#azure (2021-01)
Archive: https://archive.sweetops.com/azure/
2021-01-06
Hi all: reading https://stackoverflow.com/questions/60338757/how-do-i-import-an-azure-ad-service-principal-password-into-terraform I’m a bit confused between APP and SP passwords: It seems to indicate that to authenticate with a SP you can use a password for the APP. Is this the case? If so, why do we need SP passwords at all?
Hello @Padarn, I had the same question as you !
you should read the link below then everything will be clear !
https://kliushnikov.medium.com/azure-active-directory-application-or-service-principal-b5a5e14f2a23 and https://kliushnikov.medium.com/azure-active-directory-application-or-service-principal-b5a5e14f2a23
Saved my life
2021-01-11
Hi, I have setup a private AKS cluster by following this guide and setting it up with terraform https://docs.microsoft.com/en/azure/aks/private-clusters now I have deployed an helm charts for the nginx-ingress
release_name=nginx
version=3.19.0
chart_name=ingress-nginx/ingress-nginx
But when I do kubectl describe svc nginx-ingress-nginx-controller -n ingress-nginx
the loadbalancer Ingress is a public ip addresses !
ok the node port is private but … cluster public ips directly on internet !!! what did I missed ? ..
$ kubectl describe svc nginx-ingress-nginx-controller -n ingress-nginx
Name: nginx-ingress-nginx-controller
Namespace: ingress-nginx
Labels: app.kubernetes.io/component=controller
app.kubernetes.io/instance=nginx
app.kubernetes.io/managed-by=Helm
app.kubernetes.io/name=ingress-nginx
app.kubernetes.io/version=0.43.0
helm.sh/chart=ingress-nginx-3.19.0
Annotations: meta.helm.sh/release-name: nginx
meta.helm.sh/release-namespace: ingress-nginx
Selector: app.kubernetes.io/component=controller,app.kubernetes.io/instance=nginx,app.kubernetes.io/name=ingress-nginx
Type: LoadBalancer
IP: 10.0.xx.xx
LoadBalancer Ingress: 20.74.yy.zz
Port: http 80/TCP
TargetPort: http/TCP
NodePort: http 32006/TCP
Endpoints: 10.244.7.107:80
Port: https 443/TCP
TargetPort: https/TCP
NodePort: https 32448/TCP
Endpoints: 10.yy.z.zz:443
Session Affinity: None
External Traffic Policy: Cluster
Events: <none>
I just found the following related docs https://docs.microsoft.com/fr-fr/azure/aks/ingress-internal-ip
Can’t read that doc but we had the same problem. By default even private cluster can create public load balancer
We used an azure policy to disallow this. If you didn’t solve yet I can send it to you later
I fixed it by attributing a private ip address and it works flawlessly. But yes if you can share the azure policy then I’ll disallow the aks to create public ip !
Cool can do. Will share in a few hours
2021-01-12
2021-01-13
2021-01-18
what’s the best way to import terraform module from azure devops ? In the example below the guy uses his personnal ssh key , is there a way to use an Azure service principal ? and he warns about it “Note that unlike PAT tokens, you cannot scope SSH keys. Using the SSH key will give you the same rights as the user who’s account this key belongs to, so use them carefully.” https://samcogan.com/using-terraform-modules-from-git-in-azure-devops/