I recently had the honor of being a guest on the “Lisa at the Edge” Podcast. Lisa is a Microsoft Hybrid Cloud Strategist and an influencer in the hybrid cloud community based out of Scotland. She runs a blog and this year she started a popular podcast.
On Lisa’s podcast, she covers Careers in Tech and Microsoft Hybrid Cloud and a range of other topics with experts across the tech community.
This is an episode you don’t want to miss. This was one of the most entertaining podcasts I have been on. It took some interesting turns in regards to topics and very engaging. In the podcast episode Lisa and I talk about:
Evolving your career as technology evolves
Transformation of IT dept to Strategic Business Partner
I am also happy to announce that I was a tech reviewer on the first study guide for this cert titled “HashiCorp Terraform Certified Associate PreparationGuide“. You can find it here: https://leanpub.com/terraform-certified/. This guide was authored by fellow Microsoft MVP Ned Bellavance and Microsoft CSA Adin Ermie. Huge thanks guys for letting me be a part of this project!
If you work with Terraform I hope you get certified and be sure to use the study guide!
In Kubernetes, you have a container or containers running as a pod. In front of the pods, you have something known as a service. Services are simply an abstraction that defines a logical set of pods and how to access them. As pods move around the service that defines the pods it is bound to keeps track of what nodes the pods are running on. For external access to services, there is typically an Ingress controller that allows access from outside of the Kubernetes cluster to a service. An ingress defines the rules for inbound connections.
Microsoft has had an
Application Gateway Ingress Controller for Azure Kubernetes Service AKS in
public preview for some time and recently released for GA. The Application
Gateway Ingress Controller (AGIC) monitors the Kubernetes cluster for ingress
resources and makes changes to the specified Application Gateway to allow
This allows you to leverage the Application Gateway service in Azure as the entry into your AKS cluster. In addition to utilizing the Application Gateway standard set of functionality, the AGIC uses the Application Gateway Web Application Firewall (WAF). In fact, that is the only version of the Application Gateway that is supported by the AGIC. The great thing about this is that you can put Application Gateways WAF protection in front of your applications that are running on AKS.
This blog post is not a detailed deep dive into AGIC. To learn more about AGIC visit this link: https://azure.github.io/application-gateway-kubernetes-ingress. In this blog post, I want to share a script I built that deploys the AGIC. There are many steps to deploying the AGIC and I figured this is something folks will need to deploy over and over so it makes sense to make it a little easier to do. You won’t have to worry about creating a managed identity, getting various id’s, downloading and updating YAML files, or installing helm charts. Also, this script will be useful if you are not familiar with sed and helm commands. It combines PowerShell, AZ CLI, sed, and helm code. I have already used this script about 10 times myself to deploy the AGIC and boy has it saved me time. I thought it would be useful to someone out there and wanted to share it.
I typically deploy RBAC enabled AKS clusters so this script is set up to work with an RBAC enabled AKS cluster. If you are deploying AGIC for a non-RBAC AKS cluster be sure to view the notes in the script and adjust a couple of lines of code to make it non-RBAC ready. Also note this AGIC script is focused on brownfield deployments so before running the script there are some components you should already have deployed. These components are:
VNet and 2 Subnets (one for your AKS cluster and one for the App Gateway)
The script will
deploy and do the following:
Deploys the AAD Pod Identity.
Creates the Managed Identity used by the AAD Pod Identity.
Gives the Managed Identity Contributor access to Application Gateway.
Gives the Managed Identity Reader access to the resource group that hosts the Application Gateway.
Downloads and renames the sample-helm-config.yaml file to helm-agic-config.yaml.
Updates the helm-agic-config.yaml with environment variables and sets RBAC enabled to true using Sed.
Adds the Application Gateway ingress helm chart repo and updates the repo on your AKS cluster.
Installs the AGIC pod using a helm chart and environment variables in the helm-agic-config.yaml file.
Now let’s take a look at running the script. It is recommended to upload to and run this script from Azure Cloud shell (PowerShell). Run:
You will be prompted
for the following as shown in the screenshot:
Enter the name of the Azure Subscription you want to use.:
Enter the name of the Resource Group that contains the AKS Cluster.:
Enter the name of the AKS Cluster you want to use.:
Enter the name of the new Managed Identity.:
Here is a screenshot
of what you will see while the script runs.
That’s it. You don’t have to do anything else except entering values at the beginning of running the script. To verify your new AGIC pod is running you can check a couple of things. First, run:
kubectl get pods
Note the name of my
AGIC pod is appgw-ingress-azure-6cc9846c47-f7tqn.
Your pod name will be different.
Now you can check
the logs of the AGIC pod by running:
kubectl logs appgw-ingress-azure-6cc9846c47-f7tqn
You should not have
any errors but if you do they will show in the log. If everything ran fine the
output log should look similar to:
After its all said and done you will have a running Application Gateway Ingress Controller that is connected to the Application Gateway and ready for new ingresses.
This script does not deploy any ingress into your AKS cluster. That will need to be done in addition to this script as you need. The following is an example YAML code for an ingress. You can use this to create an ingress for a pod running in your AKS cluster.
This is a great service if you just need to run a single container or even a couple of containers that you have in Docker Compose. This service is PaaS and abstracts away an orchestration system like Kubernetes. If you need insight into the Azure App Service Web App for Containers service check out the blog post on 4sysops.
In this long blog post I am going to take things a step further and walk-through the build & release of a Container from Azure DevOps to Azure Web App for Containers. The overall goal of this post is to help someone else out if they want to setup a build and release pipeline for building and deploying a container to Azure App Service. We will use a very simple PHP web app I built that will run in the container.
Here are the components that are involved in this scenario:
Azure Container Registry (ACR): We will use this to store our container image. We will be pushing up the container image and pull it back down from the registry as a part of the build and release process.
Azure DevOps (ADO): This is the DevOps tooling we will use to build our container, push it up to ACR, pull it down into our release pipeline and then deploy to our Azure App Service.
App Service Web App for Containers: This is the web server service on Azure that will be used to host our container. Under the hood this will be a container that is running Linux and Apache to host the PHP web app.
Here is the data Flow for our containerized web app:
Deploy the Azure App Service Web App for Containers instance
Deploy the Azure Container Registry
Deploy the Azure DevOps organization and project, create repository to host the code, clone repository in VS Code (Not shown in this blog post. Assume you know how to this up.)
Update the application code (PHP code and Docker image) in Visual Studio code
Commit application code from Visual Studio code to the Azure DevOps repo (Not shown in this blog post. Assume you know how to this up.)
Setup build and then run container build and push the container image to ACR
Setup release pipeline and then kick off the release pipeline pulling down the container image from ACR and deploys the container to the App Service Web App for Containers instance.
Here is a diagram detailing out the build and release process we will be using:
Ok. Let’s get into the setup of core components of the solution and the various parts of the build and release pipeline.
For starters this solution will need a project in Azure DevOps with a repo. Create a project in Azure DevOps and a repo based on Git. Name the repo exerciseoftheday. Next up let’s create the core framework we need in Azure.
Deploy Azure App Service Web App for Containers
Let’s create the Azure App Service Web App for Containers that will be needed. We will need a resource group, an app service plan and then we can setup the app service. The PHP app we will be running is named Exercise Of The Day (EOTD) for short so our resources will use EOTD. Use the following steps to set all of this up.
Note the loginServer from the output. This is the FQDN of the registry. Normally we would need this, admin enabled, and the password to log into the registry. In this scenario we won’t need admin enabled or the password because we will be adding a connection to Azure DevOps and the pipelines will handle pushing to and pulling the image from the registry.
When it’s all done you should see the following resources in the new resource group:
Next, we will need to build an application and a container image.
Today I passed the Docker Certified Associate exam! In this post, I will share some details about the exam and the resources I used to study for it.
The certification is good for 2 years after passing the exam. It demonstrates that you have foundational real-world Docker skills. It is multiple choice with 55 questions, you have 1.5 hours to finish it and costs $195 USD. It is recommended that you have 6 to 12 months of hands-on experience with Docker before taking the exam. You can read about and sign up for the exam here: https://success.docker.com/certification.
I have had some folks ask me why I would waste my time taking the Docker exam. They say to focus on Kubernetes and Open Shift instead of Docker. Lets talk about why I chose to pursue the Docker certification. First off you have to run containers on those orchestration platforms mentioned before and chances are you will run Docker containers on them. Therefore before diving into an orchestration platform it is important to be knowledgable on containers. Also, I have seen many scenarios in the cloud where it makes sense to run containers directly on the cloud platform itself and again chances are those will be Docker containers. Docker is still a leader in the container space. There are several reports and articles that point to this. Here are some of the reports and articles backing this up:
Docker listed as the leader in the “Container Tools Used” section of the RightScale 2019 State of the Cloud Report” here:
Docker is listed as #2 with 31.35% market share on Datanyze 2020 “Containerization Market Share Competitor Analysis Report” here:
I will call out that the Docker exam covers Swarm mode orchestration platform that is included with Docker. Swarm mode is a lot easier to learn and use compared to Kubernetes however, Kubernetes has won the orchestration platform war. It would be nice if Docker would revamp the exam reducing or removing Swarm and replace with some Kubernetes objectives. This would make more sense because there is a strong chance Swarm will not be used in the real world.
The Docker exam was not an easy exam and you definitely want to have some hands-on with Docker before taking it. There are a ton of resources out there that you can leverage beyond hands-on to assist in your study for this certification. There are many books available. You can do a quick search on Amazon and check the reviews for one that would be a good fit for you. I have read a couple of books on Docker and have co-authored a book on AKS with a chapter dedicated to Docker in it.
Here is the list of what I used to study.
Free Hands on Docker labs (This resource was huge for me. It gave me environments to use and scenarios for training with Docker and Docker Swarm mode.):
I attended a “Docker JumpStart Virtual Workshop” by Microsoft MVP Mike Pfeiffer and Microsoft MVP/Docker Captain Dan Wahlin (This workshop ocurred in the past but I beleive you can sign up and watch the recordings from the workshop.):
Spent time working with Docker on some projects (self explanatory).
Overall the Docker certification is a good move for your career as an IT Pro, developer, if you work in DevOps, and with cloud. I definitely recommend getting this certification. If you decide to go after it good luck!
Stay tuned for more blog posts with insights on certifications in the future.
This will be a short
post and this one is mostly for me so I can easily find this information in the
future when I need it again. 🙂
Recently I was
containerizing some PHP websites that use Composer. If you are not familiar
with Composer but you are working with PHP, you will run across it at some
point. Composer is a dependency package manager for PHP. Composer manages
(install/update) any required libraries and dependencies needed for your PHP
To use Composer you must first declare the libraries and dependencies in a composer.json file in your site directory and then you would run Composer and it will do its magic. For more information on Composer visit: https://getcomposer.org/doc/00-intro.md
Back to my task, I
needed to install Composer in the containers I was building and run it to
install all the dependencies. I needed these actions in the Dockerfile so it
would all happen during the container build. After some research on Composer I
was able to pull something together. Here is the syntax that I ended up putting
in the Dockerfile:
# Install Composer
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
# Set working directory for composer (Contains the composer.json file)
# Run Composer
RUN composer install
Note: I placed the above code at the end of the
Dockerfile ensuring Apache, PHP etc was all in place first.
These days the growth of Kubernetes is on fire! Azure Kubernetes Service (AKS) Microsoft’s managed Kubernetes offering is one of the fastest-growing products in the Azure portfolio of cloud services with no signs of slowing down. For some time me and two fellow Microsoft MVPs Janaka Rangama (@JanakaRangama) and Ned Bellavance (@Ned1313) have been working hard on an Azure Kubernetes Service (AKS) book. We are excited that the book has been finished and is currently in production. The publisher Apress plans to publish it on December 28th, 2019.
Besides my co-authors, we had additional rock stars to help with this project. For the Tech Review, we had the honor to work with Mike Pfeiffer (@mike_pfeiffer) Microsoft MVP, Author, Speaker, CloudSkills.fm podcast and Keiko Harada (@keikomsft) Senior Program Manager – Azure Compute – Containers. Shout out to them and huge thanks for being a part of this!
We also had the honor of the foreword being written by Brendan Burns (@brendandburns) Distinguished Engineer at Microsoft and co-founder of Kubernetes. A shout out to him and a world of thanks for taking the time to help with this project!
In this book, we take a journey inside Docker containers, container registries, Kubernetes architecture, Kubernetes components, and core Kubectl commands. We then dive into topics around Azure Container Registry, Rancher for Kubernetes management, deep dive into AKS, package management with HELM, and using AKS in CI/CD with Azure DevOps. The goal of this book is to give the reader just enough theory and lots of practical straightforward knowledge needed to start running your own AKS cluster.
For anyone looking to work with Azure Kubernetes Service or already working with it, this book is for you! We hope you get a copy and it becomes a great tool you can use on your Kubernetes journey.
I want to share here about Docker training I will be attending later this month June 24th/25th, 2019. It is a Docker JumpStart Virtual Workshop. I am excited about this training because it will be delivered by a fellow Microsoft MVP’s Dan Wahlin and Mike Pfeiffer. Also Dan Wahlin is a Docker Captain.
For those that don’t know a Docker Captain is like a Microsoft MVP but for Docker. There will even be some Kubernetes covered on day 2. This is shaping up to be some great training.
As of now there is still room in this class and its less than $300 USD! If you have wanted to get up to speed on Docker this is a good low cost way to do it. Here is a link to sign up: Docker JumpStart Workshop
Here is what will be covered across the 2 days (from the training website):
I recently read a Career Advice for IT professionals in 2019 article and was reminded again by a friend and fellow MVP’s on his blog that “Change is always constant in IT.
Part of being an IT professional is keeping an eye on and ramping up on new technology. Change in IT is constant and it is critical to explore new technology so you can bring innovation to your organization and ensure you are ready if the business decides they want to use a specific technology to gain an edge in the market.
With all the excitement around Blockchain, I decided to spend time ramping up on Azure’s Blockchain technology specifically Azure Blockchain Workbench. Azure Blockchain Workbench is a way for developers and IT pros to get A blockchain network up and running quickly.
Once Azure Blockchain Workbench is up and running IT pros can administrator the network and developers can dive right into building blockchain apps. Most people that have heard of blockchain are familiar with cryptocurrency such as Bitcoin. Most people don’t know of or associate blockchain with smart contracts. Azure Blockchain Workbench powers smart contract technology. A smart contract is a self-executing contract between two or more parties involved in a transaction. Getting started with Blockchain can seem intimidating but with Azure Blockchain Workbench it is not hard to get started. I wrote a white paper that you can use to get started and takes you beyond cryptocurrency into the world of smart contracts using Azure Blockchain Workbench.
The white paper covers the following:
Explorers blockchain beyond cryptocurrency
Has an in-depth overview of Ethereum and smart contracts
Helps identify when and what to use blockchain for?
Almost every day when you go to a news website, a news program on the radio or news on the TV you can expect to hear some mention of Cryptocurrency and increasingly something about Blockchain.
Blockchain has a strong buzz and yet it is still misunderstood by many. It is an exciting time for technology and blockchain is one of the many reasons why. Blockchain is a public distributed digital ledger. Transactions between parties are processed in an efficient, verifiable and immutable way using cryptography. Transactions are tracked without a central entity such as a bank processing and keeping a record of the transactions. The ledger in a Blockchain is distributed across many nodes in the Blockchain network. Each time a transaction occurs the ledger is reconciled across all the nodes.
The Blockchain you typically
hear about is related to some cryptocurrency such as Bitcoin, Litecoin, or
Ripple. Blockchain goes way beyond this and is a technology that is being
widely explored in use by some enterprises. Here are some examples of
Blockchain in use within the enterprise. Microsoft’s Xbox uses Blockchain to
deliver royalty statements to game publishers, FedEx uses Blockchain for
storing shipping records, and 3M is using Blockchain for a new
label-as-a-service concept. The commonality those examples is that they are
using Blockchain smart contract technology.
A smart contract is a self-executing contract between two or more parties involved in a transaction. A smart contract holds each party in the transaction responsible without the need for a third-party authority. Smart contracts are essentially code running on top of a blockchain that are digitally facilitated, verified, and auto-enforced under the set of terms laid out within the contract.
Opposite of Blockchain used
for cryptocurrency Blockchain used for smart contracts enable more complex
scenarios beyond the exchange of digital currency. To illustrate an example of
a Blockchain smart contract think about being able to buy and sell cars without
a DMV processing the exchange of titles but instead the exchange of the title
being verified and transferred digitally.
In today’s fast-moving world
of technology, it is important to be able to take your solution from idea to
MVP aka 0 to 60 as fast as possible. That is the goal of the Azure Blockchain
Workbench (ABW). As shown in the following image with ABW you can literally go
from idea>consortium blockchain network>code/use pre-built blockchain
app>Blockchain app ready to use in a short amount of time.
When I first started
with Blockchain I was able to go from nothing to a fully functional Blockchain
app in a couple of hours using ABW. As seen in the previous image ABW is made
up of a combination of Azure services and capabilities. The main services
An App Service Plan with two web apps and two web APIs
An Application Insights instance
An Event Grid Topic
A couple of Key Vaults
A Service Bus Namespace
A SQL Server with a SQL Databases
A couple of Azure Storage accounts
Two Virtual Machine scale sets that consist of the ledger
nodes and workbench microservices
A couple of virtual Network
resource groups that contain Load Balancers, Network Security Groups, Public IP
Address, and Virtual Network, VNet peering, and Subnets
Other components leveraged by
ABW are Azure Active Directory for identity, Azure Monitor (optional), and log
analytics workspace for logging (deployed with Azure Monitor), a mobile app for
both iOS and Android along with a REST-based gateway service API to integrate
to blockchain apps. Workbench provides the infrastructure needed to build and
deploy blockchain applications so when you deploy ABW it includes everything
you need. As of now ABW only supports Ethereum as its target blockchain.
Microsoft has plans to add Hyperledger and Corda Blockchains in the future.
ABW is designed to make it
easy for developers to bring Blockchain to the enterprise. ABW is deployed in
the Azure Portal via a solution template. You can deploy Ethereum or attach to
an existing one. After the Blockchain Workbench is deployed developers have the
option to either create a Blockchain app or use one of the Applications
and Smart Contract Samples from a repository maintained by
These Blockchain apps consist of a configuration metadata and smart contract. The configuration metadata file is in JSON format and determines the multi-party workflow the smart contract is in a language named Solidity and determines the business logic of the Blockchain application itself. The configuration and smart contract together make up the Blockchain application user experience. The Applications and Smart Contract Samples can be used as is to take Blockchain for a test run or can be modified to fit an organization’s specific need. As an example, some of the information you can modify with the configuration is application name, display name, state, and application roles.
As you can see it is relatively easy to get a Blockchain application up and going. Another real benefit to running a Blockchain application on Azure is the integration points with many of the other services available on Azure. Here are a few examples. ABW writes a copy of the Blockchains on-chain data from the Blockchain distributed ledgers to an off-chain SQL database. Developers can connect to this database to work with the Blockchain data for any number of scenarios one of them could be reporting in Power BI. The Workbench has a REST API, Service Bus, IoT Hub, and Event Grid that could be used for integration with other technology such as IoT devices, other systems, and Azure Streaming Analytics to further expand the possibilities. With the Blockchain workbench developers also have access to one of Azures automation tools called Logic Apps opening the door to a world of further automation scenarios.
There is much more to the Azure Blockchain Workbench then can be covered in a single blog. The main point of this post is to show how a developer can go from 0 to 60 within a short amount of time with minimal effort to stand up the scaffolding needed to support a Blockchain app. For a deeper dive into the Azure Workbench it is recommended to download my Blockchain Beyond Cryptocurrency whitepaper once it is released. Thanks for reading. To get started with the Azure Blockchain Workbench visit this link: https://azure.microsoft.com/en-us/features/blockchain-workbench