mathieu-benoit / mathieu-benoit.github.io

The content of my blog hosted at: https://mathieu-benoit.github.io/

The content of my blog hosted there: https://mathieu-benoit.github.io/

mathieu-benoit.github.io's Issues

Generate a Release entry for every successful build

Like in there https://github.com/mathieu-benoit/cartservice/blob/main/.github/workflows/ci.yml#L79, create a Release entry for every successful build.

better images' alt-text descriptions for accessibility

better images' alt-text descriptions for accessibility: https://bighack.org/how-to-write-better-alt-text-descriptions-for-accessibility/

Broken links with Missing Files in 2019-07 - azure-pipelines-for-k8s

Hi,

I would be very thankful if you can provide the missing files from your article:

• azure-pipelines.yml
• build-steps-template.yml
• stage-steps-template.yml

https://github.com/Azure/phippyandfriends/blob/mathieu-benoit/azure-pipelines/common/build-steps-template.yml

Best regards

robots.txt doesn't exist

https://gohugo.io/templates/robots/

Implement Privacy settings

https://gohugo.io/about/hugo-and-gdpr/#all-privacy-settings

Issue Template (Comment, Feedback, etc.)

K8s Config Connector for IP Address

https://github.com/GoogleCloudPlatform/k8s-config-connector/tree/master/samples/tutorials/configuring-domain-name-static-ip

Pod Security Context

Setup appropriate Pod Security Context according to this: https://blog.asksven.io/posts/securing-kubernetes-configuration/

• runAsUser: 1000
• runAsNonRoot: true
• image: nginxinc/nginx-unprivileged
• allowPrivilegeEscalation: false
• readOnlyRootFilesystem: true
• emptyDir: {}

Log-based alerts

https://cloud.google.com/logging/docs/alerting/log-based-alerts

• 404s?
• 500s?
• Events in error in namespace?
• NetworkPolicies DENYs in namespace

And generate them in Chat room via Webhook: https://cloud.google.com/monitoring/support/notification-options

distroless?

Why not using the new distroless distrib? https://github.com/distroless/nginx

• https://github.com/GoogleContainerTools/distroless
• https://github.com/kyos0109/nginx-distroless/blob/master/Dockerfile
• https://github.com/abdennour/dockerfiles/blob/master/docker-images/nginx-distroless-unprivileged/Dockerfile
• https://github.com/nginxinc/docker-nginx-unprivileged/blob/main/stable/alpine/Dockerfile
• https://github.com/GoogleCloudPlatform/cloud-builders-community/blob/master/hugo/Dockerfile
• https://abdennoor.medium.com/extrem-secure-docker-image-for-nginx-kubernetets-hardening-f395b82308fd

Migrate to the new way to use the ingress-nginx helm chart

kubernetes/ingress-nginx#5161

Use the NGINX Prometheus Exporter to get more monitoring metrics?

• https://github.com/nginxinc/nginx-prometheus-exporter as a sidecar?
  • https://sysdig.com/blog/monitor-nginx-kubernetes/
• to be able to get more metrics like these: https://cloud.google.com/monitoring/api/metrics_kubernetes#kubernetes-nginx?

Automate Monitoring Dashboards creation

https://cloud.google.com/solutions/managing-monitoring-dashboards-automatically-using-the-api

Review final Docker image without Hugo in it

404 page

https://gohugo.io/templates/404/

Org Policy - Public IP address

Set Org Policies like for example Public IP restriction: https://www.youtube.com/watch?v=SiZ5b4a4EUY and actually set an allow policy for the Public IP address necessary for myblog.

ssl policy

• https://cloud.google.com/load-balancing/docs/ssl-policies-concepts
• https://cloud.google.com/load-balancing/docs/use-ssl-policies

Like described here https://github.com/GoogleCloudPlatform/gke-networking-recipes/tree/master/ingress/secure-ingress, I will do apply the default values:

If you do not choose one of the three pre-configured profiles or create a custom SSL policy, your load balancer uses the default SSL policy. The default SSL policy is equivalent to an SSL policy that uses the COMPATIBLE profile with a minimum TLS version of TLS 1.0.

gcloud compute ssl-policies create gke-ingress-ssl-policy \
    --profile COMPATIBLE  \
    --min-tls-version 1.0

And then attach it to my Ingress like described here https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#ssl

RSS

https://gohugo.io/templates/rss/

Hi I am following the link https://alwaysupalwayson.com/posts/2019/07/ci-cd-with-helm-chart/ to create the Helm Charts on AKS using ACR. But I am facing multiple issues.

Hi I am following the link https://alwaysupalwayson.com/posts/2019/07/ci-cd-with-helm-chart/ to create the Helm Charts on AKS using ACR. But I am facing multiple issues.

CI pipeline working fine by adding suggested changes. But not getting any value for helmChartVersion.

- bash: |
    chartPackage=$(ls $(projectName)-*.tgz)
    chartVersion=$(echo $(basename $chartPackage) | egrep -o '[0-9].*[0-9]')
    chartVersionAlreadyExists=$(az acr helm list \
                                    -n $(registryName) \
                                    -u $(registryLogin) \
                                    -p $(registryPassword) \
                                    --query "$(projectName)[?version=='$chartVersion'].version" \
                                    -o tsv)
    if [ "$chartVersion" != "$chartVersionAlreadyExists" ]; then
        az acr helm push \
            -n $(registryName) \
            -u $(registryLogin) \
            -p $(registryPassword) \
            $chartPackage
    fi
    echo $(jq -n --arg version "$chartVersion" '{helmChartVersion: $version}') > $(build.artifactStagingDirectory)/variables.json
  name: helmPush
  displayName: 'az acr helm push'

The problem is CD pipeline is not working at all.

Snippet:

I have tried multiple things:

- bash: |
   az login \
        --service-principal \
        -u=$(aksSpId) \
        -p='$(aksSpSecret)' \
        --tenant=$(aksSpTenantId)
    az aks get-credentials \
        -n $(aks) \
        -g $(rg)

    echo " the value of login is $(registryLogin) "
    echo "the value of password is $(registryPassword)"
    echo " the value of namespace is $(k8sNamespace) "
    echo "the value of project is $(projectName)"
   
    echo "the value of registry server name is $(registryServerName)"

    az acr login --name $(registryName) --username $(registryLogin) --password '$(registryPassword)'

    az acr helm repo add \
        --name $(registryName).azurecr.io/parrot \
        --username $(registryLogin) \
        --password '$(registryPassword)'

    helm repo update   

    helm search repo cnlabacrcohort17

    helmChartVersion=$(jq .helmChartVersion $(pipeline.workspace)/ci-pipeline/build-artifact/variables.json -r)

    echo "the value of helm chart version $helmChartVersion"

    helm registry login $(registryName).azurecr.io/parrot --username helmdemopush --password 'xxx'  

    helm repo update

    az acr helm list -n $(registryName) -u $(registryLogin) -p $(registryPassword) --query "$(projectName)[?version=='$chartVersion'].version" -o tsv

    #helm chart save $(pipeline.workspace)/ci-pipeline/build-artifact $(registryName).azurecr.io/cnlabacrcohort17:latest

    helm chart push $(registryName).azurecr.io/cnlabacrcohort17:1.0.0

    helm chart pull $(registryName).azurecr.io/cnlabacrcohort17/parrot:1.0.0

    helm chart export $(registryName).azurecr.io/cnlabacrcohort17/parrot:1.0.0 --destination $(build.stagingdirectory)

    helm install parrot \
      --namespace $(k8sNamespace) \
      --version 1.0.0 \
      --set image.repository=cnlabacrcohort17/parrot \
      --username helmdemopush \
      --password 'xxx' \
      --generate-name
      --debug \
      --wait 
  failOnStderr: true
  displayName: 'deploy helm chart'

But Getting below error:

2022-09-28T13:49:22.2828588Z Update Complete. ⎈ Happy Helming!⎈ 
2022-09-28T13:49:22.3197055Z NAME                   	CHART VERSION	APP VERSION	DESCRIPTION                                       
2022-09-28T13:49:22.3198512Z cnlabacrcohort17/parrot	182          	182        	Parrot is Captain Kube's sidekick, who shows ev...
2022-09-28T13:49:22.3546146Z the value of helm chart version 
2022-09-28T13:49:22.3862427Z WARNING! Using --password via the CLI is insecure. Use --password-stdin.
2022-09-28T13:49:23.3589479Z Login succeeded
2022-09-28T13:49:23.3950802Z Hang tight while we grab the latest from your chart repositories...
2022-09-28T13:49:24.0566941Z ...Successfully got an update from the "cnlabacrcohort17" chart repository
2022-09-28T13:49:24.0567965Z Update Complete. ⎈ Happy Helming!⎈ 
2022-09-28T13:49:24.3715024Z WARNING: This command is implicitly deprecated because command group 'acr helm' is deprecated and will be removed in a future release. Use 'helm v3' instead.
2022-09-28T13:49:25.9587089Z Error: Chart not found: cnlabacrcohort17.azurecr.io/cnlabacrcohort17:1.0.0
2022-09-28T13:49:25.9906672Z 1.0.0: Pulling from cnlabacrcohort17.azurecr.io/cnlabacrcohort17/parrot
2022-09-28T13:49:26.5240147Z Error: cnlabacrcohort17.azurecr.io/cnlabacrcohort17/parrot:1.0.0: not found
2022-09-28T13:49:26.5576891Z Error: Chart not found: cnlabacrcohort17.azurecr.io/cnlabacrcohort17/parrot:1.0.0
2022-09-28T13:49:26.5897116Z Error: failed to download "parrot" (hint: running `helm repo update` may help)

Not able to see any helm chart in ACR as well. Please help me out to resolve this issue. I am not getting why this is failing. Why Helm Install OR Helm Upgrade is not working in Azure CI-CD With AKS and ACR.

Thanks !!

http should redirect to https

http://alwaysupalwayson.com should redirect to https

By using this https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#https_redirect

And looks like 301 (i.e. MOVED_PERMANENTLY_DEFAULT) is a better choice: https://stackoverflow.com/questions/29688425/use-301-or-303-to-redirect-http-to-https

Staging deployment

Setup a Staging deployment.

Dedicated Cloud Build definition based on the same YAML file if possible.

Kicked-off, as soon as a feature/* branch/PR is created.

Leverage same Ingress (with a staging service in the same namespace?) or deploy let's say a LoadBalancer in another namespace to get a new temporary public IP address without SSL termination?

`Envoy` instead of `Nginx`?

https://www.katacoda.com/envoyproxy/scenarios/migrating-from-nginx-to-envoy

Binary authorization

https://cloud.google.com/binary-authorization