30 Minutes of Azure Kubernetes Services (AKS)

Today I went on “Tech Talk Wednesday” a podcast and radio show with Kazeem Adegboyega The topic was “30 Minutes of Azure Kubernetes Services (AKS)“. It streamed online via Microsoft Teams and aired in Lagos, Nigeria on Lagos State University (LASU) radio (95.7).

I had a great time talking with Kazeem! Even Sam Erskine made a guest appearance. If you missed the live show you can watch it on YouTube:

Or go directly to the video here: https://www.youtube.com/watch?v=q7GCHQudCWg

Read More

Tech Talk Wednesday Guest – Topic: Azure Kubernetes Service (AKS)

I am honored to be a guest next Wednesday, August 26th on the “Tech Talk Wednesday” podcast and radio show with Kazeem Adegboyega (@KazeemCanTeach)! We will be chatting about Azure Kubernetes Service (AKS).

This show will be streamed online via Microsoft Teams and will air in Lagos, Nigeria on Lagos State University (LASU) radio (95.7)!

One of my goals is to help spread knowledge about tech in Africa and showcase African technologists in the US. This is the first step in that journey.

Be sure to tune in. Go here to register: http://kazeem.com.ng/index.php/tech-talk

Don’t worry if you can’t make the live stream. It will be recorded and posted later on Kazeem’s website.

Read More

Explore: Kubernetes resource view (Preview) in AKS

Microsoft has been making some amazing enhancements to AKS and in the open-source space in general. This effort has been making it easier to use Kubernetes and easier for folks who are getting started with Kubernetes.

Recently Microsoft has added more functionally called “Kubernetes resource view“.

Kubernetes resource view in Azure Portal

Kubernetes resource view in Azure Portal

This allows you to see and work with some Kubernetes resources directly in the Azure portal. As you can see in the previous screenshot it includes Namespaces, Workloads, and Services. When you deploy a new AKS cluster this is enabled by default.

If you have deployed an AKS cluster before this functionality was release you will need to enable the Kubernetes resource view. You can choose what namespace to enable this on. It will look like this:

Enable Kubernetes resource view button

Enable Kubernetes resource view button

The three main areas of resources are:

  • Namespaces
  • Workloads
    •  Deployments
    •  Pods
    •  Replica Sets
    •  Daemon sets
  • Services and ingresses

In these resource areas, you can view the resources, add, delete, and show labels.

You can click on a resource to see the properties of it under Overview. The overview tab has valuable information for example for a pod you can see the pod status, the containers that belong to it, its conditions, and more.  Here are some screenshots:

You can see any events around the resource and you can even view or edit the resources Yaml. Here is what it looks like when editing a resource:

Well, this was a quick blog post to give an early look at the new Kubernetes resource view in AKS. I recommend you check out it! Remember this is a preview and it’s going to get better and better.

I can imagine in the future we will be able to access more Kubernetes resources and API Objects in the Azure portal. For example, it will be cool to be able to work with Secrets, and Configmaps right in the Azure portal! I don’t know about you, but I am very excited about what Microsoft has been doing with AKS!

Read More

Inside Azure Management Sessions now on YouTube

I recently presented at the Inside Azure management event. This event was packed full of Microsoft MVP’s and community experts from around the world. The focus on the event was around Azure Management based topics with some Kubernetes, AI, and DevOps topics sprinkled in.

My session was “Azure Policy Insights & Multi-Tag demo via Azure Policy” Here is what it covered: “Azure Policy is a great tool when it comes to auditing and ensuring your cloud governance is met. In this session 9 time Microsoft Azure MVP Steve Buchanan is going to take you on a full-speed ride on the ins and outs of Azure Policy and land you with a recipe for handling a multi-tagging strategy with Azure Policy. Some of the key topics you will learn from this session include:

  • Overview of Azure Policy
  • Azure Policy Configuration best practices to meet compliance (NIST, PCI, ISO, HIPPA)
  • Securing Azure services: AKS / Networking / SQL / App Service
  • Azure Policy vs RBAC
  • Overview of Azure Policy Guest Configuration
  • Tagging and more

The event has passed and if you didn’t make it no worries! All of the sessions have been recorded and uploaded to the Inside Azure management YouTube channel to be watched at your leisure. Here is the link to the YouTube channel where you can watch all the sessions:

https://bit.ly/azurevideos

The event coordinators have also set up some Youtube playlists to make it easier to find videos on the topics that pertain to you. They broke these out in the following categories: Azure Management, Artificial Intelligence in Azure, Cloud Governance, Cybersecurity, and DevOps.

You can watch my session right here:

Also here is the direct link to the video of my session on YouTube: https://youtu.be/EfAiITcExK0

Thanks for checking out my session and others from this event. Stay tuned to my blog for info on where I will be speaking next!

Read More

Third Pluralsight Course Published – Microsoft Azure Pricing and Support Options

Today my third Pluralsight course has been published. This course is titled “Microsoft Azure Pricing and Support Options“. It is a part of an AZ-900 learning path that will help you prepare for the Microsoft Azure Fundamentals AZ-900 exam. Learn more about that exam here: https://docs.microsoft.com/en-us/learn/certifications/exams/az-900 .

I was excited about this course as it is a part of my day to day focus on Azure. Also, this is a chance to help those that are getting started with Azure. Here is what you will gain from this course:

This course will teach you the fundamental knowledge about the pricing and support options in Azure one of the core skills measured in the AZ-900: Azure Fundamentals exam.

In this course, Microsoft Azure Pricing and Support Options, you’ll learn to estimate the pricing and support of Azure cloud services. First, you’ll explore Azure subscriptions, subscription management, and management groups.

Next, you’ll discover, plan, and manage Azure costs. Finally, you’ll learn how to understand Azure SLA’s, various Azure service lifecycles, and how to select the right support options. When you’re finished with this course, you’ll have the skills and knowledge of Azure pricing and available support needed to estimate Azure costs and select the right support options.

Please check out this new course here: https://app.pluralsight.com/library/courses/microsoft-azure-pricing-support-options

Also, be sure to follow my profile on Pluralsight so you will be notified as I release new courses! I will be releasing more courses soon!

Here is the link to my Pluralsight profile: https://app.pluralsight.com/profile/author/steve-buchanan

Read More

Speaking at Inside Azure Management Summit

I was recently added to the speaker lineup for the “Inside  Azure Management Summit” happening on 7/23/2020. This event is a FREE 1-day virtual event. It features the Microsoft cloud experts from the authoring team of “Inside Azure Management” book, Microsoft MVP’s, and community experts from around the world.

Attendees will get a day full of deep-dive technical sessions across a variety of Microsoft cloud topics including:

  • DevOps and Automation
  • Cyber Security
  • Cloud Governance
  • Migration and Monitoring
  • Docker and Kubernetes
  • AI and Identity

The sessions will span a 13-hr period to allow audiences from around the world to join a portion of the event.

 I will be giving a session on Azure Policy. Here is my session info:

Session Title:

Azure Policy Insights & Multi-Tag demo via Azure Policy

 

Session Abstract:

Azure Policy is a great tool when it comes to auditing and ensuring your cloud governance is met. In this session 9 time Microsoft Azure MVP Steve Buchanan is going to take you on a full-speed ride on the ins and outs of Azure Policy and land you with a recipe for handling a multi-tagging strategy with Azure Policy. Some of the key topics you will learn from this session include:

  • Overview of Azure Policy
  • Azure Policy Use Cases
  • How Azure Policy can meet NIST standards
  • Azure Policy vs RBAC
  • Overview of Azure Policy Guest Configuration
  • Tagging and more

Here is the direct link to my session:

https://insideazuremgmt.com/session/azure-policy-insights-multi-tag-demo-via-azure-policy/

Be sure to register for this event to check out all the great sessions including mine on Azure Policy.

Here is the link to the official site:

https://www.insideazuremgmt.com

Here is the link to register:

https://www.eventbrite.com/e/inside-azure-management-the-virtual-summit-tickets-109230577598?aff=ebdssbeac

Read More

Guest on “Lisa at the Edge” Podcast EP13

I recently had the honor of being a guest on the “Lisa at the Edge” Podcast. Lisa is a Microsoft Hybrid Cloud Strategist and an influencer in the hybrid cloud community based out of Scotland. She runs a blog and this year she started a popular podcast.

On Lisa’s podcast, she covers Careers in Tech and Microsoft Hybrid Cloud and a range of other topics with experts across the tech community.

This is an episode you don’t want to miss. This was one of the most entertaining podcasts I have been on. It took some interesting turns in regards to topics and very engaging. In the podcast episode Lisa and I talk about:

  • Evolving your career as technology evolves
  • Transformation of IT dept to Strategic Business Partner
  • DevOps
  • Containers 101
  • Azure Kubernetes Service
  • Diversity in tech

You can listen to the episode here:


or here
https://anchor.fm/lisaattheedge/episodes/EP13—Career-Development–Containers-101-and-Diversity-in-Tech-with-Steve-Buchanan-efnjrp

You can stay up to date with what Lisa is doing in the tech community here:

Lisa at the Edge Podcast – – https://anchor.fm/lisaattheedge
Lisa at the Edge Blog – https://lisaattheedge.com/blog/
Twitter – https://twitter.com/lisaattheedge

Read More

Use Azure Container Registry with Azure Kubernetes Service

When working with Containers a common need is to store Container images somewhere. Container Registries are the go-to for this. Docker hub is an example of a Container Registry and it is the most well-known Container Registry.

What is a Container Registry?

A Container Registry is a group of repositories used to store container images. A container repository is used to manage, pull or push container images. A Container Registry does more than a repository in that it has API paths, tasks, scanning for vulnerabilities, digital signature of images, access control rules and more.

Container registries can be public or private. For example, a public registry is Docker Hub and anyone can access its container repositories to pull images. A private registry is one that you would host either on-premises or on a cloud provider. All of the major cloud providers including Azure has a Container Registry offering.

Integrate ACR with AKS

With AKS it is a good idea to use a private container registry to host your container images. The process is used Docker to build your image>push the image to your Azure Container Registry>Pull the image from the registry when deploying a Pod to your AKS cluster.

There are 3 ways to integrate AKS with Azure Container Registry. I typically only use one way and will focus on that in this blog post.

2 of the ways you can integrate AKS with Azure Container Registry. The first is through an Azure AD service principal name (SPN) that assigns the AcrPull role to the SPN. More on this here. You would use this first way in scenarios where you only have one ACR and this will be the default place to pull images from.

The second is to create a Kubernetes ServiceAccount that would be used to pull images when deploying pods. With this you would add “kind: ServiceAccount” to your Kubernetes cluster and it would use the ACR credentials. Then in your pods yaml files you would need to specify the service account for example “serviceAccountName: ExampleServiceAccountName”.

The way I like to integrate AKS with Azure Container Registry is to use Kubernetes Secret of type docker-registry. With this option basically, you create a secret in the Kubernetes cluster for your Azure Container Registry. You then specify the secret in your pod yaml files. This allows you to have multiple container registries to pull from. This option is also quick and easy to setup.  Ok.

To get started you need to build your Docker image and push it up to your Azure Container Registry. In this blog post, I will not cover deploying ACR, or building the Docker image assuming you have already done these things. Now let’s set up the ACR and AKS integration using a docker-registry Kubernetes secret.

1. For the first step, you will need the credentials to your Azure Container Registry. To get this go navigate to:

Azure Portal (portal.azure.com) > Container registries > YOURCONTAINERREGISTRY | Access keys

2. The second step push your Docker image up to your ACR.

# Log into the Azure Container Registry
docker login ACRNAMEHERE.azurecr.io -u ACRUSERNAMEHERE -p PASSWORDHERE

# Tag the docker image with ACR
docker tag DOCKERIMAGENAMEHERE ACRNAMEHERE.azurecr.io/DOCKERIMAGENAMEHERE:v1

# Push the image to ACR
docker push ACRNAMEHERE.azurecr.io/DOCKERIMAGENAMEHERE:v1

3. The third step create the docker-registry Kubernetes secret by running following syntax from Azure Cloud Shell:

kubectl create secret docker-registry NEWSECRETNAME --docker-server ACRNAMEHERE.azurecr.io --docker-username ACRUSERNAMEHERE --docker-password YOURPASSWORDGOESHERE

4. The fourth step is to create the Yaml file for your pod. The following is an example:

apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: ACRNAMEHERE.azurecr.io:myapp:v1
  imagePullSecrets:
  - name: NEWSECRETNAME

The following is an example of a yaml file with a service, deployment, and pod:

apiVersion: v1
kind: Service
metadata:
  name: eotdservice
spec:
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 80
  selector:
    app: eotd
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: eotddeployment
  labels:
    app: eotd
spec:
  replicas: 4
  selector:
    matchLabels:
      app: eotd
  template:
    metadata:
      labels:
        app: eotd
    spec:
      containers:
      - name: eotd   
        image: ACRNAMEHERE.azurecr.io/eotd:v1
        imagePullPolicy: Always
        ports:
        - containerPort: 80
      imagePullSecrets:
       - name: NEWSECRETNAME

5. The fifth and final step is to deploy the pod to your AKS cluster by running the following syntax from Azure Cloud Shell.

kubectl apply -f YOURPODNAME.yaml

That wraps up this blog post. Thanks for reading and happy containerizing!

Read More

Delete Azure App Registrations Script

When working in my Azure labs I tend to end up with a lot of Azure App Registrations. Recently I had hundreds and hundreds of them in the directory. Its been a while since I cleaned this up. I needed to clean this out and did not want to do this manually through the portal. PowerShell to the rescue.

I pulled together a script that will place your app registrations in a variable. It will then loop through the app registrations to remove them. Note you will be prompted with a confirmation to remove each one.

You can download the script here: https://github.com/Buchatech/Delete-Azure-App-Registrations-

Read More

Build & release a Container Image from Azure DevOps to Azure Web App for Containers

I recently published a blog post on 4sysops.com about Web App for Containers on Azure here: https://4sysops.com/archives/web-app-for-containers-on-azure. That blog post is about the often-overlooked service in Azure that can be used to host a container/s on a web app in Azure App service.

This is a great service if you just need to run a single container or even a couple of containers that you have in Docker Compose. This service is PaaS and abstracts away an orchestration system like Kubernetes. If you need insight into the Azure App Service Web App for Containers service check out the blog post on 4sysops.

In this long blog post I am going to take things a step further and walk-through the build & release of a Container from Azure DevOps to Azure Web App for Containers. The overall goal of this post is to help someone else out if they want to setup a build and release pipeline for building and deploying a container to Azure App Service. We will use a very simple PHP web app I built that will run in the container.

Here are the components that are involved in this scenario:

  • Azure Container Registry (ACR): We will use this to store our container image. We will be pushing up the container image and pull it back down from the registry as a part of the build and release process.
  • Azure DevOps (ADO): This is the DevOps tooling we will use to build our container, push it up to ACR, pull it down into our release pipeline and then deploy to our Azure App Service.
  • App Service Web App for Containers: This is the web server service on Azure that will be used to host our container. Under the hood this will be a container that is running Linux and Apache to host the PHP web app.

Here is the data Flow for our containerized web app:

  1. Deploy the Azure App Service Web App for Containers instance
  2. Deploy the Azure Container Registry
  3. Deploy the Azure DevOps organization and project, create repository to host the code, clone repository in VS Code (Not shown in this blog post. Assume you know how to this up.)
  4. Update the application code (PHP code and Docker image) in Visual Studio code
  5. Commit application code from Visual Studio code to the Azure DevOps repo (Not shown in this blog post. Assume you know how to this up.)
  6. Setup build and then run container build and push the container image to ACR
  7.  Setup release pipeline and then kick off the release pipeline pulling down the container image from ACR and deploys the container to the App Service Web App for Containers instance.

Here is a diagram detailing out the build and release process we will be using:

Click to enlarge

Note that all code used in this blog post is hosted on my GitHub here: https://github.com/Buchatech/EOTD-PHP-APP-DOCKER-CONTAINER

Ok. Let’s get into the setup of core components of the solution and the various parts of the build and release pipeline.

For starters this solution will need a project in Azure DevOps with a repo. Create a project in Azure DevOps and a repo based on Git. Name the repo exerciseoftheday. Next up let’s create the core framework we need in Azure.

Deploy Azure App Service Web App for Containers

Let’s create the Azure App Service Web App for Containers that will be needed. We will need a resource group, an app service plan and then we can setup the app service. The PHP app we will be running is named Exercise Of The Day (EOTD) for short so our resources will use EOTD. Use the following steps to set all of this up.

We will do everything via Azure Cloud Shell. Go to https://shell.azure.com/ or launch Cloud Shell within VS Code.

Run the following Syntax:

# Create a resource group

az group create –name EOTDWebAppRG –location centralus

# Create an Azure App Service plan

az appservice plan create –name EOTDAppServicePlan –resource-group EOTDWebAppRG –sku S1 –is-linux

# Create an Azure App Service Web App for Containers

az webapp create –resource-group EOTDWebAppRG –plan EOTDAppServicePlan –name EOTD –deployment-container-image-name alpine

# Create a deployment slot for the Azure App Service Web App for Containers

az webapp deployment slot create –name EOTD –resource-group EOTDWebAppRG –slot dev –configuration-source EOTD

Deploy Azure Container Registry

Now let’s create the Azure Container Registry. Again, this is where we will store the container image. Run the following Syntax:

# Create Azure Container Registry

az acr create –resource-group EOTDWebAppRG –name eotdacr –sku Basic –admin-enabled false –location centralus

Note the loginServer from the output. This is the FQDN of the registry. Normally we would need this, admin enabled, and the password to log into the registry. In this scenario we won’t need admin enabled or the password because we will be adding a connection to Azure DevOps and the pipelines will handle pushing to and pulling the image from the registry.

When it’s all done you should see the following resources in the new resource group:

Next, we will need to build an application and a container image.

Read More