All the example codes are available in GitHub. Background Governance of cloud estates is challenging for businesses. It’s crucial to enforce security policies, workload redundancies, uniformity (such as naming conventions), simplify deployments with packaged artifacts (i.e., ARM templates), Azure role-based access control (Azure RBAC) across the enterprise. Generally, the idea is, a centralized team (sometimes … Continue reading Azure Resource Governance with Template Specs & Biceps
Azure DevOps Security & Permissions REST API
Every Few months I notice the following Saga repeats. I face a challenge where I need to programmatically manage security aspects of Azure DevOps resources (like Repository, Pipeline, Environment etc.). I do lookup the Azure DevOps REST API documentation, realize that the Permissions & Security API's are notoriously complicated and inadequately documented. So, I begin … Continue reading Azure DevOps Security & Permissions REST API
Manage Kubernetes running anywhere via Azure Arc
Azure Arc (currently in preview) allows attach and configure Kubernetes Clusters running anywhere (inside or outside of Azure). Once connected the clusters shows up in Azure portal and allows applying tags, policies like other resources. This brings simplicity and uniformity managing both cloud and on-premises resources in a single management pane (Azure Portal). Azure Arc … Continue reading Manage Kubernetes running anywhere via Azure Arc
Restricting Unverified Kubernetes Content with Docker Content Trust
Docker Content Trust (DCT) provides the ability to use digital signatures for data sent to and received from remote Docker registries. These signatures allow client-side or runtime verification of the integrity and publisher of specific image tags. Image source: Docker Content Trust Through DCT, image publishers can sign their images and image consumers can ensure … Continue reading Restricting Unverified Kubernetes Content with Docker Content Trust
Azure DevOps Multi-Stage pipelines for Enterprise AKS scenarios
Background Multi-Stage Azure pipelines enables writing the build (continuous integration) and deploy (continuous delivery) in Pipeline-as-Code (YAML) that gets stored into a version control (Git repository). However, deploying in multiple environments (test, acceptance, production etc.) needs approvals/control gates. Often different stakeholders (product owners/Operations folks) are involved into that process of approvals. In addition to that, … Continue reading Azure DevOps Multi-Stage pipelines for Enterprise AKS scenarios
Azure AD Pod Identity – password-less app-containers in AKS
Background I like Azure Managed Identity since its advent. The concept behind Managed Identity is clever, and it adds observable value to any DevOps team. All concerns with password configurations in multiple places, life cycle management of secrets, certificates, and rotation policies suddenly irrelevant (OK, most of the cases).Leveraging managed identity for application hosted in … Continue reading Azure AD Pod Identity – password-less app-containers in AKS
Azure AD App via ARM Template Deployment Scripts
Background ARM templates offer a great way to define resources and deploy them. However, ARM templates didn’t have any support to invoke or run scripts. If we wanted to carry out some operations as part of the deployment (Azure AD app registrations, Certificate generations, copy data to/from another system etc.) we had to create pre … Continue reading Azure AD App via ARM Template Deployment Scripts
Key Vault as backing store of Azure Functions
If you have used Azure function, you probably are aware that Azure Functions leverages a Storage Account underneath to support the file storage (where the function app code resides as Azure File share) and also as a backing store to keep Functions Keys (the secrets that are used in Function invocations). Figure: Storage Account containers … Continue reading Key Vault as backing store of Azure Functions
Terraforming Azure DevOps
Background In many organizations, specially in large enterprises there’s a need to automate Azure DevOps projects and Teams members. Manually managing large number of Azure DevOps projects, Teams for these projects and users to the teams, on-boarding and off-boarding team members are not trivial. Besides managing the users sometimes, we just need to have an … Continue reading Terraforming Azure DevOps
Access Control management via REST API – Azure Data Lake Gen 2
Background A while ago, I have built an web-based self-service portal that facilitated multiple teams in the organisation, setting up their Access Control (ACLs) for corresponding data lake folders. The portal application was targeting Azure Data Lake Gen 1. Recently I wanted to achieve the same but on Azure Data Lake Gen 2. At the … Continue reading Access Control management via REST API – Azure Data Lake Gen 2
Reverse Engineering 