8S cluster

Flannel Networking Demystify

Flannel Featured

Flannel Networking Demystify

In my previous article Deploy a Ubuntu Based Flannel K8S Cluster in Azure with ARM Template and Kubeadm [https://msazure.club/deploy-a-ubuntu-based-flannel-k8s-cluster-in-azure-with-arm-template-and-kubeadm/] , I provided an Azure ARM template to deploy a flannel networking K8S cluster on Azure. But how flannel networking works, in this article we will discuss a little

Connect to Azure AD from Azure Functions with Powershell Script

Connect to Azure AD from Azure Functions with Powershell Script

There are certain things to overcome to use Connect-AzureAD from powershell script under azure functions by authenticating with certificate. This article explains how to do it. 0 Prerequisites Azure functions has been deployed already. 1 Generate Certificate and Service Principal To run Azure AD powershell commands, we need to connect

Addendum of Azure Load Balancer and NSG Rules

Addendum of Azure Load Balancer and NSG Rules

1 AllowAzureLoadBalancerInBound NSG Rule When an IaaS VM get deployed in Azure, there will be a default NSG rule AllowAzureLoadBalancerInBound created You might wonder what's the meaning of this NSG rule? Well, basically this rule means allow "Azure Load Balancer Health Probe". When an Azure Load Balancer get created, it

Persistent SSH Tunneling

Persistent SSH Tunneling

Imaging the sitaution that we need to access services behind NAT/firewall, how to achieve it? The answer is reverse SSH tunneling. Reverse SSH is a technique through which you can access systems that are behind a firewall from the outside world. In that case, the server behind NAT/firewall

Docker Macvlan Demystify

Macvlan Featured

Docker Macvlan Demystify

In this article, we are going to disucss a little bit about Macvlan and setup a Macvlan lab environment under Hyper-V host with 3 Ubuntu 16.04 VMs. 0 What is Macvlan Refer to Macvlan Driver [https://github.com/docker/libnetwork/blob/master/docs/macvlan.md] > The Macvlan driver provides

Using Lets Encrypt to Sign a Certificate

Using Lets Encrypt to Sign a Certificate

First of all, a private key is needed before genreate a signing request. Either use openssl openssl genrsa -out ~/domain.com.ssl/domain.com.key 2048 openssl req -new -sha256 -key ~/domain.com.ssl/domain.com.key -out ~/domain.com.ssl/domain.com.csr or use Azure key vault specially

Deploy a Ubuntu Based Flannel K8S Cluster in Azure with ARM Template and Kubeadm

Deploy a Ubuntu Based Flannel K8S Cluster in Azure with ARM Template and Kubeadm

The infomation migth be outdated here as acs-engine adds support for Flannel recently with PR 2967 [https://github.com/Azure/acs-engine/pull/2967] However, if you want to gain more control on your kubernetes cluster in Azure, in our case, by using kubeadm, this article still applies. 0. Prerequisites * Azure