Pinned

[Playground]Provision a k8s cluster with terraform & kubeadm and use Calico as CNI on Azure

The code can be found in github https://github.com/Shuanglu/k8s_infra_azure There are some limitations like Calico CIDR is using the default one. I’m working on a golang program to provide more customization. [Architecture] [Provision Process]

Azure

2 min read

Jul 15

Remote debug Istio controlplane with delve in VSCODE

Remote debug Istio controlplane with delve in VSCODE Clone the istio repo Update the docker filewith ‘devle’ following the istio wiki Build image with debug enabled following the mentioned wiki as well. The github action can help if there is no container runtime in local to build. Update the image to the istiod deployment and update the ‘readOnlyRootFilesystem’ to ‘false’ Build tunnel with ‘port-forward’ between local and the istiod pod at port 40000

Istio

1 min read

Remote debug Istio controlplane with delve in VSCODE

Clone the istio repo
Update the docker filewith ‘devle’ following the istio wiki
Build image with debug enabled following the mentioned wiki as well. The github action can help if there is no container runtime in local to build.
Update the image to the istiod deployment and update the ‘readOnlyRootFilesystem’ to ‘false’
Build tunnel with ‘port-forward’ between local and the istiod pod at port 40000
Configure the ‘.vscode/launch.json’ like below in the local istio repo if the image is built with github action. May need to add ‘substitutePath’ if necessary.

Insert the ‘breakpoints’ in the code and launch the ‘debugging’

Mar 27

What happens when volumeManager in the kubelet starts?

What happens when volumeManager in the kubelet starts? TL;DR The volumeManager is initialized along with the initialization of kubelet and is started by kubelet as well. …

Kubernetes

7 min read

What happens when volumeManager in the kubelet starts?

Jan 11, 2021

[Playground] Azure CNI initialization log/source code analysis

Azure CNI in one of the CNI plugins AKS provides. Below example is based on an AKS cluster. The k8s version is 1.18.10 and CNI version is v1.2.0_hotfix. What? network The info of virtual network CNI creates endpoint The info of pod’s networking CNI creates netPlugin The parent plugin created when…

Azure

9 min read

Jan 6, 2021

How does AKS provision a Windows node

Generally speaking the process are two parts. Part-1: The 1st part is to provision the resources on Azure platform like control plane, networking, identity and virtual machine. Part-2: The 2nd part is to use the features of Azure virtual machine like custom data and custom script extension to install/configure kubelet related components…

Azure

2 min read

Nov 10, 2020

Tiny tool to help capture network traces in the pods running in k8s cluster

Download URL: Shuanglu/k8sTcpdump The tool is to use the 'tcpdump' to capture the network trace of the pod The access to create privileged pod The access…github.com Input the “name” of the pod and “namespace” of the pod to the “xxx.json”. Example is “example/test.json” Run “./k8sTcpdump -p xxx.json” and it will bring up pods on the corresponding nodes to capture the network traces of the target pods. The ‘.cap’ file will be downloaded to the…

Kubernetes

1 min read

Tiny tool to help capture network traces in the pods running in k8s cluster

Download URL:

Shuanglu/k8sTcpdumpThe tool is to use the 'tcpdump' to capture the network trace of the pod The access to create privileged pod The access…
github.com

Input the “name” of the pod and “namespace” of the pod to the “xxx.json”. Example is “example/test.json”
Run “./k8sTcpdump -p xxx.json” and it will bring up pods on the corresponding nodes to capture the network traces of the target pods. The ‘.cap’ file will be downloaded to the…

Oct 22, 2020

[Troubleshooting notes]In the AKS cluster, pods in a separate subnet cannot connect to the Internet

Issue: In the AKS cluster, pods in a separate subnet(172.16.3.0/24) cannot connect to the Internet Environment: cloudprovider: AKS version: 1.17.11 NetworkPolicy: Calico NetworkPlugin: Azure nodepools: agentpool | 172.16.2.0/24 test | 172.16.3.0/24 Troubleshooting steps: Login to the node where the pod is running and run the test like ‘curl -v 216.58.193.78’…

K 8 S

3 min read

[Troubleshooting notes]In the AKS cluster, pods in a separate subnet cannot connect to the…

Jul 16, 2020

[playground]Azure Policy template analysis in AKS

Azure Policy in AKS is in-preview. Reviewed the deployment and found it uses open policy agent. Below are some language references for the constraint template created. https://raw.githubusercontent.com/Azure/azure-policy/master/built-in-references/Kubernetes/container-allowed-capabilities/template.yaml Introduction The Open Policy Agent (OPA, pronounced "oh-pa") is an open source, general-purpose policy engine that unifies policy…www.openpolicyagent.org

Azure

2 min read

Published in FAUN Publication

·May 28, 2020

Webhook authentication using Azure Active Directory(AAD) for k8s cluster on Azure

Glossary: Native client A type of client application that is installed natively on a device. It’s behalf of the human user while authenticating with AAD. We name it “kubectl app” in this article. Microsoft identity platform developer glossary This article contains definitions for some of the core developer concepts and terminology, which are helpful when…docs.microsoft.com 2. Web Client A type of client application that executes all code on a web server, and…

Kubernetes

5 min read

k8s cluster on Azure integrates with Azure Active Directory(AAD) and webhook authentication

May 25, 2020

Access the Azure Container Registry using Azure Managed Identity programatically

Access the Azure Container Registry using Azure Managed Identity programatically Install the MSI to the VM Configure managed identities using the Azure portal - Azure AD Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active…docs.microsoft.com 2. Get the ARM access token from the MSI endpoint response=$(curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' -H Metadata:true -s)

Azure Kubernetes Service

2 min read

[Playground]Provision a k8s cluster with terraform & kubeadm and use Calico as CNI on Azure

Remote debug Istio controlplane with delve in VSCODE

What happens when volumeManager in the kubelet starts?

[Playground] Azure CNI initialization log/source code analysis

How does AKS provision a Windows node

Tiny tool to help capture network traces in the pods running in k8s cluster

Tiny tool to help capture network traces in the pods running in k8s cluster

Shuanglu/k8sTcpdump

The tool is to use the 'tcpdump' to capture the network trace of the pod The access to create privileged pod The access…

[Troubleshooting notes]In the AKS cluster, pods in a separate subnet cannot connect to the Internet

[playground]Azure Policy template analysis in AKS

Webhook authentication using Azure Active Directory(AAD) for k8s cluster on Azure

Access the Azure Container Registry using Azure Managed Identity programatically

ShuangLu