Managing Planned Maintenance for Azure Container Apps

Azure Container App is a fully managed Azure service that receives regular updates automatically. These updates are applied with minimal impact on the container applications. However, Azure Container App users can now define a maintenance window, allowing them to schedule service maintenance at a convenient time. This ensures application availability during important periods without downtime due to service maintenance.

There are two types of service updates, critical and non-critical updates. Critical updates are applied immediately when required, and users cannot set a maintenance window for them. However, maintenance windows can be set for non-critical updates. This blog explains how to set a maintenance window for Azure Container App using a GitHub Action pipeline.

Enhance Your Azure Kubernetes Service Experience with GitHub Copilot Plugins

This blog explains how to use GitHub Copilot Chat to perform various Azure Kubernetes Service (AKS) tasks, such as creating an AKS cluster and generating kubectl commands to interact with the cluster.

Prerequisites:

• GitHub Copilot and GitHub Copilot for Azure installed
• Azure Kubernetes Service extension for Visual Studio Code installed

Enabling Azure Container Storage Monitoring with Managed Prometheus

Azure Monitor Managed Service for Prometheus is a fully managed monitoring solution in Azure Monitor. It allows us to collect Prometheus metrics from Azure Kubernetes Services (AKS) clusters to monitor the workload.

This blog provides a guide on monitoring stateful workloads running on Azure Container Service within an Azure Kubernetes Service (AKS) cluster with managed Prometheus enabled.

Simplifying Docker Authentication in Azure DevOps with Azure Workload Identity

Credential based authentication methods have several disadvantages such as security risks and secret management overhead. As a solution Azure Managed Identity and Azure Workload Identity can be used as modern and secure, non-credential-based authentication method for workloads running outside or inside Azure.

Workload Identity Federation can now be used with Azure DevOps Docker service connection targeting Azure Container Registry. This blog will explain how to use workload Identity with Azure DevOps Docker service connection.

Ensuring Outbound Rules of Azure App Service

In situations where Azure App Service is configured with network protection, it is crucial to know which systems and applications have access to the App Service, and which applications and systems can be accessed from the App Service (outbound). This blog explains a simple but useful trick that can be used to check the outbound rules of the App Service.

Prerequisites: Azure App Service with restricted internet access

How to Reset Azure VM Password for Domain Controller

This blog explains how to reset the Azure domain controller VM's password when the local administrator password expires.

Pre-requites: Azure VM as a domain controller and expired local administrator password

Resetting the Azure VM password using the "Reset password" option under the Help in the Service menu will give the following error. "VMAccess Extension does not support Domain Controller." The solution is to use the Run Command to reset the local administrator password.

Promote Azure Snapshot with Azure CLI

Azure Storage account blobs facilitate versioning through two mechanisms, blob versioning and blob snapshots. Blob versioning creates a new version with each edit, while blob snapshots allow you to take a snapshot of the current blob and make changes to it. Both mechanisms enable users to revert to a previous version or a created snapshot if needed and recover the data.

This blog explains how to revert to a blob snapshot using an automated script.

Prerequisite: Azure DevOps blob

Bringing Role Assignments into Terraform State Management

Terraform is an infrastructure automation tool that keeps track of the state of your infrastructure managed by Terraform in a state file. It serves as a snapshot of the actual infrastructure. Therefore, Keeping Terraform state file up to date is crucial. If a new resource added or any manual changes are made to the actual resource, it is important to import those changes into the state file. This blog explains how to import manually added role assignment to the terraform state file.

Pre-requisites: Manually add User Access Administrator Role to the Azure resource group.

Deploy Azure Container App with Azure CLI

This blog explains how to setup an Azure DevOps release pipeline to deploy a container app to the Azure Container Environment using an Azure CLI script.

Pre-requisites: 

• Azure DevOps deployment pipeline
•  Azure container app environment 
• Azure Container registry

Add an Azure CLI task to the Azure DevOps pipeline and add following script. The script installs a few required extensions and create a container app.

Verify Terraform Configurations Using Terraform Test

This blog explains how to use the terraform test framework to verify that new changes do not break existing resources. 

Pre-requisites: Follow this blog and configure a terraform project with a test file.

The sample terraform project configure a resource group and a storage account in Azure.

Getting Started with Terraform Test

This blog explains how to use new terraform test framework to test infrastructure automation scripts.

Pre-requisites: Install Terraform v1.6.0 or later version, Azure subscription, code editor (Visual studio code use as the code editor in this blog)

What is the use of terraform test?

Terraform has introduced new test framework which helps to achieve followings.

• Validate terraform configuration updates and get verified new changes does not introduce any breaking changes.
• Terraform test supports running test against test environment which allows to create short lived resources without breaking existing resources.

Set Longer Expiration date for Azure SPN Client Secrets

Azure SPN client secret expiration period can be set as 3 months, 6 months, 12 months, 18 months and 24 months via Azure portal. Other than the above-mentioned fixed time durations, there is an option to select customize expiration period for client secrets. However, maximum duration allowed to select as the secret end date is 24 months. 

Container App Deployment with YAML Template

This blog explains how to deploy an Azure container app using a YAML template.

Pre-requisites: 

1. Azure container app environment
2. Azure container registry with docker image

Create a YAML file and add following content to it. 

Add values for Container App name, resource group name, Azure subscription id where resources going to be created, Container App Environment name and resource group, Azure Container Registry (ACR) name, ACR username, ACR password, image path and image tag.

Deploy Azure Container App Environment Using Terraform

Azure container app environment is fully managed environment to run containerized applications. This blog contains terraform script that can be used to deploy Azure Container App Environment with internal only ingress which means accessible only from VNet. You can find the complete code sample in GitHub here.

Use an Image from Azure Container Registry in a Different Subscription from an Azure Container App

This blog explains the limitation and a workaround to access Azure Container Registry from Container App Environment when the two resources are in two separate subscriptions.

Pre- requisites: Azure Container App and Azure Container Registry deployed to two separate subscriptions.

Go to Azure Container App and click on Containers. Then Click on Edit and Deploy.

How to Access Cognitive Service Translator API With Virtual Network Endpoint

Microsoft Cognitive Service translator accessible with Web API, Virtual Network and container endpoints. This blog explains how to access cognitive service with virtual network endpoint.

Pre-requisites: cognitive service translator

Go to translator app Networking under Resource Management. Select Firewalls and virtual networks tab.

How to Call Cognitive Service Translator API With Postman

This blog explains how to setup postman to test cognitive service translator. 

Pre-requisites: Cognitive service translator, access to postman

Open postman, add a new post request and add following configurations.

If the translator access limited to VNet use following URL format.

URL : https://your-translate-service-name.cognitiveservices.azure.com/translator/text/v3.0/translate?to=fr

ex: https://my-demo-translator.cognitiveservices.azure.com/translator/text/v3.0/translate?from=en&to=fr

Scan Code in Azure DevOps Build Pipelines Using Microsoft Security DevOps

Static code analysis is a mechanism to find and fix security vulnerabilities in source code without running the software. This blog explains how to integrate Microsoft Security DevOps to a build pipeline, which installs and configures static code analysis tools against your source code.

Pre-requisites: 

• Azure DevOps build pipeline
• Build agent which has .NET 6 (for MicrosoftSecurityDevOps build task) and NET 3.1 (CredScan analyzer) installed.

Terraform State List and Terraform Graph

This blog explains two useful commands available in Terraform.

Tip 01

You might have a requirement to view resources in terraform state file to get an idea on resources already applied with your Terraform script. But, if you try to do it by reading the state file, it is not an easy task. You can get list of resources available in Terraform state file with a simple command as explain below.

Resolve Chef Kitchen Verify Error "Cannot converge without accepting the Chef Infra Client License"

You might have experienced, Azure pipeline failing from kitchen verify step due to Chef Infra client License not accepted error while  creating a Chef test kitchen in Azure. Let's look at how to fix this issue in this post.