Pinned[Playground]Provision a k8s cluster with terraform & kubeadm and use Calico as CNI on AzureThe code can be found in github https://github.com/Shuanglu/k8s_infra_azure There are some limitations like Calico CIDR is using the default one. I’m working on a golang program to provide more customization. [Architecture] [Provision Process]Azure2 min readAzure2 min read
Mar 17Some unexpected failures when migrating from Docker to ContainerdThanks to Chat-GPT! This is a polished version with the help from Chat-GPT. Recently, I have been working on upgrading some Kubernetes clusters. Initially, the upgrade was not a complex task, but it became challenging when I had to migrate the runtime from Docker to Containerd. …Kubernetes3 min readKubernetes3 min read
Jul 15, 2022Remote debug Istio controlplane with delve in VSCODERemote debug Istio controlplane with delve in VSCODE Clone the istio repo Update the docker filewith ‘devle’ following the istio wiki Build image with debug enabled following the mentioned wiki as well. The github action can help if there is no container runtime in local to build. Update the image to the istiod deployment and update the ‘readOnlyRootFilesystem’ to ‘false’ Build tunnel with ‘port-forward’ between local and the istiod pod at port 40000Istio1 min readIstio1 min read
Mar 27, 2022What happens when volumeManager in the kubelet starts?What happens when volumeManager in the kubelet starts? TL;DR The volumeManager is initialized along with the initialization of kubelet and is started by kubelet as well. …Kubernetes7 min readKubernetes7 min read
Jan 11, 2021[Playground] Azure CNI initialization log/source code analysisAzure CNI in one of the CNI plugins AKS provides. Below example is based on an AKS cluster. The k8s version is 1.18.10 and CNI version is v1.2.0_hotfix. What? network The info of virtual network CNI creates endpoint The info of pod’s networking CNI creates netPlugin The parent plugin created when…Azure9 min readAzure9 min read
Jan 6, 2021How does AKS provision a Windows nodeGenerally speaking the process are two parts. Part-1: The 1st part is to provision the resources on Azure platform like control plane, networking, identity and virtual machine. Part-2: The 2nd part is to use the features of Azure virtual machine like custom data and custom script extension to install/configure kubelet related components…Azure2 min readAzure2 min read
Nov 10, 2020Tiny tool to help capture network traces in the pods running in k8s clusterDownload URL: Shuanglu/k8sTcpdump The tool is to use the 'tcpdump' to capture the network trace of the pod The access to create privileged pod The access…github.com Input the “name” of the pod and “namespace” of the pod to the “xxx.json”. Example is “example/test.json” Run “./k8sTcpdump -p xxx.json” and it will bring up pods on the corresponding nodes to capture the network traces of the target pods. The ‘.cap’ file will be downloaded to the…Kubernetes1 min readKubernetes1 min read
Oct 22, 2020[Troubleshooting notes]In the AKS cluster, pods in a separate subnet cannot connect to the InternetIssue: In the AKS cluster, pods in a separate subnet(172.16.3.0/24) cannot connect to the Internet Environment: cloudprovider: AKS version: 1.17.11 NetworkPolicy: Calico NetworkPlugin: Azure nodepools: agentpool | 172.16.2.0/24 test | 172.16.3.0/24 Troubleshooting steps: Login to the node where the pod is running and run the test like ‘curl -v 216.58.193.78’…K8s3 min readK8s3 min read
Jul 16, 2020[playground]Azure Policy template analysis in AKSAzure Policy in AKS is in-preview. Reviewed the deployment and found it uses open policy agent. Below are some language references for the constraint template created. https://raw.githubusercontent.com/Azure/azure-policy/master/built-in-references/Kubernetes/container-allowed-capabilities/template.yaml Introduction The Open Policy Agent (OPA, pronounced "oh-pa") is an open source, general-purpose policy engine that unifies policy…www.openpolicyagent.orgAzure2 min readAzure2 min read
Published in FAUN Publication·May 28, 2020Webhook authentication using Azure Active Directory(AAD) for k8s cluster on AzureGlossary: Native client A type of client application that is installed natively on a device. It’s behalf of the human user while authenticating with AAD. We name it “kubectl app” in this article. Microsoft identity platform developer glossary This article contains definitions for some of the core developer concepts and terminology, which are helpful when…docs.microsoft.com 2. Web Client A type of client application that executes all code on a web server, and…Kubernetes5 min readKubernetes5 min read
![[playground]Provision a k8s cluster with terraform & kubeadm and use Calico as CNI on Azure](https://miro.medium.com/v2/resize:fill:224:224/1*8ZMYr6C6T-KSHKclwgLpCw.jpeg)
![[playground]Provision a k8s cluster with terraform & kubeadm and use Calico as CNI on Azure](https://miro.medium.com/v2/resize:fill:160:112/1*8ZMYr6C6T-KSHKclwgLpCw.jpeg)
![[Playground] Azure CNI log/source code analysis](https://miro.medium.com/v2/resize:fill:224:224/1*99egSodIfCGuqh_pylJ35Q.png)
![[Playground] Azure CNI log/source code analysis](https://miro.medium.com/v2/resize:fill:160:112/1*99egSodIfCGuqh_pylJ35Q.png)
![[Troubleshooting notes]In the AKS cluster, pods in a separate subnet cannot connect to the…](https://miro.medium.com/v2/resize:fill:224:224/1*dMmhnvIL_2m6orY2UlrnnA.png)
![[Troubleshooting notes]In the AKS cluster, pods in a separate subnet cannot connect to the…](https://miro.medium.com/v2/resize:fill:160:112/1*dMmhnvIL_2m6orY2UlrnnA.png)
