Kubernetes on Thorsten Hans

Hot-Reload .NET Configuration in Kubernetes with ConfigMaps

Tue, 06 Dec 2022 20:39:10 +0100

Leveraging ConfigMaps, we can inject configuration data into applications running in Kubernetes. In this article, we’ll look at how to use a Kubernetes ConfigMap to configure a .NET application from the outside and automatically reload changes applied to the ConfigMap.

Automatically reloading configuration data without redeploying the application and without making a code change is super handy - not just for cloud-native applications. Being able to modify certain aspects of the application to hunt and pinpoint bugs is valuable and something you should consider adding to your applications too. For demonstration purposes, we will create a ConfigMap that allows us to modify the logging behavior of a simple HTTP API acting as the sample application.

Patch Kubernetes objects with .NET: The Simple Way

Thu, 01 Sep 2022 15:54:07 +0000

By leveraging the official Kubernetes client libraries for C# , we can easily interact with any Kubernetes cluster. We can also update (or patch) existing objects by invoking the corresponding Patch* methods (like PatchNamespacedPod, PatchNamespacedConfigMap, and many more) provided by the client library.

Although we can construct patches from different formats (JsonPatch, ApplyPatch, MergePatch, or StrategicMergePatch), we’ll focus on JsonPatch for the sake of this article, and we will update the following ConfigMap:

Logging in Kubernetes with Loki and the PLG stack

Tue, 05 Apr 2022 13:30:00 +0000

Observability is a huge topic in cloud-native environments. One must collect, understand, and investigate millions of logs from different sources to understand what’s happening at an application’s runtime. Log stacks - like PLG - address all those concerns and are typically composed of multiple applications with dedicated responsibilities. At the core of every log stack, a log aggregation system is responsible for indexing, storing, and exposing a query interface for log messages.

Custom health probes with Azure Container Apps

Fri, 25 Mar 2022 11:41:56 +0000

In Kubernetes, individual probes like liveness, readiness, and startup are mission-critical when deploying applications. Kubernetes uses probes to determine the health of containers in a Pod. Kubernetes may restart Pods because of failing probes. On top of that, Kubernetes uses probes to determine if a particular container can deal with incoming requests. Kubernetes Services will route incoming requests to containers that made it to the Ready state. If a readiness probe is defined on a container, that container must successfully respond to the probe invocation to become Ready.

Custom health probes with Application Gateway Ingress Controller

Wed, 16 Feb 2022 19:58:50 +0100

With Azure Application Gateway Ingress Controller (AGIC) , we can integrate an existing Azure Application Gateway instance with Kubernetes. In Kubernetes, an ingress controller is responsible for routing inbound requests to applications running inside the cluster. AGIC automatically watches Ingress resources inside your cluster and automatically updates the linked instance of Azure Application Gateway upon reconciliation.

Azure Application Gateway uses health probes to determine if the desired backend target can serve requests. Azure Application Gateway won’t send incoming requests to the backend target if a configured health probe fails. Instead, it will respond to the request with an HTTP 502. If the health probe is successful, incoming requests will be forwarded to the desired backend target, responsible for handling the requests and generating proper responses.

Add krustlet node pools to Azure Kubernetes Service

Tue, 26 Oct 2021 14:23:42 +0000

If we had traveled three years back in time, running WebAssembly (Wasm) workloads in Kubernetes would have sounded like fiction. Today, it’s real! With krustlet , developers can run Wasm workloads directly in Kubernetes. This article will look at what krustlet is and how we can bring it to our Azure Kubernetes Service (AKS) clusters.

What is Krustlet

Krustlet is a Kubernetes kubelet written in Rust to run Wasm workloads in Kubernetes. Nodes running krustlet have special tolerations assigned, which we can use within Kubernetes manifests, to ensure Wasm workloads will be scheduled to krustlet nodes. Under the covers, krustlet uses wasmtime as the runtime for our Wasm workloads using the wasm32-wasi architecture.

Read-only filesystems in Docker and Kubernetes

Tue, 19 Oct 2021 13:31:43 +0000

You should harden your containerized workloads to minimize the attack surface of your overall application. Paying close attention while building your container images and applying proven patterns will reduce the risk of an attack while running your application in production. One of the simple practices to apply is setting the filesystem of your containers to read-only, and that’s exactly what we will cover in this article.

Read-only filesystems in Docker

Docker and compliant CLIs offer the read-only flag, which we can use when mounting the container’s filesystem as read-only. Let’s try it! Let’s start a new container from the official ubuntu image with an interactive TTY, to verify that the filesystem is read-only. The following docker run command uses -it (creates an interactive pseudo TTY and ensures STDIN is kept open) and --rm (removes the container automatically once exited):

External-DNS with Azure Kubernetes Service and Azure DNS

Thu, 09 Sep 2021 10:52:53 +0000

This article guides you through the process of configuring External-DNS with Azure Kubernetes Service (AKS) and Azure DNS. By deploying and configuring External-DNS and necessary Azure services correctly, you can ensure proper routing from your custom domain into Kubernetes. Before we dive into actually configuring External-DNS and wiring everything up, let’s briefly revisit some core concepts.

Cloud platform automation with managed Kubernetes clusters

Managed Kubernetes clusters like Azure Kubernetes Service (AKS) automate the surrounding cloud platform using their custom cloud controller manager implementation as part of their Kubernetes distribution. For example, this makes exposing a service of type LoadBalancer frictionless. AKS will automatically acquire a public IP address and provision an instance of Azure Load Balancer (LNB) to route ingress traffic into the Kubernetes cluster.

Encrypted Secrets in Helm Charts

Wed, 11 Aug 2021 08:00:44 +0000

In my recent article “How to encrypt Kubernetes secrets with Mozilla SOPS ”, I demonstrated how to encrypt regular Kubernetes secret manifests (yaml) using SOPS CLI in conjunction with Azure Key Vault as the backend for the encryption-key.

This post will take it one step further; it guides you through the process of creating a custom Helm chart that will reference encrypted secrets. In the end, you will be able to add your encrypted secrets to source control without leaking sensitive information.

Encrypt your Kubernetes Secrets with Mozilla SOPS

Tue, 03 Aug 2021 12:59:24 +0200

By default, Kubernetes Secrets (secrets) are stored with base64 encoding in YAMLfiles. The lack of encryption for secrets often leads to the question of how to store secrets securely. Obviously, you don’t want to put your sensitive configuration data into a git repository, because it is just encoded. echo <base64_representation> | base64 -d.

A typical solution is using services like Azure Key Vault , or HashiCorp Vault to persist sensitive data. Those services can be integrated with Kubernetes by using the Secrets Store CIS driver . However, relying on an additional service means that you have to manage and maintain that service in addition to Kubernetes. Additionally, depending on the service you use to store your sensitive data, some sensitive configuration must be stored somewhere to configure the CIS driver.

Debugging apps in Kubernetes with Bridge

Wed, 28 Jul 2021 12:40:38 +0200

One of the most common questions I get when teaching developers in Kubernetes is

“How can I debug my application once it is deployed to Kubernetes?”

Although there are several ways how to achieve that, this post will explain and demonstrate how to debug applications running in Kubernetes using Bridge to Kubernetes (Bridge).

What is Bridge to Kubernetes

Bridge to Kubernetes (Bridge), the successor of “local process” is an IDE / editor extension. It allows developers to debug and test application counterparts (or microservices) on their local machine. While debugging locally, downstream and related components are consumed directly from within the Kubernetes cluster. Existing configuration objects - such as Kubernetes ConfigMaps, or Secrets -, and volumes mounted to the Pod are also applied to the local debugging instance seamlessly.

What is new in Open Service Mesh 0.4.0

Wed, 07 Oct 2020 00:00:00 +0000

A couple of days ago, Open Service Mesh (OSM) version 0.4.0 was released on GitHub. Compared to the previous release, several things have changed. In this post I will walk through the most important changes, which will have an impact on the actual usage of Open Service Mesh.

Sidecar Injection disabled by default

Open Service Mesh uses Kubernetes’ sidecar-container pattern to bring Service Mesh capabilities to your application deployments. With version 0.4.0, OSM will no longer inject sidecar-containers by default. In contrast, you have to enable it explicitly when onboarding a Namespace. This can be achieved by using osm CLI with the new --enable-sidecar-injection flag:

Getting Started With Microsoft Open Service Mesh

Fri, 28 Aug 2020 00:00:00 +0000

A couple of weeks ago, Microsoft announced the first public release of Open Service Mesh (OSM) an open-source, lightweight, and extensible service mesh implementation, based on the Service Mesh Interface (SMI) specification. This article explains the core concepts of a service mesh, provides an Open Service Mesh introduction, and demonstrates some common service mesh use-cases.

Update 2020-10-08

In the meantime, Microsoft has released version 0.0.4 of Open Service Mesh. The updates reflect the upstream changes.

How To Access Kubernetes Dashboard On RBAC Enabled Azure Kubernetes

Tue, 09 Jun 2020 09:00:00 +0000

The Kubernetes dashboard is quite useful to drill through existing Kubernetes clusters and inspect things without using kubectl. However, starting with version 2.0.40 of Azure CLI, Azure Kubernetes clusters are deployed with Role-Based-Access-Control (RBAC) enabled by default. Since that point in time, you will be presented with a bunch of errors when trying to access the traditional Kubernetes dashboard using az aks browse.

6 Steps To Run .NET Core Apps In Azure Kubernetes

Sun, 07 Jun 2020 08:00:00 +0000

Mastering Kubernetes is hard and a time-consuming task. However, getting started with Kubernetes in Azure as a .NET Core Developer is relatively easy. It takes six steps to get your application up and running in Azure Kubernetes Service (AKS), starting with a plain, regular .NET Core Web API.

This article will guide you through the entire process and explain all steps in detail, so you can follow and end up with having your application being executed in Kubernetes and being exposed to the internet.

AKS cluster auto-scaler inside out

Mon, 11 May 2020 16:10:00 +0000

Cluster auto-scaling for Azure Kubernetes Service (AKS) is available for quite some time now. I have been using it in several projects so far.This post explains all details about the AKS cluster auto-scaler, shows how to enable it for both - new and existing AKS clusters - and gives you an example of how to use custom auto-scaler profile settings.

What is the AKS cluster auto-scaler

With cluster auto-scaling, the actual load of your worker-nodes will be monitored actively. By adding and removing worker-nodes from the cluster, it ensures that enough resources are available to keep your application healthy and responsive. In contrast, it removes worker-nodes from the AKS cluster, to optimize resource utilization and be as cost-effective as possible.

Getting Started With Helm 3

Wed, 22 Apr 2020 00:00:00 +0000

Helm 3 is around for a couple of months now. During that time, I recognized more and more customers willing to use Helm 3 to package, distribute, and construct their cloud-native application bundles. Perhaps you have already heard of Helm, but don’t know where to start with Helm exactly? Or you want to learn the differences between Helm 2 and Helm 3. Again others, prefer having all essential information compiled into a single article. Then this is the right one for you! See this post as an introduction to Helm 3; it explains all the major building-blocks and provides - just - enough background information to get started with Helm 3.

3 Ways to integrate ACR with AKS

Wed, 12 Feb 2020 00:00:00 +0000

To integrate Azure Container Registry (ACR) with Azure Kubernetes Service (AKS), operators and developers currently have three different options. At the end of the article, you can integrate the protected implementation of Docker Registry 2.0 with your Kubernetes cluster using your preferred strategy.

1. Kubernetes Secret

First and perhaps the easiest integration strategy is to create a Kubernetes Secret of type docker-registry. You can create such a Secret either using yaml or using the kubectl create command:

Extend Kubernetes with Custom Resource Definitions and RBAC for ServiceAccounts

Tue, 11 Feb 2020 00:00:00 +0000

We can extend Kubernetes using Custom Resource Definitions (CRDs). By adding Custom Resource Definitions to Kubernetes, operators can use familiar concepts and tools like kubectl to deal with custom data. We can bring our schema and have it sitting next to first-class types like Pod, Service, and others. Kubernetes API Server takes care of the entire lifecycle of custom objects, which means once CRDs are deployed, we can create, modify, retrieve, and delete them. On top of that, we can create custom Roles and ClusterRoles to protect custom objects using RBAC.

Book review - Kubernetes Up & Running 2nd Edition

Sat, 02 Nov 2019 00:00:00 +0000

A couple of days ago, I stumbled upon a tweet from Brendan Burns mentioning that the 2nd edition of “Kubernetes: Up & Running” is available. Because I enjoyed the initial release of the book some years ago, I bought a copy and read it. Brendan Burns, Joe Beda, and Kelsey Hightower updated their popular book “Kubernetes: Up & Running” to provide a good Kubernetes introduction for developers. On less than 300 pages, you will learn what Kubernetes is and which needs it addresses.

Certified Kubernetes Application Developer - Review and Tips

Tue, 22 Oct 2019 00:00:00 +0000

During this week, I took the Certified Kubernetes Application Developer (CKAD) exam and passed. However, I did not take the exam because of the certificate; I took the exam because of the challenge. The challenge to verify my Kubernetes knowledge and experience. The knowledge and experience I got from real-world projects and from falling in love with cloud-native application development in general.

Compared to other exams (and I did a bunch of exams back in the .NET Framework v3 and v4 days), CKAD is challenging. There are no multiple-choice questions, CKAD challenges your experience with Kubernetes by presenting you with a set of day-to-day tasks. Tasks that you must solve in 120 minutes or less by using a terminal and an editor. I enjoy challenges like these. They make me identify areas where I can improve because they measure both: Experience and speed.

AKS and ACR Integration - Revisited

Fri, 04 Oct 2019 00:00:00 +0000

Back in 2017, I published this article on integrating Kubernetes with ACR. Since that time, a lot has changed in the world of containers and orchestrators. Especially Microsoft is pushing hard in the Kubernetes area and keeps on shipping features regularly as part of their managed Kubernetes offering. The integration of ACR and AKs became even more comfortable since Azure CLI 2.0.73 has been released. That said, let’s check out how smooth the integration is.

The state of Helm 3 - Hands-On!

Wed, 02 Oct 2019 00:00:00 +0000

Helm, is the package manager for Kubernetes. It allows you to install complex applications and maintain the entire application lifecycle using a lightweight and intuitive CLI. You can think of it as the npm or nuget for Kubernetes.

Helm is around for quite some time in the Kubernetes community. The project was started by Deis and Google and is an essential part of CNCF.

Since Helm 3 is available as a beta release, it is the right time to look into it. This article summarizes the upcoming changes and illustrates how Helm 3 could be used to build, distribute, and manage applications in Kubernetes.

Custom domains in Azure Kubernetes Service (AKS) with NGINX Ingress and Azure CLI

Mon, 30 Sep 2019 00:00:00 +0000

When running applications in Azure Kubernetes Service (AKS), NGINX Ingress does a great job in routing inbound traffic. The flexible routing engine allows a wide variety of scenarios to expose different parts of cloud-native applications using different URLs. Unfortunately, there is no documentation on how to map such a custom domain to a public IP address without using the Azure Portal.

This article outlines the process of mapping a custom domain to the public IP address acquired by NGINX Ingress in AKS using Azure CLI. I assume you have already deployed your application and corresponding NGINX Ingress to your AKS.

Azure Key Vault FlexVolume for Kubernetes — A journey to integrate Azure Key Vault and AKS

Mon, 10 Dec 2018 00:00:00 +0000

This is the second part of the mini-series on Integrating Azure Key Vault and AKS (Azure Kubernetes Services). If you missed the first part , you should definitely read it before digging into this article.

Introducing Azure Key Vault FlexVolume for Kubernetes

Azure Key Vault FlexVolume for Kubernetes is a driver that allows you to consume typed data from Azure Key Vault (like secrets, keys or certificates) and attach that data directly to Pods. You can find the project itself directly on GitHub .

AzureAD Pod Identity in AKS: A journey to integrate Azure Key Vault

Thu, 06 Dec 2018 00:00:00 +0000

Back in May, I wrote an article on how to integrate Azure Key Vault with ACS. Since that, a lot happened in the Azure and Kubernetes space and I thought an updated version would be worth sharing because dealing correctly with sensitive data is essential.

This is the first of two separate articles, that will guide you through the complete setup and configuration process to integrate Azure Kubernetes Services and Azure Key Vault securely without leaking essential data about your Service Principal.

Inspect your Kubernetes inventory in no time with ASP.NET Core and Kubernetes Client Library

Tue, 04 Dec 2018 00:00:00 +0000

Running and maintaining complex applications on Kubernetes often requires good monitoring capabilities. Sure, there are plenty of products available which can be deployed easily to an existing cluster to get insights about the current cluster inventory. But why not build your own?

In this post, I’ll guide you through the process of creating a simple ASP.NET Core Web API to expose your cluster’s inventory - such as Pods for example - to other applications in order to get exactly those insights that are important for you. I used the following example frequently during public talks to explain the core concepts of Kubernetes to .NET developers.

Integrating Azure Key Vault with Azure Container Services

Fri, 11 May 2018 00:00:00 +0000

With Azure Key Vault, Microsoft is offering a dedicated and secure service to manage and maintain sensitive data like Connection-Strings, Certificates, or key-value pairs.

We’re hoping to see a native Azure Key Vault integration for Azure Container Services (ACS) in the near future. At least the official FAQ mentions the feature on the product’s roadmap. Until this features will be shipped and if you’re using another Kubernetes environment - such as GCP or AWS offerings -, you’ve to integrate Azure Key Vault manually into your application building blocks to get rid of storing most sensitive data in plain old Kubernetes Secrets.

Limit resources for containers with LimitRanges in Kubernetes

Thu, 22 Mar 2018 00:00:00 +0000

When deploying applications to Kubernetes one of the most important things to specify are resource-requests and -limits. Having proper limits defined per Container makes it easier to optimize the hardware utilization for all worker nodes in a Kubernetes cluster.

When creating deployments, you can set resource-requests and -limits by using the resources property on each container as part of the podspec. See the official documentation for further information .

Unfortunately, those properties are not mandatory, so every developer has to remember providing requests and limits for both memory and cpu.

Upgrading a Kubernetes cluster on AKS using Azure CLI

Thu, 22 Mar 2018 00:00:00 +0000

Upgrading an on-premises Kubernetes cluster can be very cumbersome and time-consuming task. It’s not just a single upgrade command that you can execute and everything happens magically behind the scenes. A single command for upgrading an entire Kubernetes cluster would be awesome 💚 and that’s exactly what’s provided by the AKS team. A single command to upgrade all your masters and nodes.

My fellow MVP Tobias Zimmergren wrote a great post on how to upgrade AKS clusters a couple of weeks ago. But technology and tools are changing quickly these days.

CronJobs on AKS using Azure Files and .NET Core

Wed, 21 Feb 2018 00:00:00 +0000

Tasks need to be executed repeatedly in almost every application. We all know requirements like these. Perhaps you have to clean up some tables in the database or you’ve to delete temporary files, no matter which requirement you’ve exactly, but CronJobs in Kubernetes are exactly designed for scenarios like these. Kubernetes offers CronJobs as first-class citizen objects. In the scope of Kubernetes, a CronJob should be used if you want to execute a piece of software either at a specified point in time or repeatedly at specified points in time. Technically it’s just a regular Pod with a schedule definition. You’ve to provide your schedule using the good old cron format .

Deploy Azure Functions to Kubernetes and scale them automatically

Fri, 26 Jan 2018 00:00:00 +0000

Azure Functions has become my standard framework to build serverless backends for Single Page Applications (SPAs). It’s easy to get started with Azure Functions, although the platform itself is really powerful and highly configurable. I really love the cloud hosting capabilities for Azure Functions, but from time to time, it’s not allowed to use the public cloud as the deployment target.

Azure Functions can easily be hosted in different environments. You can download the entire runtime and execute it on-premises (if you have to) or you can use the existing Docker image and deploy your serverless backend to Kubernetes. And that’s exactly what this post will describe, you’ll create a sample Azure Functions project including a docker container, deploy it to a Kubernetes cluster and let it automatically scale based on CPU utilization.

Hybrid Kubernetes Cluster on Azure Container Services

Sat, 26 Aug 2017 00:00:00 +0000

Using Azure Container Services (ACS) you can easily build hybrid kubernetes clusters. In this context, hybrid means that you’ll end up having a kubernetes cluster with both, Linux Nodes and Windows Nodes.

In this article I’ll guide you through the process of creating a new hybrid kubernetes cluster on Azure Container Services.

Prerequisites

When starting from scratch, you need only a few things:

a Microsoft Azure Account
a Text Editor
a local installation of kubectl
Azure CLI 2.0 installed on your machine

Configuring Azure CLI

Once you’ve all the prerequisites in place, it’s time to care a bit about our Azure Subscription.

What to do if Pods stuck in state Pending while deploying to Azure Container Instances

Thu, 24 Aug 2017 00:00:00 +0000

Azure Container Instances (ACI) allows you to spin up containers in the cloud without creating or managing any kind of infrastructure. It’s really bringing container as a service to you. That said, ACI is no replacement for Container Orchestration Systems like Kubernetes. It’s more an underlying infrastructure for hosting/running containers itself.

ACI integrates seamlessly with orchestrators like Kubernetes. You can use the ACI connector for Kubernetes to create an ACI node on your Kubernetes cluster. See this repo for more details .

Autocompletion for kubectl and aliases using oh-my-zsh

Tue, 22 Aug 2017 00:00:00 +0000

Kubernetes is managed and used by utilizing the command line interface kubectl. I got a ton of questions regarding my terminal configuration for daily k8s tasks. Questions like “Which aliases do you use for regular k8s tasks?” or “How did you get autocompletion for all the k8s stuff up and running on your mac?” So this post will answer those questions quickly to ensure everyone will become more productive and can spin up even more pods and nodes in less time 🚀

Using Azure Files in Kubernetes Deployments with ASP.NET Core

Mon, 21 Aug 2017 00:00:00 +0000

Azure Container Services (ACS) makes it incredibly easy to spin up and manage Kubernetes clusters in the cloud. There are plenty of other Azure resources which you can use to build daily scenarios on a native cloud stack. Common scenarios are serving files from and writing important information to persisted locations. Azure offers many different storage capabilities. In this post, I’ll explain how to use an Azure File Share to serve content by using a .NET Core Web API.

How to use a private Azure Container Registry with Kubernetes

Fri, 18 Aug 2017 00:00:00 +0000

Besides using the goodness of Azure Container Services (ACS). Different Azure services like Azure Container Registry (ACR) and Azure Container Instances (ACI) can be used and connected from independent container orchestrators like kubernetes (k8s). This post will explain how to set up a custom ACR and connect it to an existing k8s cluster to ensure images will be pulled from the private container registry instead of the public docker hub.