aks | Authoritative PGP Key Server | DNS library
kandi X-RAY | aks Summary
kandi X-RAY | aks Summary
Authoritative PGP Key Server
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of aks
aks Key Features
aks Examples and Code Snippets
Community Discussions
Trending Discussions on aks
QUESTION
We need to disable the automount of service account from our existing deployments in AKS cluster. There are 2 ways to do by adding the property "automountserviceaccount : false" in either in the service account manifest or pod template.
We are using separate service account specified in our application deployments, however when we looked in the namespace, there are default service account also created.
So inorder to secure our cluster, do we need to disable the automount property for both default and application specific service accounts?.
Since our app already live, will there be any impact by adding this to the service account s.
How to know the used service accounts of a pod and it's dependencies ?
...ANSWER
Answered 2021-Jun-14 at 16:55So inorder to secure our cluster, do we need to disable the automount property for both default and application specific service accounts?.
The design behind the default
ServiceAccount is that it does not have any rights unless you give them some. So from a security point of view there is not much need to disable the mount unless you granted them access for some reason. Instead, whenever an application truly needs some access, go ahead and create a ServiceAccount for that particular application and grant it the permissions it needs via RBAC.
Since our app already live, will there be any impact by adding this to the service account s.
In case you truly want to disable the mount there won't be an impact on your application if it didn't use the ServiceAccount beforehand. What is going to happen though, is that a new Pod will be created and the existing one is being delete. However, if you properly configured readinessProbes and a rolling update strategy, then Kubernetes will ensure that there will be no downtime.
How to know the used service accounts of a pod and it's dependencies ?
You can check what ServiceAccount a Pod is mounting by executing kubectl get pods -o yaml
. The output is going to show you the entirety of the Pod's manifest and the field spec.serviceAccountName
contains information on which ServiceAccount the Pod is mounting.
QUESTION
I am running a GitHub agent inside AKS cluster with Docker installed. I can run it successfully with VFS storage driver, however I want to use Overlay 2 because it's faster. I get the following message:
...ANSWER
Answered 2021-Jun-13 at 01:12overlay overlay 49G 20G 29G 41% /
QUESTION
I am using Azure kubernetes service. While creating the AKS iam using service principle for autentication. I am deployed the AKS through power shell script.
...ANSWER
Answered 2021-Jun-12 at 20:41There is nothing around AKS to automate this, you'll need to schedule a job or a pipeline that take care of the renewal. With that said, to avoid having to do that you should consider using a Managed Identity instead of a Service Principle. The Identity is a kind of wrapper around a Service Principal that takes care of the renewal, thus it is easier to maintain.
QUESTION
i'm working on a new idea for which I've created a setup as follows on Azure Kubernetes:
- 1 cluster
- 1 node pool in said cluster
- 1 deployment which creates 2 pods in the pool
- 1 load balancer service balancing requests between the 2 pods
I'm trying to submit a json request into the loadbalancer from outside the cluster with an AKS IP, to which i encounter 502 Bad Gateway issues.
This is my deployment file
...ANSWER
Answered 2021-Jun-11 at 06:40I don't see below annotations in your Ingress..
Can you add them and try?
QUESTION
I observe that the element, though it points to a valid
Dockerfile
is not honored by liberty:devc
.
Consider this output from mvn help:effective-pom
:
ANSWER
Answered 2021-Jun-11 at 00:28You need to add your configuration at the plugin level rather than the execution level.
So it should look more like:
QUESTION
At present, we have a Java spring boot application deployed on the VM which consumers the message from Kafka.
We have an Enterprise Kafka Cluster deployed on the VMs. It uses the standard ports - eg: 9092 & 2181.
Requirement: We want to deploy this application Azure Kubernetes Services (AKS).
Ask : Is there anything specific (eg: port ) needs to be done in the dockerfile or kubernetes manifest yaml?
I would assume that as long as the AKS can connect (VNET - VNET) with the Kafka Cluster that should be sufficient.
please suggest.
...ANSWER
Answered 2021-Jun-09 at 22:36Kafka clients don't need to expose any port mappings
Your assumption is correct, that given the proper VPC settings, then communicate should be fine.
QUESTION
I'm using Azure Container Insights for an AKS cluster and want to filter some logs using Log Analytics and Kusto Query Language. I do it to provide a convenient dashboard and alerts.
What I'm trying to achieve is list only not ready pods. Listing the ones not Running is not enough. This can be easily filtered using kubectl e.g. following this post How to get list of pods which are "ready"? However this data is not avaiable when querying in Log analytics with Kusto as the containerStatuses seems to be only a string
It should be somehow possible because Container Insights allow this filtering in Metrics section. However it's not fully satisfying because with metrics my filtering capabilities are much smaller.
...ANSWER
Answered 2021-May-31 at 14:22You can do it for pods as below for last 1h.
QUESTION
I am having lookups.tf file with the below content
...ANSWER
Answered 2021-Jun-08 at 13:26You have to use a different syntax when locals
block is defined. This should be added instead of what you currently have:
QUESTION
I have taken up the challenge of automating the deployment of my company's Django-based application that is done with AKS but I am very new to it. My initial idea is to accomplish it by upgrading the steps in a GitHub workflow that acts on the release of a new version.
I have structured it with three jobs. build
, migrate
and deploy
:
build
: Simply build the Docker image and push it to the container registry on DockerHub - this step is successfully done.migrate
: Run the migrations in the production database frompython manage.py migrate
- here lies the problem.deploy
: Deploy the image to the Kubernetes cluster - successfully done.
Step 2 is the problem because we store the Postgres database credentials inside the Kubernetes cluster and to run the migrations I need those secrets to pass them as environment variables before I call the migrate
command. So I am stuck on how I can pull those secrets from Kubernetes and use them to run a command in a step in GitHub action like this:
ANSWER
Answered 2021-Jun-03 at 10:51You can rub db migrations from Kubernetes cluster itself.
- Create a Kubernetes Job, which basically runs db migration. and
- Deploy an init container before main container(application), which periodically checks db migration job completion.
QUESTION
I am using Azure Kubernetes Service (AKS) and want to make sure pods inside a specific namespace can only receive ingress traffic from other pods in the same namespace.
I found this network policy to achieve this namespace isolation (from here):
...ANSWER
Answered 2021-Jun-02 at 11:40Looks like you hit a known problem in AKS clusters v1.19+ around "Pod IP SNAT/Masquerade behavior".
How it affects clusters using Calico's plugin for Network Policies was explained there by other users:
Just for information of other users, this issue causes problem for a NetworkPolicy with podSelector configs. Since the policy will be set based on the ipset of the pods in the IPtables by Calico, but the source IP of the packet is set to the node IP and even the packets that are supposed to be allowed will be dropped.
Please read more about this problem in github issue #2031, along with the hard fix (node image upgrade) or workaround (run Daemonset creating SNAT exemption in iptables).
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install aks
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page