GitHub Actions is a powerful tool that allows developers to automate their workflow, but when it comes to scheduling workflows, it may not always work as expected. Many users have reported that their scheduled workflows are not triggering at the scheduled time, and in some cases, the delay can be as long as an hour. In this blog post, we will explore the limitations of GitHub Actions scheduled workflows, the reasons for these delays, and what can be done to ensure that your workflows are executed on time. We will also discuss various alternative solutions that can be used to trigger the workflows manually, guaranteeing the execution of your production tasks.
<h3 id="heading-scenario-actions-not-running-at-the-scheduled-time">Scenario: Actions not running at the scheduled time.</h3>
I've recently written a GitHub action that generates reports by running scripts and sending an email of the report every Tuesday at 8 AM EST.
E.g.,
<pre><code class="lang-yaml">name: Generate Report

on:
 schedule:
 - cron: "0 13 * * 2" # UTC

jobs:
 generate:
 runs-on: ubuntu-latest
 steps:
 # Reduced the code for brevity
 - name: Generate report and Send email
 run: |
 generate-report.sh 
 send-email.sh
</code></pre>
It took less than a minute to generate a report. I was expecting the email to be received at least by 8.05 AM. But it's not started. It took 30min to 1 hour to get the new workflow run queued.
One of the main reasons for delays in scheduled workflows is the fact that GitHub runs workflows on shared runners. There is no guarantee that the workflow will run at the exact scheduled time. When you set up a workflow schedule, you request GitHub to schedule it. However, many factors can affect the execution of the workflow, such as system load, queue size, and other workflows competing for resources.
This means that the resources available to run workflows are not dedicated to a specific user or repository and are subject to the demands of other users and workflows. As a result, there may be delays in the execution of a scheduled workflow, as it may need to wait for resources to become available.
<h2 id="heading-solution-use-external-schedulers-amp-workflow-dispatch">Solution: Use external schedulers &amp; Workflow Dispatch</h2>
One possible solution to overcome these limitations is manually triggering the workflow using an external scheduler. GitHub Actions supports the workflow_dispatch trigger, allowing you to trigger a workflow manually. This means you can use a third-party cron scheduling service, like <a target="_blank" href="https://ifttt.com/">IFTTT</a>, <a target="_blank" href="https://cronhub.io/">Cronhub</a>, <a target="_blank" href="https://cronitor.io/">Cronitor</a>, etc., to request the GitHub API to trigger the workflow. By doing so, you can ensure that the workflow is executed at the desired time, regardless of the state of the shared runners or the cron schedule.
Add the workflow_dispatch to trigger the GitHub Actions manually.
<pre><code class="lang-yaml">name: Generate Report

on:
 workflow_dispatch:

jobs:
 generate:
 runs-on: ubuntu-latest
 steps:
 # Reduced the code for brevity
 - name: Generate report and Send email
 run: |
 generate-report.sh 
 send-email.sh
</code></pre>
You could trigger the workflow using an HTTP call, for e.g,
<pre><code class="lang-bash">curl -X POST -H "Accept: application/vnd.github+json" -H "Authorization: token YOUR_ACCESS_TOKEN" https://api.github.com/repos/OWNER/REPO/actions/workflows/WORKFLOW_ID/dispatches
</code></pre>
This way, your workflow will be executed at the exact scheduled time, without any delays, regardless of the state of shared runners.
<h3 id="heading-conclusion">Conclusion</h3>
In summary, while GitHub Actions is a powerful tool for automating your workflow, its scheduled workflows may not always run at the exact scheduled time. This can be due to the shared runner's nature, where the system load, queue size and other workflows can affect the execution of your workflow. To ensure that your production tasks are executed on time, it is recommended to use an external scheduler to manually trigger the workflow. This way, you can guarantee the execution of your workflow and avoid delays.
I'm Siva - Director, DevOps &amp; Principal Architect at <a target="_blank" href="https://www.ceiamerica.com/">Computer Enterprises Inc</a> from Orlando. I'm an AWS Community builder. I write blogs and tutorials about Cloud, Containers, IoT, and DevOps. If you are interested, please follow me <a target="_blank" href="https://twitter.com/ksivamuthu">@ ksivamuthu</a>on Twitter or check out my blogs at <a target="_blank" href="http://sivamuthukumar.com">sivamuthukumar.com</a>

GitHub Actions is a powerful tool that allows developers to automate their workflow, but when it comes to scheduling workflows, it may not always work as expected. Many users have reported that their scheduled workflows are not triggering at the sche...

GitHub Actions Scheduled Workflows: Understanding the Limitations and Possible Solutions

In this blog post, we will cover how you can use the OSSF Scorecard to assess the security score of your repository and report the results in GitHub Advanced Security - Overview. This will allow you to assess the security scores of your repositories across your organization, providing a comprehensive view of your repository’s security posture.
The Open Source Security Foundation (OSSF) Scorecard is a tool that helps assess the security measures taken in a repository. It does this by performing a series of checks, each of which is assigned a score of 0-10. By using the OSSF Scorecard, you can assess the risks that dependencies introduce, understand specific areas where you can improve the security posture of your project, and make informed decisions about accepting those risks or evaluating alternative solutions.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ossf/scorecard">https://github.com/ossf/scorecard</a></div>
 
Some of the checks included in the OSSF Scorecard are:
<ul>
<li>Branch-Protection: This check assesses whether the project uses Branch Protection to ensure that code is reviewed before it is merged.
</li>
<li>CI-Tests: This check looks for the presence of tests that are run in CI, such as GitHub Actions.
</li>
<li>Code-Review: This check assesses whether the project requires code review before code is merged.
</li>
<li>Dangerous-Workflow: This check looks for the use of dangerous coding patterns in GitHub Action workflows, which can pose a security risk.
</li>
<li>Dependency-Update-Tool: This check looks for the use of tools to help update dependencies, which can help keep the project up-to-date and secure.
</li>
<li>License: This check assesses whether the project has a declared license, which is important for ensuring legal compliance.
</li>
<li>Maintained: This check looks for projects that are at least 90 days old and are actively maintained.
</li>
<li>Pinned Dependencies: This check looks for the declaration and pinning of dependencies, which can help ensure that the project is using stable and secure versions of those dependencies.
</li>
<li>Packaging: This check looks for the building and publishing of official packages from CI/CD, such as GitHub Publishing.
</li>
<li>SAST: This check looks for the use of static code analysis tools such as CodeQL or other SAST tools such as SonarCloud, which can help identify vulnerabilities in the code.
</li>
<li>Security Policy: This check looks for the presence of a security policy, which can help outline the steps taken to ensure the security of the project.
</li>
<li>Signed-Releases: This check looks for the use of cryptographic signing for releases, which can help ensure the authenticity and integrity of those releases.
</li>
<li>Token-Permissions: This check assesses whether the project declares GitHub workflow tokens as read-only, which can help prevent unauthorized access to sensitive information.
</li>
<li>Vulnerabilities: This check looks for unfixed vulnerabilities in the project and uses the OSV service to assess the risk level.
</li>
<li>Webhooks: This check looks for the presence of tokens in webhooks that are used to authenticate the origins of requests. This can help prevent unauthorized access to the project.
</li>
</ul>
You can use GitHub Actions to automate the process of updating an OSSF scorecard for a project. To do this, you will need to set up a workflow that runs the OSSF Scorecard and then parses and displays the results.
In this tutorial, we will walk through the process of using GitHub Actions to automate the process of updating an OSSF scorecard for a project. We will cover the following steps:
<ol>
<li>Setting up a GitHub repository for your project.
</li>
<li>Creating a workflow file to automate OSSF scorecard updates
</li>
<li>Running security scans and updating dependencies with GitHub Actions
</li>
<li>Viewing and updating your OSSF scorecard
</li>
</ol>
<h3 id="heading-setting-up-a-github-repository-for-your-project">Setting up a GitHub repository for your project</h3>
If you don't already have a GitHub repository, the first step is to create one. To do this, log in to your GitHub account and click the "New repository" button. Give your repository a name and description, and choose whether you want it to be public or private.
<h3 id="heading-creating-a-workflow-file-to-automate-ossf-scorecard-updates">Creating a workflow file to automate OSSF Scorecard updates</h3>
Next, we will create a workflow file to define the steps performed by our GitHub Action.
<ul>
<li>You can set up this directly or navigate to the “Security” tab → Setup Code scanning (or Add more scanning tools).
</li>
<li>Choose the “OSSF Scorecards supply-chain security analysis” from the list and set up the workflow. It will create a workflow file like the one below.
 <img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672400684900/722f9744-7585-4603-bf98-48841a8e4eac.png" alt class="image--center mx-auto" />
</li>
<li>Here is an example workflow file that runs a security scorecard scan and uploads the findings in Code scanning alerts whenever code is pushed to the <code>main</code> branch:
<pre><code class="lang-yaml">
 name: Scorecards supply-chain security
 on:
 branch_protection_rule:
 schedule:
 - cron: '30 8 * * 3'
 push:
 branches: [ "main" ]

 permissions: read-all

 jobs:
 analysis:
 name: Scorecards analysis
 runs-on: ubuntu-latest
 permissions:
 # Needed to upload the results to code-scanning dashboard.
 security-events: write
 # Uncomment the permissions below if installing in a private repository.
 contents: read
 actions: read

 steps:
 - name: "Checkout code"
 uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
 with:
 persist-credentials: false

 - name: "Run analysis"
 uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # v2.0.6
 with:
 results_file: results.sarif
 results_format: sarif
 repo_token: ${{ secrets.SCORECARD_TOKEN }}

 # Public repositories:
 # - Publish results to OpenSSF REST API for easy access by consumers
 # - Allows the repository to include the Scorecard badge.
 # - See https://github.com/ossf/scorecard-action#publishing-results.
 # For private repositories:
 # - `publish_results` will always be set to `false`, regardless
 # of the value entered here.
 publish_results: false

 # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
 # format to the repository Actions tab.
 - name: "Upload artifact"
 uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
 with:
 name: SARIF file
 path: results.sarif
 retention-days: 5

 # Upload the results to GitHub's code scanning dashboard.
 - name: "Upload to code-scanning"
 uses: github/codeql-action/upload-sarif@807578363a7869ca324a79039e6db9c843e0e100 # v2.1.27
 with:
 sarif_file: results.sarif
</code></pre>
</li>
</ul>
In this example, the <code>on</code> block defines the trigger for the workflow, which is a push event to the <code>main</code> branch. The <code>jobs</code> block defines the steps that are performed by the workflow. In this case, the workflow has an <code>analysis</code> job that runs on an Ubuntu virtual machine. The job has three steps:
<ul>
<li><code>actions/checkout@&lt;sha&gt;</code>: This action checks out the code from the repository to the virtual machine.
</li>
<li><code>ossf/scorecard-action@&lt;sha&gt;</code>: This action runs an OSSF Scorecard section on the repo to identify any misconfigurations based on the OSSF rules.
</li>
<li><code>actions/upload-artifact@&lt;sha&gt;:</code>: This action runs an upload artifact - the sarif file result from the scorecard action
</li>
<li><code>actions/upload-artifact@&lt;sha&gt;:</code>: This action uploads OSSF Scorecard results to the code scanning alerts to the dashboard.
</li>
</ul>
<h3 id="heading-code-scanning-alerts">Code scanning Alerts</h3>
Using the OSSF Score card in conjunction with code scanning alerts can be a powerful way to ensure the security of your projects in the enterprise. By integrating the OSSF Scorecard with code scanning alerts, you can receive notifications whenever a check fails or a score falls below a certain threshold. This can help you stay informed about the security of your repository and take prompt action to fix any identified issues.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672400711828/cfcb2525-5c81-4639-a14c-3b91a5657694.png" alt class="image--center mx-auto" />
You can see the details of the check and the remediation steps to fix it.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672400724227/e5116188-9a2b-483a-9f6e-f743f201ad07.png" alt class="image--center mx-auto" />
To view code scanning alerts of all your repositories in the organization, you can go to the "Security" section. Monitoring code scanning alerts is an important part of maintaining the security of your repositories in the enterprise. Regularly reviewing and addressing any identified vulnerabilities can help ensure that your projects are secure and protect your organization against potential vulnerabilities. Here is the screenshot of the sample Security Risk of your organization.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672400740454/840d6728-03eb-4207-9c9f-75a5c401bcbb.png" alt class="image--center mx-auto" />
<h3 id="heading-best-practices">Best Practices</h3>
It is important to note that the OSSF Scorecard is just one tool that can help you assess the security of your repositories. It is recommended that you use a combination of tools and best practices to ensure the security of your projects in the enterprise. Some other best practices to consider include the following:
<ul>
<li>Regularly updating dependencies and keeping them up-to-date.
</li>
<li>Using secure coding practices and following best practices for secure development.
</li>
<li>Regularly scanning your code for vulnerabilities using tools such as CodeQL or other SAST tools.
</li>
<li>Implementing branch protection and code review processes to ensure that code is reviewed before it is merged.
</li>
<li>Creating and maintaining a security policy that outlines the steps taken to ensure the security of the project.
</li>
<li>Cryptographically signing releases to ensure the authenticity and integrity of those releases.
</li>
</ul>
By following these best practices and using tools like the OSSF Scorecard, you can help improve the security of your projects in the enterprise and protect your organization against potential vulnerabilities.
<h3 id="heading-conclusion">Conclusion</h3>
Using the OSSF Scorecard, you can get a comprehensive view of the security measures taken in your repository and identify areas for improvement. You can also use the scorecard in conjunction with code scanning alerts to receive notifications when potential vulnerabilities or security issues are discovered, allowing you to take prompt action to fix those issues.
Overall, the OSSF Scorecard is a valuable tool for assessing and improving the security of your projects in the enterprise. By using it regularly, you can ensure that your projects are secure and well-maintained, and you can demonstrate to your customers and stakeholders that you are committed to maintaining a high level of security.
I'm Siva - Director, DevOps &amp; Principal Architect at <a target="_blank" href="https://www.ceiamerica.com/">Computer Enterprises Inc</a> from Orlando. I'm an AWS Community builder. I write blogs and tutorials about Cloud, Containers, IoT, and DevOps. If you are interested, please follow me <a class="user-mention" href="https://hashnode.com/@ksivamuthu">@ksivamuthu</a> on Twitter or check out my blogs at <a target="_blank" href="http://sivamuthukumar.com">sivamuthukumar.com</a>

In this blog post, we will cover how you can use the OSSF Scorecard to assess the security score of your repository and report the results in GitHub Advanced Security - Overview. This will allow you to assess the security scores of your repositories ...

Boost Your Enterprise Security with GitHub Actions and the OSSF Score Card

As an Azure user, you may be looking for a way to manage your infrastructure with the power of Terraform. However, getting started with Terraform can be challenging, especially if you have existing resources that you want to include in your configuration. That's where Azure Terrafy comes in. Azure Terrafy is a tool that makes it easy to import your existing Azure resources into Terraform modules. In this blog post, I will introduce you to Azure Terrafy and show you how it can streamline your Azure resource management process. By the end, you will have a better understanding of how Terrafy can help you use Terraform to manage your infrastructure with ease.
<a target="_blank" href="https://github.com/Azure/aztfy">Azure Terrafy</a> is a tool that makes it easy to import your existing Azure resources into Terraform modules. Suppose you're an Azure user looking to manage your infrastructure with the power of Terraform. In that case, Azure Terrafy can save you time and effort by automating the process of incorporating your existing resources into your Terraform configuration. This is especially useful for those who have a "brownfield" environment, where their infrastructure already has a number of existing resources that need to be brought under the management of Terraform. It can save you a lot of time and effort. Without Terrafy, you would need to manually create a Terraform configuration file for each resource you want to manage. This can be tedious and error-prone, especially if you have many resources.
In addition to saving time and effort, using Azure Terrafy can also help you ensure that your Terraform configuration is accurate and up-to-date. By importing your existing resources into Terraform, you can ensure that your configuration reflects the current state of your resources rather than relying on potentially outdated documentation or manual configuration. This can help you avoid errors and ensure your infrastructure is managed effectively.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/Azure/aztfy">https://github.com/Azure/aztfy</a></div>
 
<h3 id="heading-features-and-benefits-of-using-terrafy">Features and benefits of using Terrafy:</h3>
<ul>
<li>Automates the process of importing existing Azure resources into Terraform modules
</li>
<li>Saves time and effort compared to manual resource management
</li>
<li>Helps ensure that your Terraform configuration is accurate and up-to-date
</li>
<li>Works with both Azure Resource Manager and Azure Classic resources
</li>
<li>Can be easily integrated into existing Terraform workflows
</li>
</ul>
<h3 id="heading-how-azure-terrafy-fits-into-the-overall-azure-and-terraform-landscape">How Azure Terrafy fits into the overall Azure and Terraform landscape:</h3>
<ul>
<li>Azure Terrafy is a tool specifically designed to help manage Azure resources in Terraform
</li>
<li>It works alongside Azure Resource Manager to discover and import resources into Terraform modules
</li>
<li>Azure Terrafy is just one piece of the puzzle regarding managing Azure infrastructure with Terraform. Other tools and technologies, such as Azure DevOps and Azure Functions, can also be used in conjunction with Terrafy to create a comprehensive infrastructure management solution.
</li>
</ul>
<h3 id="heading-prerequisites">Prerequisites</h3>
<ul>
<li>An Azure account and subscription
</li>
<li>Terraform installed on your machine
</li>
<li>The Azure CLI installed on your machine
</li>
<li>A configured Azure CLI profile with the necessary permissions to read resources in your Azure subscription
</li>
<li>Install <code>aztfy</code> from <a target="_blank" href="https://github.com/Azure/aztfy/releases">GitHub Releases</a> - pre-compiled binaries on macOS, Windows &amp; Linux platforms
</li>
</ul>
<h3 id="heading-importing-existing-resources">Importing Existing Resources</h3>
<ol>
<li>Run the <code>aztfy</code> command to create a new Terraform configuration file on a single resource, resource group or query for the list of resources. You can pass the —non-interactive option if you want to run in non-interactive mode. Here dapr-talk is the resource group name.
<pre><code class="lang-bash"> **aztfy rg --non-interactive dapr-talk
 // or
 aztfy res &lt;resource_id&gt;**
</code></pre>
</li>
<li>Review the generated Terraform configuration file to ensure that it accurately reflects the state of your Azure resources
<ol>
<li>You may need to modify or expose certain configurations through terraform variables/sensitive variables.</li>
</ol>
</li>
<li>Run the <code>terraform plan</code> command to preview the changes that will be made to your resources when you apply the Terraform configuration
<pre><code class="lang-bash"> ➜ terraform plan

 azurerm_resource_group.res-0: Refreshing state... [id=/subscriptions/xxxx/resourceGroups/dapr-talk]
 azurerm_service_plan.res-1: Refreshing state... [id=/subscriptions/xxxx/resourceGroups/dapr-talk/providers/Microsoft.Web/serverfarms/ASP-daprtalk-814c]
 azurerm_application_insights.res-8: Refreshing state... [id=/subscriptions/xxxx/resourceGroups/dapr-talk/providers/Microsoft.Insights/components/webappdapr]
 azurerm_windows_web_app.res-2: Refreshing state... [id=/subscriptions/xxxx/resourceGroups/dapr-talk/providers/Microsoft.Web/sites/webappdapr]
 azurerm_app_service_custom_hostname_binding.res-6: Refreshing state... [id=/subscriptions/xxxx/resourceGroups/dapr-talk/providers/Microsoft.Web/sites/webappdapr/hostNameBindings/webappdapr.azurewebsites.net]

 No changes. Your infrastructure matches the configuration.
</code></pre>
</li>
<li>If the plan looks correct, run the <code>terraform apply</code> the command to apply the Terraform configuration and bring your Azure resources under the management of Terraform.
<pre><code class="lang-bash"> terraform apply
</code></pre>
</li>
</ol>
Here are a few tips and best practices to keep in mind when using Terrafy to import your existing resources into Terraform:
<ul>
<li>Be sure to review the generated Terraform configuration file carefully before applying it. This will help you ensure that the configuration accurately reflects the state of your resources and avoid any errors or unintended consequences.
</li>
<li>If you have many resources, it may take some time for Azure Terrafy to scan and generate the configuration file. Be patient and allow the process to complete before applying the configuration.
</li>
<li>If you have resources that you don't want to include in your Terraform configuration, you can use the <code>aztfy res or aztfy query</code> command to import specific resources individually. This can be helpful if you only want to manage a subset of your resources with Terraform.
</li>
<li>You must create terraform resources manually if there are not-supported / skipped resources.
</li>
<li>Don't forget to run the <code>terraform plan</code> command before applying your configuration. This will help you identify potential issues or conflicts before they become a problem.
</li>
</ul>
By following these steps and best practices, you can use Azure Terrafy to easily import your existing Azure resources into Terraform modules and start managing them with ease.
<h3 id="heading-limitations">Limitations</h3>
Here are some limitations of Azure Terrafy to consider:
<ol>
<li>Only works with Azure resources: Terrafy cannot import resources from other cloud providers.
</li>
<li>It may not be suitable for highly complex or customized infrastructure: Azure Terrafy does not support all resources. The resources which are not supported have to be done manually.
</li>
<li>Limited context: The review is necessary to convert the sensitive configurations to terraform-managed variables.
</li>
</ol>
<h3 id="heading-conclusion">Conclusion</h3>
In conclusion, I have found Azure Terrafy to be a valuable tool for managing Azure resources in Terraform. It has saved me time and effort compared to manual resource management, and its integration with Azure and Terraform has made it easy to use in various infrastructure management scenarios. However, like any tool, it has its limitations, such as only working with Azure resources and potentially complex for more customized infrastructure.
Overall, I recommend giving Azure Terrafy a try if you are looking for a tool to help manage your Azure resources with Terraform. Just be sure to consider its limitations and whether it fits the needs of your specific infrastructure. By following the steps outlined in this blog post and keeping in mind best practices like reviewing the generated code before applying it, you can use Azure Terrafy to manage your Azure resources with Terraform effectively.
I'm Siva - Director, DevOps &amp; Principal Architect at <a target="_blank" href="https://www.ceiamerica.com/">Computer Enterprises Inc</a> from Orlando. I'm an AWS Community builder. I write blogs and tutorials about Cloud, Containers, IoT, and DevOps. If you are interested, please follow me <a class="user-mention" href="https://hashnode.com/@ksivamuthu">@ksivamuthu</a> on Twitter or check out my blogs at <a target="_blank" href="http://sivamuthukumar.com">sivamuthukumar.com</a>

As an Azure user, you may be looking for a way to manage your infrastructure with the power of Terraform. However, getting started with Terraform can be challenging, especially if you have existing resources that you want to include in your configura...

Azure Terrafy: Import and Manage Existing Azure Resources with Terraform

Observability is an essential part of any cloud-native environment. When it comes to Amazon EKS clusters, observability is an even more critical factor. This blog post will explore how you can provision an observability landscape to monitor and manage your EKS clusters using AWS Observability Accelerator for Terraform.
The AWS Observability accelerator for Terraform is a powerful terraform module that enables developers to quickly and easily set up observability solutions for their Amazon Elastic Container Service for Kubernetes (EKS) clusters using Amazon Web Services (AWS) observability services. This tool includes a core module that helps you configure your cluster with the AWS Distro for OpenTelemetry (ADOT) Operator for EKS, Amazon Managed Service for Prometheus, and Amazon Managed Grafana.
In addition to the core module, the AWS Observability accelerator also includes a set of workload modules that provide curated ADOT collector configurations, Grafana dashboards, Prometheus recording rules, and alerts. These modules allow you to leverage the power of these tools to monitor and troubleshoot your applications and infrastructure in real-time.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/aws-observability/terraform-aws-observability-accelerator">https://github.com/aws-observability/terraform-aws-observability-accelerator</a></div>
 
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672013463968/0182baff-0966-4378-ac26-e6586684565c.png" alt class="image--center mx-auto" />
In this post, we will set up the EKS cluster using terraform. Then we will provision AWS Managed service for Prometheus, AWS Managed service for Grafana, Install AWS Distro for Open Telemetry in Cluster to scrape the metrics and necessary recording rules, and dashboards for Prometheus and Grafana - all these in only a few lines of Infrastructure as Code.
Let’s start with the setup of initializing the EKS cluster using the EKS Blueprints terraform module.
<ol>
<li>Initialize the EKS cluster using the EKS Blueprints terraform module. EKS blueprints are modular constructs available in CDK and as terraform modules that can provision fully functional production-ready kubernetes cluster and modular add-ons such as service mesh, autoscalers, networking, storage, gitops, etc.
<pre><code class="lang-ini"> module "eks_blueprints" {
 source = "github.com/aws-ia/terraform-aws-eks-blueprints?ref=v4.19.0"
 cluster_name = var.cluster_name
 cluster_version = "1.20"

 vpc_id = var.vpc_id
 private_subnet_ids = var.private_subnet_ids
 public_subnet_ids = var.public_subnet_ids

 managed_node_groups = {
 t3_small = {
 node_group_name = "node-group-t3-small"
 instance_types = ["t3.small"]
 subnet_ids = var.private_subnet_ids
 min_size = 1
 max_size = 2
 desired_size = 1
 }
 }

 tags = var.tags
 }
</code></pre>
</li>
<li>You can then specify which observability services you want to enable, such as the ADOT operator, Amazon Managed Prometheus, and Amazon Managed Grafana.
<pre><code class="lang-ini"> module "eks_observability_accelerator" {
 source = "github.com/aws-observability/terraform-aws-observability-accelerator?ref=v1.5.0"

 aws_region = var.aws_region
 eks_cluster_id = module.eks_blueprints.eks_cluster_id

 enable_amazon_eks_adot = true
 enable_managed_prometheus = true
 enable_alertmanager = true
 enable_managed_grafana = true

 tags = var.tags
 }
</code></pre>
</li>
<li>You can also specify your own instance IDs if you want to reuse existing managed services or disable the creation of managed services altogether.
<pre><code class="lang-ini"> module "eks_observability_accelerator" {
 source = "github.com/aws-observability/terraform-aws-observability-accelerator?ref=v1.5.0"

 aws_region = var.aws_region
 eks_cluster_id = module.eks_blueprints.eks_cluster_id

 enable_amazon_eks_adot = true
 enable_managed_prometheus = true
 enable_alertmanager = true

 # Reuse existing setup by disabling the creation of managed grafana service
 # and pass the existing service workspace id
 enable_managed_grafana = false
 managed_grafana_workspace_id = var.managed_grafana_workspace_id
 grafana_api_key = var.grafana_api_key

 tags = var.tags
 }
</code></pre>
</li>
<li>Set up the default Grafana dashboards, alerting rules, and metrics scraping configuration from AWS Observability Accelerator for Terraform modules. You can customize them as needed.
<pre><code class="lang-ini"> module "workloads_infra" {
 source = "github.com/aws-observability/terraform-aws-observability-accelerator/modules/workloads/infra"

 eks_cluster_id = module.eks_observability_accelerator.eks_cluster_id

 dashboards_folder_id = module.eks_observability_accelerator.grafana_dashboards_folder_id
 managed_prometheus_workspace_id = module.eks_observability_accelerator.managed_prometheus_workspace_id

 managed_prometheus_workspace_endpoint = module.eks_observability_accelerator.managed_prometheus_workspace_endpoint
 managed_prometheus_workspace_region = module.eks_observability_accelerator.managed_prometheus_workspace_region

 # optional, defaults to 60s interval and 15s timeout
 prometheus_config = {
 global_scrape_interval = "60s"
 global_scrape_timeout = "15s"
 }

 depends_on = [
 module.eks_observability_accelerator
 ]
 }
</code></pre>
</li>
<li>Once you have included the AWS Observability Accelerator in your Terraform configuration and specified which services you want to enable, you can use Terraform to provision the observability landscape for your EKS cluster.
<pre><code class="lang-bash"> terraform plan -var-file env/dev.tfvars
 terraform apply -var-file env/dev.tfvars
</code></pre>
</li>
</ol>
The complete Observability Landscape has been set up for you - including ADOT (AWS Distro for Open Telemetry collectors), AWS Managed Services for Prometheus (Prometheus endpoints where ADOT writes the metrics), AWS Managed Services for Grafana (where it can query from Prometheus data sources to build dashboards and display alerts).
You can view the Prometheus Endpoint URL, alerting, and recording rules in the AWS console.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672013592543/6e8eccb4-8295-43f0-b26b-ff2cde669cee.png" alt class="image--center mx-auto" />
Navigate the Grafana Dashboard in the AWS Managed Services for the Grafana workspace, and configure the user to view/edit the dashboards. The necessary dashboards are already created for the user to view.
<ul>
<li>Kubernetes - Cluster
</li>
<li>Kubernetes - Namespace(Workloads)
</li>
<li>Kubernetes - Node (Pods)
</li>
<li>Kubernetes - Workload
</li>
<li>Kubernetes - Kubelet
</li>
<li>Node Exporter - Nodes
</li>
</ul>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672013616980/3663769c-079e-4f95-9d60-803f934f5b4d.png" alt class="image--center mx-auto" />
You can navigate to the individual dashboard and view the charts based on the metrics scraped from the infrastructure and workloads.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672013637285/101e3125-ce13-4bf1-b173-84ba8b0a925c.png" alt class="image--center mx-auto" />
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1672013644230/0a006ea4-ecb7-44fd-955d-34a6b5a5187b.png" alt class="image--center mx-auto" />
<h1 id="heading-conclusion">Conclusion</h1>
In conclusion, the AWS Observability Accelerator for Terraform is a powerful terraform module that allows you to quickly and easily set up observability solutions for your EKS clusters. It includes a core module and a set of workload modules that provide curated configurations, dashboards, recording rules, and alerts to help you monitor and troubleshoot your applications and infrastructure in real-time. Using the AWS Observability Accelerator, you can leverage the power of tools like Prometheus and Grafana to visualize and analyze your metrics and logs, enabling you to optimize and improve the performance and reliability of your cloud-native environments.
I'm Siva - working as Director, DevOps &amp; Principal Architect at <a target="_blank" href="https://www.ceiamerica.com/">Computer Enterprises Inc</a> from Orlando. I'm an AWS Community builder. I will write a lot about Cloud, Containers, IoT, and DevOps. If you are interested, please follow me <a class="user-mention" href="https://hashnode.com/@ksivamuthu">@ksivamuthu</a> on Twitter or check out my blogs at <a target="_blank" href="https://sivamuthukumar.com">sivamuthukumar.com</a>

Observability is an essential part of any cloud-native environment. When it comes to Amazon EKS clusters, observability is an even more critical factor. This blog post will explore how you can provision an observability landscape to monitor and manag...

EKS Observability Infrastructure as Code - AWS Observability Accelerator

Amazon made a couple of announcements today (November 29, 2022) at AWS re: Invent in Las Vegas, focusing on Data, Analytics, Infrastructure &amp; Security. We will see the announcements that excite me in this blog post.
<h3 id="heading-data-andamp-analytics">Data &amp; Analytics:</h3>
<ol>
<li>Zero ETL future
When you build a data platform - ETL takes primary effort. AWS committed to building the Zero ETL future and made two great announcements toward that.
<ul>
<li><a target="_blank" href="https://aws.amazon.com/about-aws/whats-new/2022/11/amazon-aurora-zero-etl-integration-redshift/">Amazon Aurora zero-ETL integration with Amazon Redshift</a>
<ul>
<li>enables near-real-time analytics and ML on transaction data.
</li>
<li>consolidate data from multiple Aurora database
</li>
<li>continuous updates
</li>
<li>serverless - no infrastructure to manage
</li>
</ul>
</li>
<li>Amazon Redshift Integration for Apache Spark
<ul>
<li>Now, you can run Spark queries on REshift data from EMR, Glue, and Sagemaker within seconds. No need to move the data</li>
</ul>
</li>
</ul>
</li>
<li><a target="_blank" href="https://aws.amazon.com/datazone/">Amazon Datazone</a> - ML based Data management service
<ul>
<li>A data management service that helps orgs catalog, share and govern data.
</li>
<li>Integrates with Redshift, Athena and Quicksights and provides APIs to third party sources
</li>
<li>AWS Clean Room - Data sharing / masking services.
<ol>
<li>I think AWS is running out the names for the product. ;-)</li>
</ol>
</li>
</ul>
</li>
<li>Amazon QuickSight - ML powered
<ul>
<li>It includes AI-enhanced automated data preparation, making it fast &amp; easy to enable data for natural language questions.</li>
</ul>
</li>
<li><a target="_blank" href="https://aws.amazon.com/blogs/aws/preview-amazon-opensearch-serverless-run-search-and-analytics-workloads-without-managing-clusters/">Amazon OpenSearch Serverless</a>
<ul>
<li>Run search and analytics workloads without managing clusters.
</li>
<li>It’s one of the features I expected - finally, it got announced.
</li>
</ul>
</li>
<li><a target="_blank" href="https://aws.amazon.com/blogs/aws/new-fully-managed-blue-green-deployments-in-amazon-aurora-and-amazon-rds/">Amazon RDS Blue/Green Deployments</a>
<ul>
<li>A new feature for Amazon Aurora with MySQL compatibility, Amazon RDS for MySQL, and Amazon RDS for MariaDB that enables you to make database updates safer, simpler, and faster.
</li>
<li>With just a few steps, you can use Blue/Green Deployments to create a separate, synchronized, fully managed staging environment that mirrors the production environment. The staging environment clones your production environment’s primary database and in-Region read replicas. Blue/Green Deployments keep these two environments in sync using logical replication
</li>
</ul>
</li>
</ol>
<h3 id="heading-infrastructure">Infrastructure</h3>
<ol>
<li>Graviton: NEW 3rd generation processor. 25% faster &amp; use 60% LESS energy.
<ol>
<li>Strong momentum for Graviton
</li>
<li>500x time increase: delivering highest performing #MachineLearning workloads. 70% lower cost per inference.
</li>
</ol>
</li>
<li><a target="_blank" href="https://aws.amazon.com/about-aws/whats-new/2022/11/aws-announces-amazon-ec2-inf2-instances-preview/">AWS announces EC2 Inf2 instances</a>
</li>
<li><a target="_blank" href="https://aws.amazon.com/blogs/aws/new-aws-simspace-weaver-build-large-scale-spatial-simulations-in-the-cloud/">AWS Simspace Weave</a>r - Run large-scale spatial simulations in the cloud
</li>
</ol>
<h3 id="heading-security">Security</h3>
<ol>
<li><a target="_blank" href="https://aws.amazon.com/blogs/aws/preview-amazon-security-lake-a-purpose-built-customer-owned-data-lake-service/">Amazon Security Lake</a>: centralizes security data of your organization from AWS and third-party systems for quick risk response. Supports OCSF standard format. Amazon Security Lake is the first service/initiative to support OCSF open standard format - to normalize the structure for security findings across vendors and products.
</li>
<li>AWS Guard Duty - Runtime vulnerability detection for containers., attempts to access host nodes, etc. This feature will be available soon and integrates with Amazon EKS
</li>
</ol>
<h3 id="heading-industries">Industries</h3>
<ol>
<li><a target="_blank" href="https://aws.amazon.com/blogs/aws/introducing-amazon-omics-a-purpose-built-service-to-store-query-and-analyze-genomic-and-biological-data-at-scale/">Amazon Omics</a> - Genome large-scale multimodal analysis that integrates with Amazon Healthlake or Sagemaker
</li>
<li><a target="_blank" href="https://aws.amazon.com/about-aws/whats-new/2022/11/aws-supply-chain-preview/#">AWS Supply Chain</a>: improves visibility into systems to lower costs &amp; improve #CX - supply chain resiliency.
</li>
</ol>
<h3 id="heading-summary">Summary</h3>
There were exciting announcements in today's keynote focused on Data, Analytics &amp; Infrastructure mostly. I'm excited to about learning these new announcements and help enterprises on their successful journey - that innovates, analyzes, and scales their enterprise data analytics platform.
I'm Siva - working as Principal Architect at <a target="_blank" href="https://www.ceiamerica.com">Computer Enterprises Inc</a> from Orlando. I'm an AWS Community builder. I will write a lot about Cloud, Containers, IoT, and Devops. If you are interested, please follow me @ksivamuthu on Twitter or check out my blogs at blog.sivamuthukumar.com!

Amazon made a couple of announcements today (November 29, 2022) at AWS re: Invent in Las Vegas, focusing on Data, Analytics, Infrastructure & Security. We will see the announcements that excite me in this blog post.
Data & Analytics:

Zero ETL future...

AWS re:Invent 2022 Announcements - Data, Infrastructure & Security Highlights

Amazon Elastic Kubernetes Service (EKS) helps you manage, scale, and deploy your Kubernetes clusters. In the enterprise cluster setup, you need more than the cluster setup. To bootstrap, the kubernetes cluster requires significant features, including automated node management, ingress controller, monitoring, logging, security, networking tools, etc. 
With my experience with other cloud provider platform Kubernetes offerings such as GKE &amp; AKS, EKS was behind in the management features - logging, ingress controllers, etc. We need to set it up manually to get the basic features. That was hard to get into the Kubernetes platform - especially if it’s the first time onboarding to Kubernetes experience and/or EKS cluster. Later the Kubernetes components from AWS speed up the operation’s onboarding process easier. 
AWS EKS Blueprints - AWS is making the operations and developer experience greater by providing modular Infrastructure as Code modules to expedite the process of onboarding the cluster and open source tools and security controls with production readiness.
<h2 id="heading-what-are-aws-eks-blueprints">What are AWS EKS Blueprints?</h2>
<a target="_blank" href="https://github.com/aws-quickstart/cdk-eks-blueprints/">EKS Blueprints</a> is a collection of Infrastructure as Code (IaC) modules that will help you configure and deploy EKS clusters across accounts and regions. You can use EKS Blueprints to easily bootstrap an EKS cluster with Amazon EKS add-ons as well as a wide range of popular open-source add-ons, including Prometheus, Karpenter, Nginx, Traefik, AWS Load Balancer Controller, Fluent Bit, Keda, Argo CD, and more. EKS Blueprints also helps you implement relevant security controls needed to operate workloads from multiple teams in the same cluster.
Highlights of the features:
<ul>
<li>Deploy Well-Architected EKS clusters across accounts and regions</li>
<li>Manage cluster configuration, including add-ons from a single GIt repo.</li>
<li>Teams and Access management</li>
<li>Continuous Delivery pipelines for deploying infrastructure</li>
<li>GitOps - based workflows for workloads</li>
</ul>
<img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/awbvfw4ox8l8812jfo8o.png" alt="aws cdk blueprint" />
Courtesy: Image from AWS Blog.
<h3 id="heading-imperative-declarative">Imperative / Declarative</h3>
When it comes to Infrastructure as Code, there are two options - Declarative (Terraform, yamls, etc.) and Imperative (CDK, etc.). AWS EKS Blueprints are available in both declarative and imperative options.
AWS EKS Blueprints for Terraform
In AWS EKS Blueprints for Terraform - the tools are available as terraform modules to implement. You can bootstrap the kubernetes cluster and use the adds-on modules to install the open-source tools. 
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/aws-ia/terraform-aws-eks-blueprints">https://github.com/aws-ia/terraform-aws-eks-blueprints</a></div>
AWS EKS Blueprints for CDK
In AWS EKS Blueprints for CDK - the tools are available as CDK constructs to implement. You can bootstrap the kubernetes cluster and use the adds-on modules to install the open-source tools. 
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/aws-quickstart/cdk-eks-blueprints">https://github.com/aws-quickstart/cdk-eks-blueprints</a></div>
<h2 id="heading-demo-walkthrough">Demo Walkthrough</h2>
In today’s blog, we are going to set up the EKS Blueprint CDK and set up the necessary add-ons and the team structure.
<ul>
<li>Install the AWS-CDK
<pre><code class="lang-bash"> npm install -g aws-cdk
</code></pre>
</li>
<li>Initialize the CDK application
<pre><code class="lang-bash"> mkdir eks-blueprint
 cdk init app --language typescript
</code></pre>
</li>
<li>Create the EKS Blueprint Construct and call it from bin/.ts
<pre><code class="lang-bash"> ## ./bin/eks-blueprint.ts
 #!/usr/bin/env node
 import 'source-map-support/register';
 import * as cdk from 'aws-cdk-lib';
 import { EKSBlueprintConstruct } from '../lib/eks-blueprint-stack';

 const app = new cdk.App();
 new EKSBlueprintConstruct().build(app, 'siva-dev');
</code></pre>
</li>
<li>The EKS Blueprint Construct has three parts.
<ul>
<li>Create a generic EKS cluster with a node group configuration</li>
<li>Add the addons</li>
<li>Add the teams - dev team and platform team.
<pre><code class="lang-tsx">
export class EKSBlueprintConstruct {

build(scope: Construct, id: string, props?: StackProps) {
 const devTeam = new ApplicationTeam({ name: 'dev', users: this.getUserArns(scope, 'devUsers') });
 const platformTeam = new PlatformTeam({ name: 'platform', users: this.getUserArns(scope, 'platformUsers') });

 const teams = [devTeam, platformTeam];

 const addOns = [
 new VpcCniAddOn(),
 new CoreDnsAddOn(),
 new KubeProxyAddOn(),
 new MetricsServerAddOn(),
 new AwsLoadBalancerControllerAddOn(),
 new ContainerInsightsAddOn(),
 new KarpenterAddOn()
 ];

 const clusterProvider = new GenericClusterProvider({
 version: KubernetesVersion.V1_21,
 managedNodeGroups: [{
 id: `${id}-nodegroup`,
 instanceTypes: [new InstanceType('t3.small')],
 minSize: 1,
 maxSize: 2
 }],
 })

 EksBlueprint.builder()
 .addOns(...addOns)
 .clusterProvider(clusterProvider)
 .teams(...teams)
 .region('us-east-1')
 .build(scope, id, props);
}
 ...
}
</code></pre>
</li>
</ul>
</li>
<li>You can add the context properties that have <code>devUsers</code> and <code>platformUsers</code> that has a list of user/role ARN to create the team.
<pre><code class="lang-bash"> "context": {
 "devUsers": [
 "arn:aws:iam::xxxxxxxxxxx:user/user_name_1",
 "arn:aws:iam::xxxxxxxxxxx:user/user_name_2"
 ],
 "platformUsers": [
 "arn:aws:iam::xxxxxxxxxxx:user/admin_name"
 ]
 }
</code></pre>
<pre><code class="lang-tsx"> private getUserArns(scope: Construct, key: string): ArnPrincipal[] {
 const context: string[] = scope.node.tryGetContext(key);
 if (context &amp;&amp; context.length &gt; 0) {
 return context.map(e =&gt; new ArnPrincipal(e));
 }
 return [];
 }
</code></pre>
</li>
</ul>
You will see the CDK output has kubernetes config commands, the role for the dev and platform team.
<pre><code class="lang-tsx">siva-dev: creating CloudFormation changeset...

 ✅ siva-dev

✨ Deployment time: 1437.28s

Outputs:
siva-dev.devsa = dev-sa
siva-dev.devteamrole = arn:aws:iam::xxxxxxxxxx:role/dev-role-name
siva-dev.platformteamadmin = none
siva-dev.sivadevClusterName9C1D1E82 = siva-dev
siva-dev.sivadevConfigCommandF9D1C39C = aws eks update-kubeconfig --name siva-dev --region us-east-1 --role-arn &lt;role_name&gt;
siva-dev.sivadevGetTokenCommandA8918546 = aws eks get-token --cluster-name siva-dev --region us-east-1 --role-arn &lt;role_name&gt;
</code></pre>
<h3 id="heading-caveats">Caveats</h3>
The latest kubernetes version is not supported yet. Having issues with k8s version 1.22. You may see issues. Please use v1.21 at this time. <a target="_blank" href="https://github.com/aws-quickstart/cdk-eks-blueprints/issues/350">https://github.com/aws-quickstart/cdk-eks-blueprints/issues/350</a>
Also, you’ve to set the region - for the AWS Load balancer controller addon to work as the container images are derived from the region variable. 
Helm release - testing - It will be a great addition if the CDK is able to fail if the addons fail to install. For e.g., without setting the region, the AWS Load balancer controller was in a pending state.
<h2 id="heading-conclusion">Conclusion</h2>
AWS EKS Blueprints is definitely a big step in making the dev and operation team's life easier. AWS is also working with Industrial partners and open source tools such as Datadog, Kasten.io, ArgoCD, Hashicorp, Snyk, etc. 
In the next post of this series, we will see how to set up the CI/CD of the infrastructure and application workloads using EKS blueprints. And also how to extend the EKS blueprint to bring your own set of tools for your enterprise.
I'm Siva - working as Sr. Software Architect at Computer Enterprises Inc from Orlando. I'm an AWS Community builder and Auth0 Ambassador. I am going to write a lot about Cloud, Containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me <a target="_blank" href="https://hashnode.com/@ksivamuthu">@ksivamuthu</a> on Twitter or check out my blogs at <a target="_blank" href="https://blog.sivamuthukumar.com/">blog.sivamuthukumar.com</a>!

Amazon Elastic Kubernetes Service (EKS) helps you manage, scale, and deploy your Kubernetes clusters. In the enterprise cluster setup, you need more than the cluster setup. To bootstrap, the kubernetes cluster requires significant features, including...

EKS Blueprints - Modular Constructs for your Kubernetes cluster

In this blog, I’m going to walk through how to set up AWS Copilot in GitHub actions. 
<h2 id="heading-aws-copilot">AWS Copilot</h2>
AWS Copilot is an open-source command-line interface that makes it easy for developers to build, release, and operate production-ready containerized applications on AWS App Runner, Amazon ECS, and AWS Fargate. 
<h3 id="heading-initialize-the-copilot-application">Initialize the Copilot Application</h3>
Using copilot, you can initialize the entire infrastructure to run your containerized apps. Let’s take a look at an example. In this repository, we’ve demo nginx container that serves the index.html file. You can check out this repo here.
<ul>
<li>Initialize the application using the <code>copilot</code> command-line tool.
<pre><code class="lang-bash"> copilot init --app demo \
 --name app \
 --type 'Load Balanced Web Service'\
 --dockerfile './Dockerfile
</code></pre>
</li>
<li>Copilot will create the necessary infrastructure needed for your app in the AWS account. It will create an app service in the demo app, exposed to the internet using a load balancer. The container for running services is mentioned using dockerfile. The CLI will build the container from the docker file, set up ECR, push the image to ECR and configure the ECS service to pull the image from ECR.
<pre><code class="lang-bash"> Ok great, we'll set up a Load Balanced Web Service named app in application demo listening on port 80.

 ✔ Created the infrastructure to manage services and jobs under application demo.

 ✔ The directory copilot will hold service manifests for application demo.

 ✔ Wrote the manifest for service app at copilot/app/manifest.yml
 Your manifest contains configurations like your container size and port (:80).

 ✔ Created ECR repositories for service app.

 All right, you're all set for local development.
 Deploy: Yes

 ✔ Linked account 495775103319 and region us-east-1 to application demo.

 ✔ Proposing infrastructure changes for the demo-test environment.
 - Creating the infrastructure for the demo-test environment. [create complete] [82.9s]
 - An IAM Role for AWS CloudFormation to manage resources [create complete] [15.9s]
 - An ECS cluster to group your services [create complete] [9.4s]
 - An IAM Role to describe resources in your environment [create complete] [16.7s]
 - A security group to allow your containers to talk to each other [create complete] [5.7s]
 - An Internet Gateway to connect to the public internet [create complete] [21.7s]
 - Private subnet 1 for resources with no internet access [create complete] [5.7s]
 - Private subnet 2 for resources with no internet access [create complete] [5.7s]
 - Public subnet 1 for resources that can access the internet [create complete] [12.6s]
 - Public subnet 2 for resources that can access the internet [create complete] [9.3s]
 - A Virtual Private Cloud to control networking of your AWS resources [create complete] [18.2s]
 ✔ Created environment test in region us-east-1 under application demo.
</code></pre>
</li>
</ul>
<h3 id="heading-copilot-pipeline">Copilot Pipeline</h3>
Copilot has a pipeline command to set up the Automated release pipeline using AWS CodePipeline for your application. You can learn more about it <a target="_blank" href="https://aws.github.io/copilot-cli/docs/concepts/pipelines/">here</a>.
<h2 id="heading-copilot-in-github-actions">Copilot in GitHub Actions</h2>
This article is going to focus on how to deploy the application using Copilot using GitHub Actions. Let’s walk through the setup step by step and then I wrote a GitHub action to set up for you with easy configuration.
<h3 id="heading-installing-copilot-cli">Installing Copilot CLI</h3>
The AWS copilot CLI has to be downloaded and installed to access. The AWS Copilot binaries are released on GitHub. We can download the platform-specific binaries for a specific version or the latest version from the GitHub releases pages here.
<a target="_blank" href="https://github.com/aws/copilot-cli/releases">Releases · aws/copilot-cli</a>
<h3 id="heading-setting-up-oidc-provider">Setting up OIDC provider</h3>
OpenID Connect (OIDC) allows your GitHub Actions workflows to access resources in Amazon Web Services (AWS), without needing to store the AWS credentials as long-lived GitHub secrets.
We can configure AWS to trust GitHub's OIDC as a federated identity and includes a workflow for the <code>[aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials)</code> that use tokens to authenticate to AWS and access resources.
<h3 id="heading-copilot-cli-usage">Copilot CLI Usage</h3>
You can use the copilot after installing the tool in your PATH. 
<pre><code class="lang-bash">copilot --version
</code></pre>
You can use the deploy command using copilot cli
<pre><code class="lang-bash">copilot deploy --name demo --env test
</code></pre>
I’ve written a GitHub Actions wrapping these functionalities
<ul>
<li>Installing Copilot CLI in Tool path</li>
<li>Deploy the Copilot Application</li>
</ul>
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/marketplace/actions/aws-copilot">https://github.com/marketplace/actions/aws-copilot</a></div>
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/aws-copilot-github-action">https://github.com/ksivamuthu/aws-copilot-github-action</a></div>
<h2 id="heading-aws-copilot-github-actions-usage">AWS Copilot GitHub Actions Usage</h2>
To install the copilot cli in the path. You can add the <code>ksivamuth/aws-copilot-github-action@v0.0.1</code> steps with commands installed to add the copilot cli in the tool path. You can access the copilot cli - for e.g, we are checking the version here.
<pre><code class="lang-yaml"> build:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v2
 - name: Configure AWS credentials
 uses: aws-actions/configure-aws-credentials@v1
 with:
 role-to-assume: arn:aws:iam::111111111111:role/my-github-actions-role-test
 aws-region: us-east-1
 - uses: ksivamuthu/aws-copilot-github-action@v0.0.1
 with:
 command: install
 - run: |
 copilot --version
</code></pre>
To deploy the application using copilot. Pass the application name and environment.
<pre><code class="lang-yaml">
 deploy:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v2
 - name: Configure AWS credentials
 uses: aws-actions/configure-aws-credentials@v1
 with:
 role-to-assume: arn:aws:iam::111111111111:role/my-github-actions-role-test
 aws-region: us-east-1
 - uses: ksivamuthu/aws-copilot-github-action@v0.0.1
 with:
 command: deploy
 app: your-awesome-app
 env: prod
 force: false # optional
</code></pre>
The above example is in the demo repository <a target="_blank" href="https://github.com/ksivamuthu/demo-copilot-container-app">here</a>.
When the changes are pushed into GitHub, the action builds the docker image and push the image repository into ECR. Then the pushed docker image is deployed into the configured environment for this ECS or AppRunner application.
<img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t3kgpv26a14q79m061g2.jpg" alt="Copilot" />
Once the workflow is successful, you can see the latest version of the application deployed. 
<h2 id="heading-conclusion">Conclusion</h2>
🚀 AWS Copilot supercharges your application - one cli tool to set up infrastructure, build your application with many services, set up the pipeline to automate release, monitor the status of stack and application, and with add-ons. In this blog, we took a look at how to integrate the Copilot app using GitHub Actions.
I'm Siva - working as Sr. Software Architect at Computer Enterprises Inc from Orlando. I'm an AWS Community builder, and Auth0 Ambassador and I am going to write a lot about Cloud, Containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me <a target="_blank" href="https://hashnode.com/@ksivamuthu">@ksivamuthu</a> Twitter or check out my blogs at <a target="_blank" href="https://blog.sivamuthukumar.com/">blog.sivamuthukumar.com</a>!

In this blog, I’m going to walk through how to set up AWS Copilot in GitHub actions. 
AWS Copilot
AWS Copilot is an open-source command-line interface that makes it easy for developers to build, release, and operate production-ready containerized app...

AWS Copilot GitHub Actions

In today's blog post, we will see how to validate the JWTs using Auth0 Golang JWT middleware using Gin Web Framework. Gin is a web framework written in Go (Golang). In deep-dive, we will see how to integrate the Auth0 Golang JWT middleware to verify JWTs generated using both HS256 and RS256 using secret and JWKs.
Auth0 Golang JWT middleware stable version v2.0.0 released on Jan 19, 2022
<a target="_blank" href="https://github.com/auth0/go-jwt-middleware/releases/tag/v2.0.0">Release v2.0.0 · auth0/go-jwt-middleware</a>
<h2 id="heading-gin-web-framework">Gin Web Framework</h2>
Gin is a high-performance micro-framework that can build web applications and microservices. It makes it simple to build a request handling pipeline from modular, reusable pieces. It does this by allowing you to write middleware that can be plugged into one or more request handlers or groups of request handlers.
Let's create a simple API using Golang Gin Web Framework.
<ul>
<li>Install Gin package<pre><code class="lang-bash">go get -u github.com/gin-gonic/gin
</code></pre>
</li>
<li>Import it in your code and run simple api
<pre><code class="lang-go">package main

import (
 "context"
 "net/http"
 "github.com/gin-gonic/gin"
)

type Product struct {
 ID int `json:"id"`
 Title string `json:"title"`
 Code string `json:"code"`
 Price float32 `json:"price"`
}

func main() {
 r := gin.Default()

 r.GET("/products", func(c *gin.Context) {
 products := []Product{
 {ID: 1, Title: "Product 1", Code: "p1", Price: 100.0},
 {ID: 2, Title: "Product 2", Code: "p2", Price: 200.0},
 {ID: 3, Title: "Product 3", Code: "p3", Price: 300.0},
 }
 c.JSON(http.StatusOK, products)
 })

 // Listen and Server in 0.0.0.0:5000
 r.Run(":5000")
}
</code></pre>
</li>
</ul>
<h2 id="heading-add-jwt-middleware">Add JWT Middleware</h2>
Before configuring the Auth0 APIs, lets' integrate the Auth0 Golang JWT middleware.
<a target="_blank" href="https://github.com/auth0/go-jwt-middleware">GitHub - auth0/go-jwt-middleware: A Middleware for Go Programming Language to check for JWTs on HTTP requests</a>
<pre><code class="lang-go">go get github.com/auth0/go-jwt-middleware/v2
</code></pre>
Auth0 Golang JWT middleware is the HTTP middleware handler. To use it in the Gin Web framework, we need a wrapper to wrap the common HTTP middleware to the Gin middleware handler. For that purpose, I'm using Gin Adapter from Gareth Watts. <a target="_blank" href="https://github.com/gwatts/gin-adapter">https://github.com/gwatts/gin-adapter</a>
<pre><code class="lang-go">package main

import (
 "context"
 "net/http"

 jwtmiddleware "github.com/auth0/go-jwt-middleware/v2"
 "github.com/auth0/go-jwt-middleware/v2/validator"
 "github.com/gin-gonic/gin"
 "github.com/gwatts/gin-adapter"
)

type Product struct {
 ID int `json:"id"`
 Title string `json:"title"`
 Code string `json:"code"`
 Price float32 `json:"price"`
}

func main() {
 r := gin.Default()

 keyFunc := func(ctx context.Context) (interface{}, error) {
 return []byte("secret"), nil
 }

 jwtValidator, _ := validator.New(keyFunc, validator.HS256, "http://localhost:5000", []string{"api:read"})
 jwtMiddleware := jwtmiddleware.New(jwtValidator.ValidateToken)

 // Wrap the http handler with gin adapter
 r.Use(adapter.Wrap(jwtMiddleware.CheckJWT))

 r.GET("/products", func(c *gin.Context) {
 products := []Product{
 {ID: 1, Title: "Product 1", Code: "p1", Price: 100.0},
 {ID: 2, Title: "Product 2", Code: "p2", Price: 200.0},
 {ID: 3, Title: "Product 3", Code: "p3", Price: 300.0},
 }
 c.JSON(http.StatusOK, products)
 })

 // Listen and Server in 0.0.0.0:5000
 r.Run(":5000")
}
</code></pre>
Let's test this API with JWT URLs.
<pre><code class="lang-go">curl --location --request GET 'http://localhost:5000/products' \
--header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjUwMDAiLCJhdWQiOiJhcGk6cmVhZCJ9.hbgwKW_RILeXXDDUv5bVK3WgjtvqoK5IiuisgnFWefY'
</code></pre>
You can generate a new JWT with issuer <code>[http://localhost:5000](http://localhost:5000)</code> and audience <code>api:read</code> with the HS256 algorithm with a shared secret <code>secret</code>
<pre><code class="lang-bash">➜ ~ curl --location --request GET 'http://localhost:5000/products' \
--header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjUwMDAiLCJhdWQiOiJhcGk6cmVhZCJ9.hbgwKW_RILeXXDDUv5bVK3WgjtvqoK5IiuisgnFWefY' | jq
 % Total % Received % Xferd Average Speed Time Time Time Current
 Dload Upload Total Spent Left Speed
100 160 100 160 0 0 6011 0 --:--:-- --:--:-- --:--:-- 20000
[
 {
 "id": 1,
 "title": "Product 1",
 "code": "p1",
 "price": 100
 },
 {
 "id": 2,
 "title": "Product 2",
 "code": "p2",
 "price": 200
 },
 {
 "id": 3,
 "title": "Product 3",
 "code": "p3",
 "price": 300
 }
]
</code></pre>
<h2 id="heading-configure-auth0-apis">Configure Auth0 APIs</h2>
Now it's time to add authorization to the API using Auth0. Let's configure Auth0 APIs with the signing algorithm RS256 and change the Auth0 Golang middleware code to support RS256.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1643439306590/v_owRw7RM.png" alt="api.png" />
Add the permission <code>read:products</code> in the API
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1643439332320/COrvvVSvL-.png" alt="scopes.png" />
Change the Auth0 middleware to validate the RS256 signature JWT token.
<pre><code class="lang-go">issuerURL, _ := url.Parse(os.Getenv("AUTH0_ISSUER_URL"))
audience := os.Getenv("AUTH0_AUDIENCE")

provider := jwks.NewCachingProvider(issuerURL, time.Duration(5*time.Minute))

jwtValidator, _ := validator.New(provider.KeyFunc,
 validator.RS256,
 issuerURL.String(),
 []string{audience},
)

jwtMiddleware := jwtmiddleware.New(jwtValidator.ValidateToken)
r.Use(adapter.Wrap(jwtMiddleware.CheckJWT))
</code></pre>
The complete code looks like below.
<pre><code class="lang-go">package main

import (
 "log"
 "net/http"
 "net/url"
 "os"
 "time"

 adapter "github.com/gwatts/gin-adapter"

 jwtmiddleware "github.com/auth0/go-jwt-middleware/v2"
 "github.com/auth0/go-jwt-middleware/v2/jwks"
 "github.com/auth0/go-jwt-middleware/v2/validator"

 "github.com/gin-gonic/gin"
 "github.com/joho/godotenv"
)

type Product struct {
 ID int `json:"id"`
 Title string `json:"title"`
 Code string `json:"code"`
 Price float32 `json:"price"`
}

func main() {
 err := godotenv.Load()
 if err != nil {
 log.Fatal("Error loading .env file")
 }

 r := gin.Default()

 issuerURL, _ := url.Parse(os.Getenv("AUTH0_ISSUER_URL"))
 audience := os.Getenv("AUTH0_AUDIENCE")

 provider := jwks.NewCachingProvider(issuerURL, time.Duration(5*time.Minute))

 jwtValidator, _ := validator.New(provider.KeyFunc,
 validator.RS256,
 issuerURL.String(),
 []string{audience},
 )

 jwtMiddleware := jwtmiddleware.New(jwtValidator.ValidateToken)
 r.Use(adapter.Wrap(jwtMiddleware.CheckJWT))

 r.GET("/products", func(c *gin.Context) {
 products := []Product{
 {ID: 1, Title: "Product 1", Code: "p1", Price: 100.0},
 {ID: 2, Title: "Product 2", Code: "p2", Price: 200.0},
 {ID: 3, Title: "Product 3", Code: "p3", Price: 300.0},
 }
 c.JSON(http.StatusOK, products)
 })

 // Listen and Server in 0.0.0.0:5000
 r.Run(":5000")
}
</code></pre>
<h2 id="heading-verify-auth0-jwt">Verify Auth0 JWT</h2>
Create a test JWT from the API Test page. Call the API with the test token.
<pre><code class="lang-bash">➜ auth0-go-gin-middleware curl --location --request GET 'http://localhost:5000/products' \
--header 'authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InVUT0ktNGhrSDBWNU9YUGxKV0xpXyJ9.eyJpc3MiOiJodHRwczovL3NpdmEtZGVtby1hcHAudXMuYXV0aDAuY29tLyIsInN1YiI6Inl2N1NDekVueUxTWGdMZ1d3b2pJODZvNk5ZMzh0cmNtQGNsaWVudHMiLCJhdWQiOiJodHRwczovL3Byb2R1Y3RzLWFwaS8iLCJpYXQiOjE2NDM0MzM4NTYsImV4cCI6MTY0MzUyMDI1NiwiYXpwIjoieXY3U0N6RW55TFNYZ0xnV3dvakk4Nm82TlkzOHRyY20iLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.yH13H5XxLEABu3o8s2HZUs8Q9PXHeLGUcELQdlrYoClKP3k3B_WdUpaH2_c-UpA1ZjB_Is71-hSt3iqQN_OaMV_fFqpnt0qJQNXsoWSHBE5CzDDAclRlFf5XaWVbcA072rzUAtrJuPzHYf8kdR91243lJFA_13V5vlQuWxqFxas4FonVR5OLGcXYHqLfBI76DPfFaOBwOzefSYSI_jxKrrQtnux4Ktkqrgo7tpFckY6UfD6fXPeRvk4xLSb_SteAwcpCQrWJVyt7gTWv4_KkSNEyZduEbMTrnkU_jdQjHuKOLaTBc4t7t3MK_2_tmrda5xn0QXf-1y6P2M4zQu2mWA' | jq
 % Total % Received % Xferd Average Speed Time Time Time Current
 Dload Upload Total Spent Left Speed
100 160 100 160 0 0 8045 0 --:--:-- --:--:-- --:--:-- 40000
[
 {
 "id": 1,
 "title": "Product 1",
 "code": "p1",
 "price": 100
 },
 {
 "id": 2,
 "title": "Product 2",
 "code": "p2",
 "price": 200
 },
 {
 "id": 3,
 "title": "Product 3",
 "code": "p3",
 "price": 300
 }
]
</code></pre>
<h2 id="heading-conclusion">Conclusion</h2>
In this blog post, we walked through how to use Auth0 Golang middleware v2.0.0 to verify the JWT on both HS256 and RS256 signatures. You can extend this demo project to verify the custom claims in JWT and more. We will see in more detail in upcoming blog posts.

In today's blog post, we will see how to validate the JWTs using Auth0 Golang JWT middleware using Gin Web Framework. Gin is a web framework written in Go (Golang). In deep-dive, we will see how to integrate the Auth0 Golang JWT middleware to verify ...

Auth0 JWT Middleware in Go - Gin Web Framework

<a target="_blank" href="https://docs.aws.amazon.com/eks/latest/userguide/eks-connector.html">Amazon EKS Connector</a> is now generally available. With EKS Connector, you can now extend the EKS console to view your Kubernetes clusters outside AWS. What !?! Yes, now we can use the EKS console to visualize the Kubernetes clusters, both EKS and non-EKS clusters running in.
<ul>
<li>On-premises Kubernetes Cluster</li>
<li>Self-managed Clusters running on AWS EC2 instances</li>
<li>Clusters from other cloud providers</li>
</ul>
In today's blog, we will see how to connect the kubernetes clusters from my home lab and Azure / GCP Cloud providers along with EKS using eksctl. Once connected, we can see the cluster details, configurations, and workloads in one place on the EKS console.
<h2 id="heading-kubernetes-clusters">Kubernetes Clusters</h2>
Home Lab
I have the home lab kubernetes cluster running on my mini pc that's running Linux. It was previously running on Raspberry Pi, and later I switched the lab to mini pc. I often flash Raspberry Pi for my IoT experiments; there are no apparent reasons. You can set up the kubernetes cluster on Raspberry Pi if you wish. I'm using K3s - lightweight kubernetes distribution designed for running production workloads in resource-constrained, IoT edge devices.
Azure Kubernetes Service
The Amazon EKS connector can also connect the Kubernetes clusters running on other cloud providers. I've set up the AKS (Azure Kubernetes Service) for this blog in the Azure environment.
EKS
I've EKS cluster along with the other clusters too. Amazon Elastic Kubernetes Service (Amazon EKS) is a managed container service to run and scale Kubernetes applications in AWS infrastructure.
<h2 id="heading-registering-a-cluster">Registering a Cluster</h2>
<code>eksctl</code> simplifies registering non-EKS clusters by creating the required AWS resources and generating Kubernetes manifests for EKS Connector to apply to the external cluster.
To register or connect a non-EKS Kubernetes cluster, run
<pre><code class="lang-bash">➜ eksctl register cluster --name siva-home-lab --provider rancher
</code></pre>
The supported providers are : EKS_ANYWHERE, ANTHOS, GKE, AKS, OPENSHIFT, TANZU, RANCHER, EC2, OTHER
When registering, eksctl creates three yaml files.
<ul>
<li>eks-connector.yaml - Deploys EKS connector agent</li>
<li>eks-connector-clusterrole.yaml - Cluster Role of cluster</li>
<li>eks-connector-console-dashboard-full-access-group.yaml - Console Dashboard Full Access</li>
</ul>
<pre><code class="lang-bash">➜ eksctl register cluster --name siva-home-lab --provider rancher
2022-01-03 21:30:07 [ℹ] creating IAM role "eksctl-20220103213007309381"
2022-01-03 21:30:17 [ℹ] registered cluster "siva-home-lab" successfully
2022-01-03 21:30:17 [ℹ] wrote file eks-connector.yaml to /Users/ksivamuthu/personal
2022-01-03 21:30:17 [ℹ] wrote file eks-connector-clusterrole.yaml to /Users/ksivamuthu/personal
2022-01-03 21:30:17 [ℹ] wrote file eks-connector-console-dashboard-full-access-group.yaml to /Users/ksivamuthu/personal
2022-01-03 21:30:17 [!] note: "eks-connector-clusterrole.yaml" and "eks-connector-console-dashboard-full-access-group.yaml" give full EKS Console access to IAM identity "arn:aws:iam::495775103319:user/siva", edit if required; read https://docs.aws.amazon.com/eks/latest/userguide/connector-grant-access.html for more info
2022-01-03 21:30:17 [ℹ] run `kubectl apply -f eks-connector.yaml,eks-connector-clusterrole.yaml,eks-connector-console-dashboard-full-access-group.yaml` before 07 Jan 22 02:30 UTC to connect the cluster
</code></pre>
Apply the generated YAMLs in your cluster.
<pre><code class="lang-bash">➜ kubectl apply -f eks-connector.yaml, \
 eks-connector-clusterrole.yaml, \
 eks-connector-console-dashboard-full-access-group.yaml
</code></pre>
<h2 id="heading-dashboard-workloads-configuration-andamp-tags">Dashboard - Workloads, Configuration &amp; Tags</h2>
Once the cluster is registered and yamls are applied, you can view your non-EKS cluster in EKS Console.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1641267529416/tVDE5aMnu.png" alt="cluster" />
You can see the workloads, configuration and manage tags of the non-eks clusters.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1641267531267/jmEK2OyAa.png" alt="cluster" />
Let’s register the AKS cluster by repeating the registration steps.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1641267533106/QM7ZH8lOj.png" alt="workloads" />
<h2 id="heading-deregistering-a-cluster">Deregistering a cluster</h2>
To deregister cluster, you can use eksctl command.
<pre><code class="lang-bash">➜ eksctl deregister cluster --name siva-home-lab --region us-east-1
</code></pre>
It deregisters the cluster and we can delete the API server objects using kubectl
<pre><code class="lang-bash">➜ eksctl deregister cluster --name siva-home-lab --region us-east-1
2022-01-03 21:56:39 [ℹ] deleting IAM role "eksctl-20220103213007309381"
2022-01-03 21:56:39 [ℹ] unregistered cluster "siva-home-lab" successfully
2022-01-03 21:56:39 [ℹ] run `kubectl delete -f eks-connector.yaml,eks-connector-clusterrole.yaml,eks-connector-console-dashboard-full-access-group.yaml` on your cluster to remove EKS Connector resources
</code></pre>
<h2 id="heading-conclusion">Conclusion</h2>
EKS Anywhere and EKS Connector are part of a clear play for businesses embracing hybrid cloud and private infrastructure setups. EKS Connector supports self-managed clusters on EC2, EKS Anywhere clusters running on-premises, and other Kubernetes clusters running outside of AWS to the EKS console. It’s great tool providing single pane of dashboard managing all of your Kubernetes cluster including EKS &amp; Non EKS.
I'm Siva - working as Sr. Software Architect at <a target="_blank" href="https://www.ceiamerica.com">Computer Enterprises Inc</a> from Orlando. I'm an AWS Community builder, Auth0 Ambassador and I am going to write a lot about Cloud, Containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me <a target="_blank" href="https://www.twitter.com/ksivamuthu">@ksivamuthu</a> Twitter or check out my blogs at https://sivamuthukumar.com

Amazon EKS Connector is now generally available. With EKS Connector, you can now extend the EKS console to view your Kubernetes clusters outside AWS. What !?! Yes, now we can use the EKS console to visualize the Kubernetes clusters, both EKS and non-...

AWS EKS Connector - Manage all your Kubernetes Clusters in one place

In this tutorial blog post, we are going to see how to deploy .NET 6 API to AWS App Runner using AWS Copilot CLI. 
What is App Runner?
AWS App Runner is a fully managed service that makes it easy for developers to quickly deploy containerized web app...

Deploy .NET 6 API to AWS App Runner using AWS Copilot CLI

Hello all, In today's blog, we are going to learn about policy as code in Kubernetes using Kyverno. Let's get started.
<h2 id="what-is-policy-as-code">What is Policy as Code?</h2>
Policy as Code (PaC) is the idea of writing code in a high-level language to manage and automate policies. The DevOps team can adopt the best practices by representing policies as code, such as version control, automated testing, and automated deployment. You can use these policies in audit or enforcement mode to monitor existing workloads, services for misconfiguration or prevent the misconfigurations applying in the cluster. 
<h2 id="policy-as-code-in-kubernetes">Policy as Code in Kubernetes</h2>
Policies could be established for multiple areas of your operational environments. You want your Kubernetes clusters to be reliable and secure and you want to control who has access to what. You also want to enforce rules for your kubernetes resources. There are specific things you want to enforce Kubernetes workloads from security, configuration, deployment best practices, operational concerns, governance and compliance requirements.
The three categories in the policy for kubernetes:
<ul>
<li>Standard policies - Best practices across the cluster in the organizations<ul>
<li>E.g: Requiring resources to specify the resource limits. Prevent workloads from running as root, etc</li>
</ul>
</li>
<li>Organization policies - Enforce the policies specific to your organization<ul>
<li>E.g - Enforce the private image repository list to pull, Labels such as application name, environment to specify in workloads, policies with organization complian and audit requirements.</li>
</ul>
</li>
<li>Environment policies - Enforce the policies specific to the environment<ul>
<li>E.g - Stricter security enforcement in production cluster</li>
</ul>
</li>
</ul>
<h2 id="kyverno-policy-engine">Kyverno - Policy Engine</h2>
Kyverno (Greek for "govern") is a policy engine designed specifically for Kubernetes. The features are
<ul>
<li>policies as Kubernetes resources in YAML (no new language to learn!)</li>
<li>validate, mutate, or generate any resource using Kustomize overlays</li>
<li>match resources using label selectors and wildcards</li>
<li>block non-conformant resources using admission controls, or report policy violations</li>
<li>test policies and validate resources using the Kyverno CLI, in your CI/CD pipeline, before applying them to your cluster</li>
</ul>
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/kyverno/kyverno">https://github.com/kyverno/kyverno</a></div>
<h2 id="how-does-it-work">How does it work?</h2>
Kyverno runs as a dynamic admission controller in a Kubernetes cluster. Kyverno receives validating and mutating admission webhook HTTP callbacks from the kube-apiserver and applies matching policies to return results that enforce admission policies or reject requests.
<img src="https://kyverno.io/images/kyverno-architecture.png" alt="https://kyverno.io/images/kyverno-architecture.png" />
<h2 id="getting-started">Getting Started</h2>
The prerequisite for this tutorial is a functional kubernetes cluster. You can create the EKS cluster using the <code>eksctl</code> tool.
<pre><code class="lang-docker">apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
 name: eks-k8s-policy-demo
 region: us-east-1

availabilityZones: 
 - us-east-1a
 - us-east-1b

managedNodeGroups:
 - name: eks-k8s-policy-demo-ng
 instanceType: t3.medium
 minSize: 1
 maxSize: 5
</code></pre>
<h2 id="policies-and-usecases">Policies and Usecases</h2>
The Kyverno team created the best practices and most used policies in this website <a target="_blank" href="https://kyverno.io/policies/">here</a>. There are three different policy types.
<ol>
<li>Validate</li>
<li>Mutate</li>
<li>Generate</li>
</ol>
We will see the demo on the below use cases and policies we can enforce for kubernetes deployments.
<ul>
<li>Enforce "application name" label in the pod</li>
<li>Require Limits and Requests</li>
<li>Add network policy</li>
</ul>
<h3 id="enforce-application-name-label-in-the-pod">Enforce "Application Name" label in the pod</h3>
<pre><code class="lang-yaml">apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
 name: require-labels
spec:
 validationFailureAction: enforce
 rules:
 - name: check-for-labels
 match:
 resources:
 kinds:
 - Pod
 validate:
 message: "The label `app.kubernetes.io/name` is required."
 pattern:
 metadata:
 labels:
 app.kubernetes.io/name: "?*"
</code></pre>
Let's see how this policy. works by creating the deployment in the pod. Apply the above policy in your cluster. Create a inflate deployment in the cluster without any labels.
<pre><code class="lang-yaml">➜ kyverno-demo git:(main) ✗ kubectl create deployment inflate --image=public.ecr.aws/eks-distro/kubernetes/pause:3.2
error: failed to create deployment: admission webhook "validate.kyverno.svc" denied the request:

resource Deployment/default/inflate was blocked due to the following policies

require-labels:
 autogen-check-for-labels: 'validation error: The label `app.kubernetes.io/name`
 is required. Rule autogen-check-for-labels failed at path /spec/template/metadata/labels/app.kubernetes.io/name/'
</code></pre>
Now, let's create the deployment with app.kubernetes.io/name label.
<pre><code class="lang-yaml">apiVersion: apps/v1
kind: Deployment
metadata:
 labels:
 app.kubernetes.io/name: inflate
 name: inflate
spec:
 replicas: 1
 selector:
 matchLabels:
 app.kubernetes.io/name: inflate
 template:
 metadata:
 labels:
 app.kubernetes.io/name: inflate
 spec:
 containers:
 - image: public.ecr.aws/eks-distro/kubernetes/pause:3.2
 name: pause

➜ kyverno-demo git:(main) ✗ kubectl apply -f deployment.yaml
deployment.apps/inflate created
</code></pre>
<h3 id="require-limits-and-requests">Require Limits and Requests</h3>
<pre><code class="lang-yaml">apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
 name: require-requests-limits
spec:
 validationFailureAction: enforce
 rules:
 - name: validate-resources
 match:
 resources:
 kinds:
 - Pod
 validate:
 message: "CPU and memory resource requests and limits are required."
 pattern:
 spec:
 containers:
 - resources:
 requests:
 memory: "?*"
 cpu: "?*"
 limits:
 memory: "?*"
</code></pre>
These policies are validation type policies. It validates the specific pattern in your kubernetes api objects.
<h3 id="add-network-policy">Add network policy</h3>
<pre><code class="lang-yaml">apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
 name: add-networkpolicy
spec:
 validationFailureAction: enforce
 rules:
 - name: default-deny
 match:
 resources: 
 kinds:
 - Namespace
 generate:
 kind: NetworkPolicy
 name: default-deny
 namespace: "{{request.object.metadata.name}}"
 synchronize: true
 data:
 spec:
 # select all pods in the namespace
 podSelector: {}
 # deny all traffic
 policyTypes: 
 - Ingress
 - Egress
</code></pre>
<h2 id="monitoring-dashboard">Monitoring - Dashboard</h2>
Kyverno has its metrics exposed through Prometheus metrics endpoint. You can scrape the kyverno metrics or display in grafana dashboard. Kyverno has the policy reporter UI that can target different channels. Checkout here. 
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/kyverno/policy-reporter">https://github.com/kyverno/policy-reporter</a></div>
<img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cwty9mtktcmmog7f7kvv.png" alt="image" />
<h2 id="shift-left">Shift Left</h2>
You can validate the policies before applying the cluster using cli. I've integrated kyverno cli action in github before deploying yaml files in kubernetes cluster.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/kyverno-policy-demo">https://github.com/ksivamuthu/kyverno-policy-demo</a></div>
<pre><code class="lang-yaml">- name: Validate policy
 uses: gbaeke/kyverno-cli@v1
 with:
 command: |
 kyverno apply ./policies --resource=./k8s/2048.yaml
</code></pre>
<img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ojns66lke70g6lvyl36e.png" alt="Screen Shot 2021-10-05 at 7.38.18 PM" />
After fixing the YAML files 
<img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ax062b7bdnkow9vqn3ed.png" alt="Screen Shot 2021-10-05 at 8.03.44 PM" />
<h2 id="conclusion">Conclusion</h2>
You can improve the security posture for your clusters with policies as code using Kyverno. No need to learn new language to create or manager policies. It works with your existing tools such as git, kustomize, kubectl etc.
I'm Siva - working as Sr. Software Architect at Computer Enterprises Inc from Orlando. I'm an AWS Community builder, Auth0 Ambassador and I am going to write a lot about Cloud, Containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me @ksivamuthu Twitter or check out my blogs at https://blog.sivamuthukumar.com!

Hello all, In today's blog, we are going to learn about policy as code in Kubernetes using Kyverno.  Let's get started.
What is Policy as Code?
Policy as Code (PaC) is the idea of writing code in a high-level language to manage and automate policies....

Enforcing Policy as Code using Kyverno in Kubernetes

Hello everyone !! If you are running your workloads on the AWS EKS cluster, you may explore the rules and limitations of node group scaling to provision the deployments dynamically. This blog will explore the node lifecycle management solutions AWS Lab's Karpenter, an alternative approach to the frequently used Cluster Autoscaler solution. 
<h2 id="kubernetes-autoscaling">Kubernetes Autoscaling</h2>
Autoscaling allows you to dynamically adjust to demand without manual intervention through metrics or events. Without autoscaling, there will be considerable efforts to provision the (scaling up or down) resources. When the running conditions change, and optimal resource utilization and managing the cloud spending is challenging. The cluster is always running at peak capacity to ensure availability or not meeting peak demand as they don't have enough resources.
When it comes to the Kubernetes Autoscaling, there are two different layers, 
<ol>
<li>Pod Level Autoscaling (Horizontal - HPA, and Vertical - HPA)</li>
<li>Node Level Autoscaling</li>
</ol>
<h3 id="pod-level-autoscaling">Pod Level Autoscaling</h3>
Horizontal Pod Autoscaling (Scaling out) - dynamically increase or decrease the number of running pods per your application's usage changes.
Vertical Pod Autoscaling (Scaling up) - scale the given deployments vertically within a cluster by reconciling the pods' size ( CPU or memory targets) based on their current usage and the desired target.
HPA and VPA essentially make sure that all of the services running in your cluster can dynamically handle the demand.
<h3 id="node-level-autoscaling">Node Level Autoscaling</h3>
Node Level autoscaling solves the issue - to scale the nodes in the cluster when the existing nodes are overloaded or pending to be scheduled with newly scaled pods or scale down when the nodes are underutilized.
There is already an industry-adopted, open-source, and vendor-neutral tool - Cluster Autoscaler that automatically adjusts the cluster size (by adding or removing nodes) based on the presence of pending pods and node utilization metrics. It uses the existing cloud building blocks (Autoscaling Group on AWS) for scaling. The challenges in the cluster autoscaler are the limitations on node groups, and the scaling is tightly bound to the scheduler. 
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler">https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler</a></div>
<h2 id="karpenter">Karpenter</h2>
Karpenter is a node lifecycle management solution - incubating in AWS Labs, OSS, and vendor-neutral. It observes incoming pods and launches the right instances for the situation. Instance selection decisions are intent-based and driven by the specification of incoming pods, including resource requests and scheduling constraints.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/awslabs/karpenter">https://github.com/awslabs/karpenter</a></div>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1632450827335/nq0X2fa5G.png" alt="image.png" />
How does it work?
<ol>
<li>Observes the pod resource requests of unscheduled pods</li>
<li>Direct provision of Just-in-time capacity of the node. (Groupless Node Autoscaling)</li>
<li>Terminating nodes if outdated</li>
<li>Reallocating the pods in nodes for better resource utilization</li>
</ol>
Karpenter has two control loops that maximize the availability and efficiency of your cluster.
<ol>
<li>Allocator - Fast-acting controller ensuring that pods are scheduled as quickly as possible</li>
<li>Reallocator - Slow-acting controller replaces nodes as pods capacity shifts over time.</li>
</ol>
<h3 id="getting-started">Getting started</h3>
In this section, we will quickly see the node lifecycle scenarios using Karpenter in an AWS EKS cluster. Create necessary IAM roles for Karpenter autoscaler with the cloud formation template and Create EKS cluster with the below config file using eksctl. Please refer to the documentation here. 
<pre><code class="lang-yaml">apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
 name: eks-karpenter-demo
 region: us-east-1

availabilityZones: 
 - us-east-1a
 - us-east-1b

managedNodeGroups:
 - name: eks-karpenter-demo-ng
 instanceType: t3.medium
 minSize: 1
 maxSize: 5
</code></pre>
You need to enable the service account and auth-config map accounts to the Karpenter. Please refer to the document <a target="_blank" href="https://karpenter.sh/docs/getting-started/">here</a>.
Install the karpenter helm chart.
<pre><code class="lang-bash">helm repo add karpenter https://awslabs.github.io/karpenter/charts
helm repo update
helm upgrade --install karpenter karpenter/karpenter --namespace karpenter \
 --create-namespace --set serviceAccount.create=false --version 0.3.3
</code></pre>
<h3 id="configure-the-karpenter-provisioner">Configure the Karpenter Provisioner</h3>
Configure the Karpenter provisioner as below. Please check the provider spec for more details.
<pre><code class="lang-yaml">apiVersion: karpenter.sh/v1alpha3
kind: Provisioner
metadata:
 name: default
spec:
 cluster:
 name: eks-karpenter-demo
 endpoint: &lt;CLUSTER_ENDPOINT&gt;
 instanceTypes:
 - t3.medium 
 ttlSecondsAfterEmpty: 30
</code></pre>
<h3 id="deployment">Deployment</h3>
Let's do the deployment to check the launching capacity and terminating capacity features.
<pre><code class="lang-yaml">kubectl create deployment inflate --image=public.ecr.aws/eks-distro/kubernetes/pause:3.2
</code></pre>
<h3 id="provisioning-nodes">Provisioning Nodes</h3>
Scale the deployment and check out the logs in the Karpenter controller.
<pre><code class="lang-yaml">kubectl scale deployment inflate --replicas=10
</code></pre>
Check the logs of the karpenter controller
<pre><code class="lang-bash">➜ eks-karpenter-demo git:(main) kubectl logs -f -n karpenter $(kubectl get pods -n karpenter -l karpenter=controller -o name)
2021-09-23T04:46:11.280Z INFO controller.allocation.provisioner/default Starting provisioning loop {"commit": "bc99951"}
2021-09-23T04:46:11.280Z INFO controller.allocation.provisioner/default Waiting to batch additional pods {"commit": "bc99951"}
2021-09-23T04:46:12.452Z INFO controller.allocation.provisioner/default Found 9 provisionable pods {"commit": "bc99951"}
2021-09-23T04:46:13.689Z INFO controller.allocation.provisioner/default Computed packing for 9 pod(s) with instance type option(s) [t3.medium] {"commit": "bc99951"}
2021-09-23T04:46:16.228Z INFO controller.allocation.provisioner/default Launched instance: i-0174aa47fe6d1f7b4, type: t3.medium, zone: us-east-1b, hostname: ip-192-168-116-109.ec2.internal {"commit": "bc99951"}
2021-09-23T04:46:16.265Z INFO controller.allocation.provisioner/default Bound 9 pod(s) to node ip-192-168-116-109.ec2.internal {"commit": "bc99951"}
2021-09-23T04:46:16.265Z INFO controller.allocation.provisioner/default Watching for pod events {"commit": "bc99951"}
</code></pre>
The allocation controller listens for pods changes. It launched a new instance and bound the provision-able pods into the new nodes by working with kube-scheduler.
The provisioning time is fast compared to other node management solutions. The other node management solutions usually take 3 min to 6 min for the node to be available. After deploying the pods, the instances are immediately created and binding. The provisioner decides to launch a new instance within a second, and the node joins the cluster for under 60 seconds. Within 60 seconds, the nodes are available to cluster for running pods.
You can configure the instance types, capacity type, os, architecture, and other provisioner spec fields.
<h3 id="terminating-nodes">Terminating Nodes</h3>
Now, delete the deployment <code>inflate</code>. After 30 seconds (ttlSecondsAfterEmpty - Termination grace period), Karpenter should terminate the empty nodes - cordon &amp; drain by listening to the rebalance and termination events. 
<pre><code class="lang-bash">2021-09-23T04:46:18.953Z INFO controller.allocation.provisioner/default Watching for pod events {"commit": "bc99951"}
2021-09-23T04:49:05.805Z INFO controller.Node Added TTL to empty node ip-192-168-116-109.ec2.internal {"commit": "bc99951"}
2021-09-23T04:49:35.823Z INFO controller.Node Triggering termination after 30s for empty node ip-192-168-116-109.ec2.internal {"commit": "bc99951"}
2021-09-23T04:49:35.849Z INFO controller.Termination Cordoned node ip-192-168-116-109.ec2.internal {"commit": "bc99951"}
2021-09-23T04:49:36.521Z INFO controller.Termination Deleted node ip-192-168-116-109.ec2.internal {"commit": "bc99951"}
</code></pre>
<h2 id="next-steps">Next Steps</h2>
Autoscaling nodes are always challenging. Karpenter addresses key areas of challenges by eliminating Node Group and directly provision nodes. Karpenter is easy to configure, high-performance portable solution, and vendor-agnostic. It scales seamlessly working alongside native kube-scheduler and efficiently responds to dynamic resource requests. 
Check out the <a target="_blank" href="https://github.com/awslabs/karpenter/blob/main/ROADMAP.md">AWS Labs Karpenter Roadmap</a>. It's still in beta. In the year 2021, Karpenter is going to focus on covering the majority of known use cases and plan to rigorously test it for scale and performance. 
I'm Siva - working as Sr. Software Architect at <a target="_blank" href="https://www.ceiamerica.com">Computer Enterprises Inc</a> from Orlando. I'm an AWS Community builder, Auth0 Ambassador and I am going to write a lot about Cloud, Containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me <a target="_blank" href="https://www.twitter.com/ksivamuthu">@ksivamuthu</a> Twitter or check out my blogs at https://blog.sivamuthukumar.com

Hello everyone !! If you are running your workloads on the AWS EKS cluster, you may explore the rules and limitations of node group scaling to provision the deployments dynamically.  This blog will explore the node lifecycle management solutions AWS ...

Karpenter - Scaling Nodes Seamlessly in AWS EKS

Hello all, In this short post, we will take a look at Vercel's pkg - how we can package the Node.js app into a single executable. 
When we are developing a Node.js application, it totally makes sense to install dev tools, dependencies to build and run an application. In the end, the user is interested in running the app and not the code and libraries the developer integrates. In the Node.js world, it's getting tougher that - when we release the packages, the sources are also released along with the 100s of dependency code as node_modules. It brings the necessity of the package mechanism to build and distribute the node library as a single executable - with the runtime or as a single file to run on already installed nodejs runtime.
<h3 id="build-the-nodejs-app-into-a-single-file-ncc">Build the Node.js app into a single file - ncc</h3>
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/vercel/ncc">https://github.com/vercel/ncc</a></div>
ncc - Simple CLI for compiling a Node.js module into a single file, together with all its dependencies, gcc-style.
Install the ncc using the below command.
<pre><code class="lang-docker">npm i -g @vercel/ncc
</code></pre>
 Build the project using this simple command. It will output the Node.js compact build of app.js into dist/app.js
<pre><code class="lang-docker">ncc build app.js -o dist
</code></pre>
<h3 id="package-the-nodejs-app-into-a-single-executable-pkg">Package the Node.js app into a single executable - pkg</h3>
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/vercel/pkg">https://github.com/vercel/pkg</a></div>
pkg - This command-line interface enables you to package your Node.js project into an executable that can be run even on devices without Node.js installed.
Install the pkg using the below command
<pre><code class="lang-docker">npm install -g pkg
</code></pre>
Run the pkg build targeting multiple platforms. It will create the executable in the dist directory
<pre><code class="lang-docker">pkg -t node12-linux,node14-linux,node14-win index.js
</code></pre>
Targets
<code>pkg</code> can generate executables for several target machines at a time. You can specify a comma-separated list of targets via <code>--targets</code> option. A canonical target consists of 3 elements, separated by dashes, for example <code>node12-macos-x64</code> or <code>node14-linux-arm64</code>:
<ul>
<li>nodeRange (node8), node10, node12, node14, node16 or latest</li>
<li>platform alpine, linux, linuxstatic, win, macos, (freebsd)</li>
<li>arch x64, arm64, (armv6, armv7)</li>
</ul>
<h3 id="demo">Demo</h3>
 Check out this repo 
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/vercel-pkg-demo">https://github.com/ksivamuthu/vercel-pkg-demo</a></div>
Run locally and verify whether it's logging the telemetry in the console.
<pre><code class="lang-docker">➜ vercel-pkg-demo git:(main) npm i
➜ vercel-pkg-demo git:(main) node index.js
IoT Device Initialized
Telemetry: {"temperature":"56.12","humidity":"52.11"}
Telemetry: {"temperature":"68.30","humidity":"51.90"}
Telemetry: {"temperature":"53.78","humidity":"53.72"}
</code></pre>
Run <code>npm run build</code> to build the package into executable.
<pre><code class="lang-docker">"scripts": {
 "build": "npx pkg -t linux,macos,win . --out-path dist"
 },
</code></pre>
The build steps are added in GitHub Actions and you can see the executable files are added as artifacts after build.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1631668176228/CYq3OOsGM.png" alt="image.png" />
Let's download the executable and run and see whether we are seeing the same output.
<pre><code class="lang-docker">./hvac-demo-device-macos
➜ dist git:(main) ./hvac-demo-device-macos
IoT Device Initialized
Telemetry: {"temperature":"70.59","humidity":"46.23"}
Telemetry: {"temperature":"69.76","humidity":"49.93"}
Telemetry: {"temperature":"62.15","humidity":"58.93"}
</code></pre>
<h3 id="use-cases">Use cases</h3>
<ul>
<li>Make a commercial version of your application without sources</li>
<li>Make a demo/evaluation/trial version of your app without sources</li>
<li>Instantly make executables for other platforms (cross-compilation)</li>
<li>No need to install Node.js and npm to run the packaged application</li>
<li>Put your assets inside the executable to make it even more portable</li>
</ul>
<h3 id="conclusion">Conclusion</h3>
I've found vercel's pkg very useful in order to achieve a similar target and package a whole application into standalone executables for multiplatform. It's nice to have a single file that can be started right away without any external dependency. And also, it prevents from having to distribute the full sources. You can extend it for including assets and other requirements.
I'm Siva - working as Sr. Software Architect at Computer Enterprises Inc from Orlando. I'm an AWS Community builder, Auth0 Ambassador and I am going to write a lot about Cloud, Containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me @ksivamuthu Twitter or check out my blogs at blog.sivamuthukumar.com

Hello all, In this short post, we will take a look at Vercel's pkg - how we can package the Node.js app into a single executable. 
When we are developing a Node.js application, it totally makes sense to install dev tools, dependencies to build and ru...

Vercel's pkg - Package your Node.js app into a single executable

<ul>
<li><a class="post-section-overview" href="#what-is-eks-anywhere">What is EKS Anywhere?</a></li>
<li><a class="post-section-overview" href="#what-does-eks-anywhere-solve">What does EKS Anywhere solve?</a></li>
<li><a class="post-section-overview" href="#announcement">Announcement</a></li>
<li><a class="post-section-overview" href="#first-look-">First Look 👀</a><ul>
<li><a class="post-section-overview" href="#installing-eks-anywhere-local">Installing EKS Anywhere (Local)</a></li>
<li><a class="post-section-overview" href="#manage-on-premise-eks-anywhere-cluster-from-aws-eks-console">Manage on-premise EKS Anywhere Cluster from AWS EKS Console</a></li>
<li><a class="post-section-overview" href="#setup-gitops-in-eks-anywhere-cluster">Setup GitOps in EKS Anywhere Cluster</a></li>
</ul>
</li>
<li><a class="post-section-overview" href="#conclusion">Conclusion</a></li>
</ul>
<h2 id="what-is-eks-anywhere">What is EKS Anywhere?</h2>
Amazon EKS Anywhere is a new deployment option for Amazon EKS that enables you to easily create and operate Kubernetes clusters on-premises with your virtual machines. It brings a consistent AWS management experience to your data center, building on the strengths of Amazon EKS Distro, the same distribution of Kubernetes that powers EKS on AWS. Its goal is to include complete lifecycle management of multiple Kubernetes clusters capable of operating entirely independently of any AWS services.
<h2 id="what-does-eks-anywhere-solve">What does EKS Anywhere solve?</h2>
The central selling point of EKS Anywhere is that it allows customers to use Amazon’s Kubernetes software within private data centers. It makes EKS Anywhere handy in situations where businesses already have a large on-premises infrastructure that they want to modernize the cloud, keep the data in their private network due to legal reasons, or where they believe their total cost of ownership will be lower if they host workloads on their servers instead of in the public cloud.
So, the use cases the EKS Anywhere solves are
<ol>
<li>Hybrid Cloud Consistency</li>
<li>Disconnected Environment</li>
<li>Application Modernization</li>
<li>Data sovereignty</li>
</ol>
<h2 id="announcement">Announcement</h2>
ECS Anywhere and EKS Anywhere — two new versions of AWS' managed containers and managed Kubernetes services announcements are made at AWS re: Invent 2020. In <a target="_blank" href="https://aws.amazon.com/about-aws/whats-new/2021/05/amazon-elastic-container-service-anywhere-is-now-generally-available/">May 2021, ECS Anywhere was generally available</a>, and today (8th September 2021 <a target="_blank" href="https://aws.amazon.com/blogs/aws/amazon-eks-anywhere-now-generally-available-to-create-and-manage-kubernetes-clusters-on-premises/">the EKS Anywhere is available</a> for general use.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://twitter.com/ksivamuthu/status/1435678851435311110">https://twitter.com/ksivamuthu/status/1435678851435311110</a></div>
<h2 id="first-look">First Look 👀</h2>
I planned to explore AWS EKS with the three features I'm excited about.
<ul>
<li>Installation methods. (Local and/or typical Production on-premise environments (VMware)</li>
<li>Manage on-premise EKS Anywhere Cluster from AWS EKS Console</li>
<li>Setup GitOps in EKS Anywhere Cluster</li>
</ul>
In this blog post, I'm capturing the steps I followed and my thoughts on them.
<h3 id="installing-eks-anywhere-local">Installing EKS Anywhere (Local)</h3>
The <a target="_blank" href="https://github.com/weaveworks/eksctl">eksctl</a> tool is my favorite tool for creating the EKS cluster in AWS. To install "EKS Anywhere" eksctl got a plugin called <code>eksctl-anywhere</code> . This will let you create a cluster in multiple providers for local development or production workloads.
<ul>
<li>I tried macOS first. It got stuck at "Creating new bootstrap cluster" ending up a lot of containers created and exiting. Maybe, it's an issue with my macOS resource requirements. (16GB RAM, 4GB assigned for docker). Later I switched to Linux VM (2 Core, 8GB Ram) created in Azure.</li>
</ul>
To install in macOS using home brew.
<pre><code class="lang-bash">brew install aws/tap/eks-anywhere
</code></pre>
or install plugin using the following command in Linux.
<pre><code class="lang-bash">export EKSA_RELEASE="0.5.0" OS="$(uname -s | tr A-Z a-z)"
curl "https://anywhere-assets.eks.amazonaws.com/releases/eks-a/1/artifacts/eks-a/v${EKSA_RELEASE}/${OS}/eksctl-anywhere-v${EKSA_RELEASE}-${OS}-amd64.tar.gz" \
 --silent --location \
 | tar xz ./eksctl-anywhere
sudo mv ./eksctl-anywhere /usr/local/bin/
</code></pre>
Now, we are going to install the EKS Anywhere in the local environment using the docker provider.
<pre><code class="lang-bash">eksctl anywhere generate clusterconfig siva-dev --provider docker &gt; siva-dev.yaml
eksctl anywhere create cluster -f siva-dev.yaml
</code></pre>
The cluster is created successfully in a Linux VM.
<pre><code class="lang-bash">root@eks-anywhere-vm:/home/azureuser# eksctl anywhere create cluster -f siva-dev.yaml
Performing setup and validations
Warning: The docker infrastructure provider is meant for local development and testing only
✅ Docker Provider setup is valid
Creating new bootstrap cluster
Installing cluster-api providers on bootstrap cluster
Provider specific setup
Creating new workload cluster
Installing networking on workload cluster
Installing storage class on workload cluster
Installing cluster-api providers on workload cluster
Moving cluster management from bootstrap to workload cluster
Installing EKS-A custom components (CRD and controller) on workload cluster
Creating EKS-A CRDs instances on workload cluster
Installing AddonManager and GitOps Toolkit on workload cluster
GitOps field not specified, bootstrap flux skipped
Writing cluster config file
Deleting bootstrap cluster
🎉 Cluster created!
</code></pre>
Install test workloads.
<pre><code class="lang-bash">kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.0.0/docs/examples/echoservice/echoserver-namespace.yaml &amp;&amp;\
&gt; kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.0.0/docs/examples/echoservice/echoserver-service.yaml &amp;&amp;\
&gt; kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.0.0/docs/examples/echoservice/echoserver-deployment.yaml
</code></pre>
and verify the resources are created.
<pre><code class="lang-bash">root@eks-anywhere-vm:/home/azureuser# k get all -n echoserver
NAME READY STATUS RESTARTS AGE
pod/echoserver-7dd65ffdd6-jzl4f 1/1 Running 0 3m20s

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/echoserver NodePort 10.137.108.237 &lt;none&gt; 80:30795/TCP 3m21s

NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/echoserver 1/1 1 1 3m20s

NAME DESIRED CURRENT READY AGE
replicaset.apps/echoserver-7dd65ffdd6 1 1 1 3m20s
</code></pre>
Installing EKS Anywhere (VMWare)
I didn't try this out in VMWare yet. You can follow through with the documentation <a target="_blank" href="https://anywhere.eks.amazonaws.com/docs/getting-started/production-environment/">here</a>. The bare metal support is planned to release in 2022.
<h3 id="manage-on-premise-eks-anywhere-cluster-from-aws-eks-console">Manage on-premise EKS Anywhere Cluster from AWS EKS Console</h3>
The eksctl and kubectl tools are helping us to manage the on-premise EKS Anywhere cluster. Now let's see how to connect this on-premise cluster in the AWS EKS console and manage it from there as a single pane of a dashboard of all of your EKS clusters in AWS EKS and on-premise EKS Anywhere. For this purpose, The AWS EKS Connector lets you connect your EKS Anywhere cluster to the AWS EKS console, where you can see your EKS Anywhere cluster, its configuration, workloads, and their status. EKS Connector is a software agent that can be deployed on your EKS Anywhere cluster, enabling the cluster to register with the EKS console.
Create the required IAM roles and policies to register a cluster. I followed the documentation <a target="_blank" href="https://docs.aws.amazon.com/eks/latest/userguide/eks-connector.html">here</a>. Create a service-linked role - Don't miss this step. I got stuck in this without any idea why EKS Anywhere Cluster is not registering.
<pre><code class="lang-bash">aws iam create-service-linked-role --aws-service-name eks-connector.amazonaws.com
</code></pre>
Register the EKS cluster by selecting EKS Anywhere Provider and IAM role. It will give you the yaml file of the eks-connector-agent to install in the EKS anywhere cluster. And if you apply t<a target="_blank" href="https://docs.aws.amazon.com/eks/latest/userguide/connector-grant-access.html">he necessary permissions to the IAM for managing the cluster</a>, all set. 
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1631152082138/d_j5QtwtO.png" alt="image.png" />
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1631152105679/HNMCEGNnH.png" alt="image.png" />
Now you can manage the workloads, configuration of the EKS anywhere cluster from the AWS EKS console.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1631152138798/B1tbPstZC.png" alt="image.png" />
<h3 id="setup-gitops-in-eks-anywhere-cluster">Setup GitOps in EKS Anywhere Cluster</h3>
EKS Anywhere supports a <a target="_blank" href="https://www.weave.works/technologies/gitops/">GitOps</a> workflow for the management of your cluster. This is another feature I'm very much interested in - to manage the cluster configuration and workloads from the version-controlled source repo in Git.
When you create a cluster with GitOps enabled, EKS Anywhere will automatically commit your cluster configuration to the provided GitHub repository and install a GitOps toolkit on your cluster which watches that committed configuration file. Once a change is detected by the GitOps controller running in your cluster, the cluster will be adjusted to match the committed configuration file.
Add the gitops configuration as below in the YAML file you generated above. There is no way to modify the existing cluster from eksctl anywhere. So I deleted the cluster and recreated it with gitops configuration.
<pre><code class="lang-yaml">apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: Cluster
metadata:
 name: siva-dev
spec:
 ...
 gitopsRef:
 kind: GitOpsConfig
 name: siva-dev-gitops
---
apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: DockerDatacenterConfig
metadata:
 name: siva-dev
spec: {}

---
apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: GitOpsConfig
metadata:
 name: siva-dev-gitops
spec:
 flux:
 github:
 personal: true
 repository: eks-anywhere-gitops
 owner: ksivamuthu
</code></pre>
The repo is set and the flux is installed in the cluster pointing to the repo we configured. The changes in the configuration you pushed to the git branch will be monitored by the GitOps controller. GitOps Controller pulls the changes and apply the changes in the cluster - configuration and workloads. 
<pre><code class="lang-docker">root@eks-anywhere-vm:/home/azureuser# k get pods -n flux-system
NAME READY STATUS RESTARTS AGE
helm-controller-6d875c9745-8np9b 1/1 Running 0 8m9s
kustomize-controller-74c85f9944-8f48m 1/1 Running 0 8m9s
notification-controller-7c59756d9d-krtrc 1/1 Running 0 8m9s
source-controller-65dcfdf7f7-twds7 1/1 Running 0 8m9s
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1631152739634/2Mhy6pTsu.png" alt="image.png" />
<h2 id="conclusion">Conclusion</h2>
With Amazon EKS Anywhere, customers can now create and run Kubernetes clusters on-premises using VMware Inc.’s vSphere. It comes with an installable software package to create and operate Kubernetes, plus automation tools for cluster lifecycle support. I'm so interested to explore the possibilities of EKS Anywhere at the customer's on-premise environments on modernization of legacy workloads. Let me know your thoughts in the comments below.
I'm Siva - working as Sr. Software Architect at <a target="_blank" href="https://www.ceiamerica.com">Computer Enterprises Inc</a> from Orlando. I'm an AWS Community builder, Auth0 Ambassador and I am going to write a lot about Cloud, Containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me <a target="_blank" href="https://www.twitter.com/ksivamuthu">@ksivamuthu</a> Twitter or check out my blogs at https://blog.sivamuthukumar.com

What is EKS Anywhere?
What does EKS Anywhere solve?
Announcement
First Look 👀
Installing EKS Anywhere (Local)
Manage on-premise EKS Anywhere Cluster from AWS EKS Console
Setup GitOps in EKS Anywhere Cluster


Conclusion

What is EKS Anywhere?
Amazon...

EKS Anywhere - Running EKS Cluster on your own infrastructure

Hello 👋 , In <a target="_blank" href="https://blog.sivamuthukumar.com/cloud-run-flask-app">part 1</a> of the <a target="_blank" href="https://blog.sivamuthukumar.com/series/google-cloud-run">Google Cloud Run series</a>, we learned what Google Cloud Run is, how to deploy the source code or container to the Google Cloud Run, and set up the continuous deployment to deploy the application to Cloud Run using a few clicks set up in the portal. In this part 2 of the series, let's see the options available to add persistent storage to the Cloud Run applications. At the end of this blog post, you will learn to add persistent storage into the python flask application.
<h2 id="google-cloud-storage">Google Cloud Storage</h2>
Google provides various storage options that address various needs of your applications. This post will explain the three storage options to integrate into your application running in Google Cloud Run
<ol>
<li>Cloud SQL - Storing Structured Data</li>
<li>Cloud Firestore - Storing Unstructured Data</li>
<li>Cloud Storage - Storing files such as images and video</li>
</ol>
<h2 id="cloud-sql-storing-structured-data">Cloud SQL - Storing Structured Data</h2>
Cloud SQL is a fully managed database service that helps you set up, maintain, manage, and administer your relational databases in the cloud. You can configure MySQL, PostgreSQL, SQL Server - RDS in the Cloud SQL. In this, we will create a MySQL instance that can be accessed from the Private IP address. And connect the Cloud SQL instance in the Google Cloud Run.
<pre><code class="lang-bash">gcloud sql instances create cloud-sql-demo \
--database-version=MYSQL_8_0 \
--cpu=NUMBER_CPUS \
--memory=MEMORY_SIZE \
--region=REGION
--network # Private IP Address
</code></pre>
Once the Cloud SQL is provisioned, you can add the connections to Cloud Run services and configure the VPC Access connector in the Portal or using <code>gcloud</code> cli
<pre><code class="lang-bash">gcloud compute networks vpc-access connectors create CONNECTOR_NAME \
--network VPC_NETWORK \
--region REGION \
--range IP_RANGE

gcloud run services update SERVICE --vpc-connector CONNECTOR_NAME
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1630811595793/pOfy4gbfQ.png" alt="image.png" />
Please refer to <a target="_blank" href="https://cloud.google.com/sql/docs/mysql/connect-run">Connecting to Cloud SQL from Cloud Run (fully managed)</a> for detailed documentation on how to set up managed Cloud SQL connection with Cloud Run.
Connect the CloudSQL Database providers using <code>sqlalchemy</code> library by configuring the database host, port, database and credentials.
<pre><code class="lang-python">def init_tcp_connection_engine(db_config):
 db_user = os.environ["DB_USER"]
 db_pass = os.environ["DB_PASS"]
 db_name = os.environ["DB_NAME"]
 db_host = os.environ["DB_HOST"]

 # Extract host and port from db_host
 host_args = db_host.split(":")
 db_hostname, db_port = host_args[0], int(host_args[1])

 pool = sqlalchemy.create_engine(
 sqlalchemy.engine.url.URL.create(
 drivername="mysql+pymysql",
 username=db_user, 
 password=db_pass, 
 host=db_hostname, 
 port=db_port,
 database=db_name, 
 ),
 **db_config
 )
 return pool
</code></pre>
Let's create order data and store the order table.
<pre><code class="lang-python">@app.route("/order", methods=["POST"])
def create_order():
 data = request.get_json()
 item = data['item']
 requested_at = datetime.datetime.utcnow()

 stmt = sqlalchemy.text(
 "INSERT INTO orders (item, requested_at)" " VALUES (:item, :requested_at)"
 )
 try:
 with db.connect() as conn:
 conn.execute(stmt, item=item, requested_at=requested_at)
 except Exception as e:
 logger.exception(e)
 return Response(
 status=500,
 response=jsonify({ error: "Unable to successfully cast vote! Please check the "
 "application logs for more details." }),
 )

 return Response(
 status=200,
 response=jsonify({ 'msg' : 'Order Created Successfully'}),
 )
</code></pre>
Google recommends that you use Secret Manager to store sensitive information such as SQL credentials. After setting up the secrets in the Secret Manager, you can update the env variables to update the secrets in Cloud Run.
<pre><code class="lang-bash">gcloud run services update SERVICE_NAME \
--add-cloudsql-instances=CLOUD_SQL_CONNECTION_NAME
--update-env-vars=CLOUD_SQL_CONNECTION_NAME=CLOUD_SQL_CONNECTION_NAME_SECRET \
--update-secrets=DB_USER=DB_USER_SECRET:latest \
--update-secrets=DB_PASS=DB_PASS_SECRET:latest \
--update-secrets=DB_NAME=DB_NAME_SECRET:latest
</code></pre>
<h2 id="cloud-firestore-storing-unstructured-data">Cloud Firestore - Storing Unstructured Data</h2>
<a target="_blank" href="https://firebase.google.com/docs/firestore">Cloud Firestore</a> is a flexible, scalable, NoSQL database for mobile, web, and server development from Firebase and Google Cloud. Following Cloud Firestore's NoSQL data model, you store data in documents that contain fields mapping to values. These documents are stored in collections, which are containers for your documents that you can use to organize your data and build queries. You can refer to this <a target="_blank" href="https://firebase.google.com/docs/firestore/quickstart">quick start</a> to set up the Cloud Firestore.
Create a Cloud FireStore Client by initializing the app using <code>firebase_admin</code> package.
<pre><code class="lang-python">import firebase_admin
from firebase_admin import credentials
from firebase_admin import firestore

cred = credentials.ApplicationDefault()
firebase_admin.initialize_app(cred, {
 'projectId': project_id,
})

db = firestore.client()
</code></pre>
 Add the new order to the <code>orders</code> collection to store.
<pre><code class="lang-python">@app.route("/order", methods=["POST"])
def create_order():
 data = request.get_json()
 item = data['item']
 requested_at = datetime.datetime.utcnow()

 db_col = db.collection(u'orders');
 db_col.add({
 u'item': item,
 u'requested_at': requested_at
 })

 return Response(
 status=200,
 response=jsonify({ 'msg' : 'Order Created Successfully'}),
 )
</code></pre>
<h2 id="cloud-storage-storing-files-such-as-image-and-video">Cloud Storage - Storing files such as image and video</h2>
You can use <a target="_blank" href="https://cloud.google.com/storage/docs">Google Cloud Storage</a> to store the files such as images, videos, and other static content. We are using the Google Cloud Client Library to store files in Google Cloud Storage. The file content of the request is saved into the Cloud Storage blob and writes to the Cloud Storage bucket. Once the file is uploaded to Cloud Storage, the pubic URL to this file is returned, which you can serve to the file directly from Cloud Storage. You can store this URL in your data storage too.
<pre><code class="lang-python">import logging
import os

from flask import Flask, request
from google.cloud import storage

CLOUD_STORAGE_BUCKET = os.environ["cloud_storage_bucket"]

@app.route('/upload', methods=['POST'])
def upload():
 """Process the uploaded file and upload it to Google Cloud Storage."""
 uploaded_file = request.files.get('file')

 if not uploaded_file:
 return 'No file uploaded.', 400

 gcs = storage.Client()

 # Get the bucket that the file will be uploaded to.
 bucket = gcs.get_bucket(CLOUD_STORAGE_BUCKET)

 # Create a new blob and upload the file's content.
 blob = bucket.blob(uploaded_file.filename)

 blob.upload_from_string(
 uploaded_file.read(),
 content_type=uploaded_file.content_type
 )
 return blob.public_url
</code></pre>
<h2 id="next">Next...</h2>
In <a target="_blank" href="https://blog.sivamuthukumar.com/google-cloud-run-add-persistent-storage">this second part</a> of the series, we explored the options to add Persistent Storage in Google Cloud Run. In the next part of the series, we will explore more on how to orchestrate a Workflow using Cloud Run &amp; Cloud Functions, and in the final part of the series, we will see how to add Cloud Endpoints to the Cloud Run applications and build developer API portal.
I'm Siva - working as Sr. Software Architect at <a target="_blank" href="https://www.ceiamerica.com">Computer Enterprises Inc</a> from Orlando. I am going to write technical blogs on Cloud, Containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me <a target="_blank" href="https://www.twitter.com/ksivamuthu">@ksivamuthu</a> Twitter or check out my blogs at <a target="_blank" href="https://blog.sivamuthukumar.com">https://blog.sivamuthukumar.com</a> Please drop a comment below or reach me out if you've any questions or comments.

Hello 👋 , In  part 1 of the  Google Cloud Run series, we learned what Google Cloud Run is, how to deploy the source code or container to the Google Cloud Run, and set up the continuous deployment to deploy the application to Cloud Run using a few cl...

Google Cloud Run - Add Persistent Storage

Hello all, Let's see how to enable AWS Load Balancer Controller on EKS Cluster to integrate the AWS Application / Network Load Balancers. This is a guide to provision the use cases & solutions of the AWS Load Balancer integration with Kubernetes Clus...

AWS Load Balancer Controller on EKS Cluster

In this blog post, let's see what are the options to manage the Auth0 platform using Infrastructure as a code tool. I've presented this topic at Auth0 Avacado Labs Youtube channel and the demo was built around it. I will walk you through all the options to manage your Auth0 configurations and set up continuous deployment on them.
<h2 id="what-is-infrastructure-as-code">What is Infrastructure as Code?</h2>
Infrastructure as Code (IaC) is the management of infrastructure in a descriptive model, using the same versioning as DevOps team uses for source code. Microsoft
<ul>
<li>Write the infrastructure spec in descriptive code.</li>
<li>Integrate into Source Control </li>
<li>Share across &amp; Deploy different environments</li>
<li>Manage and Provision infrastructure in Cloud / On-premise.</li>
</ul>
<h2 id="how-infrastructure-as-code-works">How Infrastructure as Code works?</h2>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1630554234983/cqi69GBpY.png" alt="image.png" />
<ul>
<li>Developers write code</li>
<li>Version Control</li>
<li>Test / Audit the code and infrastructure</li>
<li>Automation &amp; API pulls the code and deploys</li>
<li>Provision and Manage Cloud / On-Premise infrastructure</li>
</ul>
<h2 id="benefits-of-iac">Benefits of IaC</h2>
<ul>
<li>Faster time to production and market</li>
<li>Improved Consistency</li>
<li>Less configuration drift</li>
<li>Reusable code</li>
<li>Faster and more efficient development</li>
<li>Lower cost and more time on developing innovations.</li>
</ul>
<h2 id="auth0-identity-infrastructure-as-code">Auth0 - Identity Infrastructure as Code</h2>
<blockquote>
Identity, Authentication, Authorization &amp; Extensibility.
</blockquote>
Auth0 is an easy-to-implement, adaptable authentication and authorization platform. 
<a target="_blank" href="https://auth0.com">https://auth0.com</a>
<h2 id="auth0-dashboard-and-management-api">Auth0 Dashboard &amp; Management API</h2>
You can create the Auth0 resources in the dashboard. As we are talking about the infrastructure as code, the management API can be used to manage the tenant, applications, APIs, extensions, and more.
Anything the Auth0 dashboard can do, the management API can do as well.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1630554278066/uU6jRzRy8.png" alt="image.png" />
<h2 id="infrastructure-as-code-tools-to-setup-auth0">Infrastructure as Code Tools to setup Auth0</h2>
<h3 id="1-auth0-deploy-cli">1. Auth0 - Deploy CLI</h3>
Auth0 supports continuous integration and deployment (CI/CD) of Auth0 Tenants through source control extensions and integration into existing CI/CD pipelines by using this auth0-deploy-cli tool.
The auth0-deploy-cli tool supports the importing and exporting of Auth0 Tenant configuration data. The auth0-deploy-cli tool leverages the Auth0 Management API passing through objects for creates, updates and deletions.
Reference:
<ul>
<li>https://auth0.com/docs/extensions/github-deployments</li>
<li>https://github.com/auth0/auth0-deploy-cli</li>
</ul>
<h3 id="2-auth0-terraform">2. Auth0 - Terraform</h3>
The Auth0 provider is used to interact with Auth0 applications and APIs. It provides resources that allow you to create and manage clients, resource servers, client grants, connections, email providers and templates, rules and rule variables, users, roles, tenants, and custom domains as part of a Terraform deployment.
Reference:
<ul>
<li>https://registry.terraform.io/providers/alexkappa/auth0/latest/docs</li>
</ul>
<h3 id="3-auth0-pulumi">3. Auth0 - Pulumi</h3>
The Auth0 provider for Pulumi can be used to provision any of the cloud resources available in Auth0. The Auth0 provider must be configured with credentials to deploy and update resources in Auth0. You can write the infrastructure as code in any language such as Javascript, Typescript, C#, Go, Python and more.
Reference:
<ul>
<li>https://www.pulumi.com/docs/intro/cloud-providers/auth0/</li>
<li>https://www.pulumi.com</li>
</ul>
<h2 id="github-actions-environment-and-reviewing-deployments">Github Actions (Environment &amp; Reviewing Deployments)</h2>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1630554311389/gGAr_bIl4.png" alt="image.png" />
<a target="_blank" href="./docs/actions.png"></a>
<h2 id="demo">Demo</h2>
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/auth0-identity-infrastructure-as-code">https://github.com/ksivamuthu/auth0-identity-infrastructure-as-code</a></div>
<h2 id="video">Video</h2>
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.youtube.com/watch?v=QvZfjee18BM">https://www.youtube.com/watch?v=QvZfjee18BM</a></div>
I am going to write a lot about cloud, containers, IoT, and Devops. I'm Auth0 Ambassador, AWS Community Builder, and involved in tech communities by speaking at meetups, open-source contributions, and mentoring. If you are interested, please make sure to follow me if you haven’t already. Follow me <a target="_blank" href="https://www.twitter.com/ksivamuthu">@ksivamuthu</a> Twitter or check out my blogs at blogs.sivamuthukumar.com

In this blog post, let's see what are the options to manage the Auth0 platform using Infrastructure as a code tool. I've presented this topic at Auth0 Avacado Labs Youtube channel and the demo was built around it. I will walk you through all the opti...

Auth0 - Identity Infrastructure as Code

Hello 👋 , In this blog post series, I'm going to walk you through the <a target="_blank" href="https://cloud.google.com/run">Google Cloud Run</a> to develop and deploy highly scalable containerized applications on a fully managed serverless platform. Let's see how Google Cloud Run makes app development simpler and faster. So, you can write your application in your favorite language or containerized apps with your favorite tools and deploy them in seconds. Cloud Run abstracts all infrastructure management by automatically scaling up and down to zero and costs you for the time only when the app is running. Let's dive deep into it. 
Let's take a look at how to deploy a Flask app on Cloud Run, Set up continuous deployment of Flask App on Cloud from Github, protect, Add authentication to the app running on a Cloud Run using Google Cloud Endpoints and other advanced features.
In this first part of the series, we are going to see, 
<ol>
<li>Create a Flask App</li>
<li>Deploy a Flask App on Cloud Run</li>
<li>Set up a Continuous Deployment to Deploy.</li>
</ol>
<h2 id="create-a-flask-app">Create a Flask App</h2>
In this step, we are going to create a flask app and run it locally. Let's create a minimal flask application that looks something like this,
<pre><code class="lang-python">## index.py
import os

from flask import Flask, jsonify, request

app = Flask(__name__)

@app.route("/")
def index():
 return jsonify({ 'status' : 'running'})

@app.route("/order", methods=["POST"])
def create_order():
 data = request.get_json()
 print('Request Data: ' + str(data))
 return jsonify({ 'msg' : 'Order Created Successfully'})

if __name__ == "__main__":
 app.run(debug=True, host="0.0.0.0", port=int(os.environ.get("PORT", 5000)))
</code></pre>
Run this flask app locally.
<pre><code class="lang-bash">export FLASK_APP=index
flask run
</code></pre>
You can hit the API using the curl or postman.
<pre><code class="lang-bash">➜ ~ curl --location --request GET 'http://127.0.0.1:5000/'
{"status":"running"}
</code></pre>
To test the service locally and to easily integrate with the cloud run, you can use <a target="_blank" href="https://cloud.google.com/code">Cloud Code</a> or Docker installed locally to run and test locally, including running locally with access to Google Cloud services.
<h2 id="deploy-a-flask-app-in-cloud-run">Deploy a Flask app in Cloud Run</h2>
You can deploy the app using two ways. 1. Create a docker container 2. Directly from the source. When you deploy the gcloud project from the source, the gcloud tool identifies the application type and sets up the cloud build to build the container and deploy in google Cloud Run.
Deploy from source using the following command.
<pre><code class="lang-bash">gcloud run deploys order-service --source .
</code></pre>
If prompted,
<ol>
<li>Source Location</li>
<li>Region to Deploy</li>
<li>Enable the Artifactory Registry - press <code>y</code> to set up the artifactory registry.</li>
<li>You will be prompted to allow unauthenticated invocations - press <code>y</code> for now</li>
<li>In few minutes, the build will be done, and it will deploy the service and provide you the URL</li>
</ol>
<pre><code class="lang-bash">➜ /cloud-run-flask-demo ➜ gcloud run deploy order-service --source .
This command is equivalent to running "gcloud builds submit --pack image=[IMAGE] ." and "gcloud run deploy order-service --image [IMAGE]"

Building using Buildpacks and deploying the container to Cloud Run service [order-service] in project [*******] region [us-east1]
✓ Building and deploying... Done.
 ✓ Uploading sources...
 ✓ Building Container... Logs are available at [https://console.cloud.google.com/cloud-build/builds/...].
 ✓ Creating Revision...
 ✓ Routing traffic...
Done.
Service [order-service] revision [order-service-00002-rab] has been deployed and is serving 100 percent of traffic.
Service URL: https://order-service-......ue.a.run.app
</code></pre>
What's going on here... The application does not have Dockerfile. Buildpacks automatically determines that this is a Python application. It know how to run the python application and how to start the python server from Procfile. Buildpacks build a docker container image for your application, so we don't need to worry about managing the base image - as it's all managed by Google and tooling to build the container image locally or how to containerize your app.
Now you can run the curl command in your service .run.app URL to check whether it's working.
<pre><code class="lang-bash">➜ cloud-run-flask-demo curl --location --request GET 'https://order-service-******-ue.a.run.app'
{"status":"running"}
</code></pre>
<h2 id="set-up-a-continuous-deployment-to-deploy">Set up a Continuous Deployment to Deploy.</h2>
Deploying from source code is great !! Now it's time to set up a continuous deployment to deploy whenever the code is pushed. By connecting your GitHub repositories to Cloud Run, you can configure builds and deploy your repositories without writing Dockerfiles or build files. To configure automated builds, while deploying a new Cloud Run service, choose “Continuously deploy new revisions from a source repository”, connect your repo.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1630205333503/G02ozps_C.png" alt="image.png" />
Once you configured your repo, Fill the options in Build Configuration step. 
<ul>
<li>Branch - indicates what source should be used when running the trigger. You can put the <a target="_blank" href="https://github.com/google/re2/wiki/Syntax">regex</a> here. Matched branches are automatically verified.</li>
<li>Build Type<ul>
<li>If your repository should be built using Docker and it contains a Dockerfile, select Dockerfile. Source location indicates the location and name of the Dockerfile. This directory will be used as the Docker build context. All paths should be relative to the current directory.</li>
<li>Otherwise, select Google Cloud Buildpacks. Use Buildpack context to specify the directory and Entrypoint (optional) to provide the command to start the server.</li>
</ul>
</li>
</ul>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1630205344602/7sHOaNf7_.png" alt="image.png" />
Once you set up the continuous build, the push to the branch you configure will trigger the new version to deploy in the Cloud Run.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1630205363532/gbao6bg0h.png" alt="image.png" />
<h2 id="whats-next">What's Next?</h2>
In this first part of the series, we see how to set up the Cloud Run from the source and how buildpack automatically converts your application code into a container image that you can then deploy to Cloud Run. And also, we see how to set up the continuous deployment from your source code in github to trigger the Cloud Build on push and run the deployment automatically. Source Code to Production in seconds !!
In the upcoming posts in this series, we will see how to test and debug locally, how to integrate with other Google services such as storage, authentication, and more.
I am going to write a lot about cloud, containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me <a target="_blank" href="https://www.twitter.com/ksivamuthu">@ksivamuthu</a> Twitter or check out my blogs at https://blogs.sivamuthukumar.com

Hello 👋 , In this blog post series, I'm going to walk you through the  Google Cloud Run  to develop and deploy highly scalable containerized applications on a fully managed serverless platform. Let's see how Google Cloud Run makes app development si...

Google Cloud Run - Build and Deploy a Flask App

Hello 👋 , In this blog post, we are going to see how to send SMS using Azure Communication Service using Azure NodeJS SDKs. 
<h2 id="azure-communication-service">Azure Communication Service</h2>
Azure Communication Services are cloud-based services with REST APIs and client library SDKs available to help you integrate communication into your applications. You can add communication features to your applications without much expertise in media tools.
Azure Communication Services supports various communication formats:
<ol>
<li>Voice and Video Calling</li>
<li>Rich Text Chat</li>
<li>SMS</li>
</ol>
<h2 id="scenario">Scenario</h2>
I've explored the Azure Communication Service as an alternative to Twilio to send SMS. I've used Azure Communication SMS to send alerts to the user when the IoT Hub telemetry data is in the alert. The requirements are simple: 
<ol>
<li>Get a phone number.</li>
<li>Call an API or using SDK to send SMS when the IoT alert is triggered.</li>
<li>Get the SMS Delivery Event to audit or process.</li>
</ol>
<h2 id="prerequisites">Prerequisites</h2>
<ul>
<li>Create or use an existing Azure Account. To get a phone number, you've to use Paid Account. The free trial or MSDN accounts cannot get the phone numbers for SMS/Telephony services.</li>
<li><a target="_blank" href="https://docs.microsoft.com/en-us/azure/communication-services/quickstarts/create-communication-resource?tabs=windows&amp;pivots=platform-azp">Create an Azure Communication Service</a></li>
</ul>
<h2 id="get-a-phone-number">Get a Phone number</h2>
A phone number is assigned to your Communication Services resource. Phone numbers can be acquired and assigned to a Communication Services resource from the Azure Portal. Instructions on how to get a phone number using the Azure Portal can be found <a target="_blank" href="https://docs.microsoft.com/en-us/azure/communication-services/quickstarts/telephony-sms/get-phone-number?pivots=platform-azp">here</a>.
You can select a phone number type - Local or Toll-Free number and the capabilities include inbound / outbound with a call or SMS&gt;
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629861049952/Kyr1sErmj.png" alt="1.png" />
<h2 id="using-azure-nodejs-sdk-to-send-sms-number">Using Azure Node.js SDK to send SMS number</h2>
In a node.js project, install the @azure/communications-sms package. SmsClient is the primary interface for developers using this client library. It provides an asynchronous method to send SMS messages.
<pre><code class="lang-bash">npm install @azure/communication-sms
</code></pre>
<h3 id="authentication">Authentication</h3>
You can directly use the connection string or using Azure Active Directory managed identity to authenticate the communication services when using it from the Azure services. 
<pre><code class="lang-jsx">import { SmsClient } from "@azure/communication-sms";

const connectionString = `endpoint=https://&lt;resource-name&gt;.communication.azure.com/;accessKey=&lt;Base64-Encoded-Key&gt;`;
const client = new SmsClient(connectionString);
</code></pre>
<pre><code class="lang-jsx">import { DefaultAzureCredential } from "@azure/identity";
import { SmsClient } from "@azure/communication-sms";

const endpoint = "https://&lt;resource-name&gt;.communication.azure.com";
const credential = new DefaultAzureCredential();
const client = new SmsClient(endpoint, credential);
</code></pre>
<h3 id="sending-an-sms-message">Sending an SMS Message</h3>
To send an SMS message, call the send function from the SmsClient. You need to pass in a SmsSendRequest object. You may also pass an options object to specify whether the delivery report should be enabled and set custom tags for the report. An array of SmsSendResult is returned. A successful flag is used to validate if each individual message was sent successfully.
<pre><code class="lang-jsx">const sendResults = await client.send(
 {
 from: fromPhoneNumber, 
 to: ["&lt;to-phone-number-1&gt;", "&lt;to-phone-number-2&gt;"],
 message: "Site #1 - Alert - Temperature is High!"
 },
 {
 enableDeliveryReport: true,
 tag: "alert"
 }
);

for (const sendResult of sendResults) {
 if (sendResult.successful) {
 console.log("Success: ", sendResult);
 } else {
 console.error("Something went wrong when trying to send this message: ", sendResult);
 }
}
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629861136760/1fCeV3VRI.png" alt="image.png" />
<h2 id="handling-sms-events-for-delivery-report-or-inbound-message">Handling SMS Events for Delivery Report (or Inbound Message)</h2>
In the portal, select Events from the left menu of the Communication Services resource page. You can subscribe to specific events to tell Event Grid which of the SMS events you want to track, and where to send the events. 
Select the events you'd like to subscribe to from the dropdown menu. For SMS you'll have the option to choose SMS Received and SMS Delivery Report Received. I'm choosing SMS Delivery Report Events here to send it to ServiceBus Topic to process the delivery report and store the logs for audit.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629861174636/zCzgZLZIX.png" alt="image.png" />
<ul>
<li><code>SMS Received</code> events are generated when the Communication Services phone number receives a text message. To trigger an event, just send a message from your phone to the phone number attached to your Communication Services resource.</li>
<li><code>SMS Delivery Report Received</code> events are generated when you send an SMS to a user using a Communication Services phone number. To trigger an event, you are required to enable <code>Delivery Report</code> in the options.
<pre><code class="lang-jsx"> const sendResults = await client.send(
 {
 from: fromPhoneNumber, 
 to: ["&lt;to-phone-number-1&gt;", "&lt;to-phone-number-2&gt;"],
 message: "Site #1 - Alert - Temperature is High!"
 },
 {
 enableDeliveryReport: true,
 tag: "alert"
 }
 );
</code></pre>
</li>
</ul>
You can find the source code of the repo here.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/azure-communication-sms">https://github.com/ksivamuthu/azure-communication-sms</a></div>
<h2 id="conclusion">Conclusion</h2>
Azure Communication Services is great for SMS integration for your applications - alert messages, schedule reminders, customer service scenarios, and other real communication needs. And also, the service supports Bulk messaging, Two-way conversations, Reliable Delivery, Analytics, and a Simple setup experience for adding SMS capability to your application.
I am going to write a lot about cloud, containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me @ksivamuthu or check out my blogs at blog.sivamuthukumar.com.

Hello 👋 , In this blog post, we are going to see how to send SMS using Azure Communication Service using Azure NodeJS SDKs. 
Azure Communication Service
Azure Communication Services are cloud-based services with REST APIs and client library SDKs ava...

Send SMS messages with Azure Communication Services

<h1 id="azure-stream-analytics-alerts-on-iot-telemetry">Azure Stream Analytics - Alerts on IoT telemetry</h1>
<h2 id="overview">Overview</h2>
Hello 👋 , In this blog post, I'm going to walk through to create stream-processing logic using Azure Stream Analytics to gather data from the Internet of Things(IoT) devices. In detail, I will explain the alert handling queries in Azure Stream Analytics to trigger an alert when the threshold is reached, clear the alert when telemetry is out of the alert, and other alert handling scenarios. 
<h2 id="setting-up-azure-stream-analytics">Setting up Azure Stream Analytics</h2>
To set up Azure Stream Analytics, you need an Azure account. If you don't have one, create a free Azure account <a target="_blank" href="https://azure.microsoft.com/free/">here</a>.
You can set up Azure Stream Analytics from Azure Portal or CLI or other IaC (Infrastructure as Code) tools. I would recommend installing the <a target="_blank" href="https://marketplace.visualstudio.com/items?itemName=ms-bigdatatools.vscode-asa">Azure Stream Analytics Tool extension</a> in <a target="_blank" href="https://code.visualstudio.com/">Visual Studio Code</a> for development and testing purposes. Please follow this <a target="_blank" href="https://docs.microsoft.com/en-us/azure/stream-analytics/quick-create-visual-studio-code">documentation</a> to set up an Azure Stream Analytics Job. 
<h2 id="iot-telemetry-and-alert-handling-scenario">IoT Telemetry &amp; Alert Handling - Scenario</h2>
Now, let's talk about IoT Telemetry and the Alert handling scenarios. Consider the industrial automation company that has machinery in a plant that has sensors that are emitting streams of data in real-time. In this scenario, the plant manager wants to have real-time insights from the sensor data and take action on when the alert happens. You can configure the thresholds and detect whether the measurement values are over the threshold to identify alerts. In this blog, we will consider the sensor measurement values are - Temperature &amp; Humidity.
We are going to write an Azure Stream Analytics (ASA) query to identify alerts with the following requirements.
<ol>
<li>Identify the alert when the measurement values are over the threshold.</li>
<li>Send Alert event to EventHub or ServiceBus Topic to process. 
<ol>
<li>Design Goal: The alert has to be sent only when the measurement value crosses the threshold and not spam the user with email alerts.</li>
<li>For e.g, if the temperature is greater than the threshold of 80 and the below data, the alert should happen at the second record only and not on every record.
<pre><code class="lang-jsx">{ "time": "2021-08-20T20:47:53", "temp": "78",... "deviceId": "sensor-001" }
{ "time": "2021-08-20T20:47:54", "temp": "86",... "deviceId": "sensor-001" }
{ "time": "2021-08-20T20:47:55", "temp": "81",... "deviceId": "sensor-001" }
</code></pre>
</li>
</ol>
</li>
<li>Send "Alert Cleared" event when the device is back to normal.
</li>
<li>Send "Escalated" event when the device is in alert for configured escalation duration.</li>
</ol>
Let's see what are the options available in ASA query patterns to implement the above requirements.
<h2 id="detecting-alerts-in-telemetry">Detecting Alerts in Telemetry</h2>
First, we will create a pass-through query that passes all input data to the output. In this, I've used limited data as sample JSON for clarity while developing. Please download the data from <a target="_blank" href="https://raw.githubusercontent.com/ksivamuthu/device-telemetry-asa-demo/main/Inputs/devicetelemetry.json">here</a> if you wish to use the same. 
<pre><code class="lang-sql">SELECT
 *
INTO
 [output]
FROM
 [deviceTelemetry]
</code></pre>
The test results will be
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629656121240/fvz8IWCeZ.png" alt="1.png" />
Now, let's apply the analytics to find the alert when the temperature is greater than 80. The output of the query has the hasAlert flag that denotes whether the telemetry is in alert or not. 
<ul>
<li>Please note, we can use reference input to apply the rules dynamically instead of hardcoding threshold values in stream analytics query. For brevity of this blog, please refer <a target="_blank" href="https://docs.microsoft.com/en-us/azure/stream-analytics/stream-analytics-threshold-based-rules#reference-data">here</a> on how to do reference inputs for query or I'll cover in another blog post.</li>
</ul>
<pre><code class="lang-sql">WITH ProcessedTelemetry as (
 SELECT
 deviceId, 
 System.timestamp() as time,
 AVG(temp) as temp,
 CASE WHEN AVG(temp) &gt; 80 THEN 1 ELSE 0 END as hasAlert
 FROM
 [deviceTelemetry] TIMESTAMP BY time
 GROUP BY 
 System.Timestamp(), deviceId -- Run immediately on every event or use any temporal window here
)

SELECT * FROM ProcessedTelemetry
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629656596763/Q6Lkcdpwn.png" alt="Untitled.png" />
Good !! Now we know what are the events has alert or not. We need to send an alert only when the telemetry is entered into the alert status. In the above table, it has to be the second row where the device gets into alert. Let's take a look what are the analytical functions in ASA Query to identify the previous event.
LAG - The LAG analytic operator allows one to look up a “previous” event in an event stream, within certain constraints. It is very useful for computing the rate of growth of a variable, detecting when a variable crosses a threshold, or when a condition starts or stops being true.
In the below query, we are using the LAG function with a day scope to find the previous event hasAlert field in the telemetry. If you execute the results, you can see both hasAlert and previousAlert fields. previousAlert tells what's the previous hasAlert field in the stream.
<pre><code class="lang-sql">WITH ProcessedTelemetry as (
 SELECT
 deviceId, 
 System.timestamp() as time,
 AVG(temp) as temp,
 CASE WHEN AVG(temp) &gt; 80 THEN 1 ELSE 0 END as hasAlert
 FROM
 [deviceTelemetry] TIMESTAMP BY time
 GROUP BY 
 System.Timestamp(), deviceId -- Run immediately on every event
),
TelemetryWithLastAlert as (
 SELECT
 deviceId, 
 time,
 temp,
 hasAlert,
 LAG(hasAlert) OVER (PARTITION BY deviceId LIMIT DURATION(day, 1)) as previousAlert
 FROM
 ProcessedTelemetry 
)

SELECT * FROM TelemetryWithLastAlert
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629657127630/T8VXO1r2X.png" alt="Untitled (1).png" />
So to detect the event exactly when the device entered into the alert state is easy to query by comparing hasAlert and previousAlert state.
<pre><code class="lang-sql">WITH ProcessedTelemetry as (
 SELECT
 deviceId, 
 System.timestamp() as time,
 AVG(temp) as temp,
 CASE WHEN AVG(temp) &gt; 80 THEN 1 ELSE 0 END as hasAlert
 FROM
 [deviceTelemetry] TIMESTAMP BY time
 GROUP BY 
 System.Timestamp(), deviceId -- Run immediately on every event
),
TelemetryWithLastAlert as (
 SELECT
 deviceId, 
 time,
 temp,
 hasAlert,
 LAG(hasAlert) OVER (PARTITION BY deviceId LIMIT DURATION(day, 1)) as previousAlert
 FROM
 ProcessedTelemetry 
)

SELECT 
 deviceId, 
 time, 
 temp, 
 hasAlert 
INTO
 alertHub
FROM
 TelemetryWithLastAlert 
WHERE
 hasAlert = 1 AND (previousAlert IS NULL OR previousAlert = 0)
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629657185575/qsMWGEq2D.png" alt="image.png" />
So far, we've seen #1 and #2 of our requirements - Detecting the alert state in telemetry and trigger an event to hub or service bus topic only when the state got changed into alert from normal.
<h2 id="alert-cleared-events">Alert Cleared Events</h2>
As we've both the current alert state and previous alert state is available, we can do a similar query to identify when the device is back to its normal state.
<pre><code class="lang-sql">...
AlertEvents as (
 SELECT 
 deviceId, 
 time, 
 temp, 
 hasAlert,
 'alertRaised' as eventType
 FROM
 TelemetryWithLastAlert 
 WHERE
 hasAlert = 1 AND (previousAlert IS NULL OR previousAlert = 0)

 UNION

 SELECT 
 deviceId, 
 time, 
 temp, 
 hasAlert,
 'alertCleared' as eventType
 FROM
 TelemetryWithLastAlert 
 WHERE
 hasAlert = 0 AND previousAlert = 1
)

SELECT * INTO alertHub FROM AlertEvents
</code></pre>
The test results will be 
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629657235611/H5YdnjQ9S.png" alt="image.png" />
<h2 id="alert-escalated-events">Alert Escalated Events</h2>
To implement a final item in the requirements, the final item is - to escalate the alert after the threshold interval. Here, we are using LAST analytics query to find the time where the alert started and finding the duration of the alert - so we can escalate event when the device is alert state more than configured threshold. You can extend the query - to find the last escalation duration to emit events only when the alert is escalated. I leave it here for your exercise to extend it further.
<ul>
<li>LAST
 The LAST analytic operator allows one to look up the most recent event in an event stream within defined constraints. It is useful in the scenarios like computing last known good value (e.g. not null), finding last time when event matched certain criteria, etc.
</li>
</ul>
<pre><code class="lang-sql">TelemetryWithDuration as (
 SELECT
 deviceId, 
 time,
 temp,
 hasAlert,
 previousAlert,
 DATEDIFF(second,LAST(time) OVER (PARTITION BY deviceId LIMIT DURATION(day, 1) WHEN hasAlert = 1 AND previousAlert = 0), time) as alertDuration
 FROM
 TelemetryWithLastAlert 
),
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629657276927/JurGXeBBK.png" alt="image.png" />
Please check out the repo here:
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/device-telemetry-asa-demo">https://github.com/ksivamuthu/device-telemetry-asa-demo</a></div>
Sample of complete query results:
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629658288411/jdzpmw3rlI.png" alt="image.png" />
<h2 id="conclusion">Conclusion</h2>
In conclusion, Azure Stream Analytics Query provides the ability to process complex events in real-time by real-time analytics. We can use the extensive analytics functions to achieve the result we want by doing real-time analytics in the IoT streaming data. In this blog post, we explored the alert handling scenarios - Detect Alerts, Alert Cleared and Alert Escalated events to be processed by event hub or service bus topics. 
I am going to write a lot about cloud, containers, IoT, and Devops. If you are interested in any of that, make sure to follow me if you haven’t already. Please follow me <a target="_blank" href="https://twitter.com/ksivamuthu">@ksivamuthu</a> or check out my blogs at https://blog.sivamuthukumar.com.

Azure Stream Analytics - Alerts on IoT telemetry
Overview
Hello 👋 , In this blog post, I'm going to walk through to create stream-processing logic using Azure Stream Analytics to gather data from the Internet of Things(IoT) devices.  In detail, I wi...

Azure Stream Analytics - Alerts on IoT telemetry

Hello everyone 👋 !! In this blog post, we will see how to implement Progressive Delivery with AWS AppMesh in EKS using Flagger. Before getting deep dive into the blog, let's see some of the concepts behind it. - Continuous Delivery, Continuous Deployment, Progressive Delivery.
<h2 id="concepts">Concepts</h2>
Continuous delivery — the capability of supplying artifacts such as binaries, container images, secrets, or runtime configurations in a safely automated, hands-off approach.
Continuous deployment — somewhat established, pulling said artifacts and launching them in a runtime environment such as Kubernetes, Amazon ECS, etc. At the time
of publication, certain good practices such as immutable artifacts and multi-staged caching have been shared and adopted widely.
<h2 id="progressive-delivery">Progressive Delivery</h2>
Progressive delivery is modern software development for gradually rolling out new features to limit the potential negative impact and measure the metrics with newly deployed features. Progressive delivery builds on the foundation of continuous delivery and expands the practice to include feature rollouts, canary, a/b testing, blue-green deployments. 
Progressive delivery makes your release process more resilient. It reduces the risk by doing incremental changes, and in each step, you are validating or doing manual approval to proceed to the next stage. Using this, you can deliver more frequently with confidence.
<h3 id="flagger">Flagger</h3>
<a target="_blank" href="https://github.com/fluxcd/flagger">Flagger</a> is a progressive delivery tool that automates the release process for applications running on Kubernetes. It reduces the risk of introducing a new software version in production by gradually shifting traffic to the new version while measuring metrics and running conformance tests.
Flagger implements several deployment strategies (Canary releases, A/B testing, Blue/Green mirroring) using a service mesh (App Mesh, Istio, Linkerd) or an ingress controller (Contour, Gloo, NGINX, Skipper, Traefik) for traffic routing. For release analysis, Flagger can query Prometheus, Datadog, New Relic, CloudWatch, or Graphite, and for alerting, it uses Slack, MS Teams, Discord, and Rocket. Flagger can be configured with Kubernetes custom resources and is compatible with any CI/CD solutions made for Kubernetes.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1629418802189/qTJICvvbK.png" alt="flagger.png" />
Image: Flagger
<h3 id="getting-started">Getting Started</h3>
This blog walks you through setting up Flagger and AWS AppMesh on EKS. You can create the kubernetes cluster using portal or eksctl. Here we will use the eksctl - command-line tool to create or manage the EKS cluster. 
<ul>
<li>Create an EKS Cluster
<pre><code class="lang-bash"> eksctl create cluster --name=eks-dev \
 --region=us-east-1 \
 --nodes 3 \
 --appmesh-access
</code></pre>
</li>
</ul>
This command will create an EKS cluster with an appmesh IAM policy attached.
<h3 id="installing-aws-appmesh">Installing AWS AppMesh</h3>
<ul>
<li>Add EKS helm repo
<pre><code class="lang-bash"> helm repo add eks https://aws.github.io/eks-charts
</code></pre>
</li>
<li>Install the AppMesh CRDs
<pre><code class="lang-bash"> kubectl apply -k [github.com/aws/eks-charts/stable/appmesh-controller//crds?ref=master](http://github.com/aws/eks-charts/stable/appmesh-controller//crds?ref=master)
</code></pre>
</li>
<li>Create a namespace called app-mesh
<pre><code class="lang-bash"> kubectl create ns appmesh-system
</code></pre>
</li>
<li>Install the AppMesh Controller
<pre><code class="lang-bash"> helm upgrade -i appmesh-controller eks/appmesh-controller \
 --wait --namespace appmesh-system
</code></pre>
</li>
<li>Install the Prometheus instance to collect the app mesh metrics to run the canary analysis.
<pre><code class="lang-bash"> helm upgrade -i appmesh-prometheus eks/appmesh-prometheus \
 --wait --namespace appmesh-system
</code></pre>
</li>
</ul>
<h3 id="installing-flagger">Installing Flagger</h3>
<ul>
<li>Add Flagger Helm repository
<pre><code class="lang-bash"> helm repo add flagger https://flagger.app
</code></pre>
</li>
<li>Install Flagger's Canary CRDs
<pre><code class="lang-bash"> kubectl apply -f https://raw.githubusercontent.com/fluxcd/flagger/main/artifacts/flagger/crd.yaml
</code></pre>
</li>
<li>Deploy flagger in the appmesh-system namespaces. Please set the meshProvider to appmesh and the metricsServer to your Prometheus address.
<pre><code class="lang-bash"> helm upgrade -i flagger flagger/flagger \
 --namespace=appmesh-system \
 --set crd.create=false \
 --set meshProvider=appmesh:v1beta2 \
 --set metricsServer=http://appmesh-prometheus:9090
</code></pre>
</li>
</ul>
<h3 id="lets-do-the-deployment">Let's do the deployment</h3>
Install the deployment of your pod, including horizontal pod scaler. Here, I'm using one of the popular samples - pod info. Note, we are not installing any appmesh specific kubernetes API objects here. Flagger will be creating the appmesh virtualrouter, virtualservice based on the canary file we will create.
<pre><code class="lang-bash">kubectl apply -k https://github.com/fluxcd/flagger//kustomize/podinfo?ref=main
</code></pre>
Deploy the loadtest pod to run the load tests on the podinfo deployment
<pre><code class="lang-bash">helm upgrade -i flagger-loadtester flagger/loadtester \
--namespace=test \
--set appmesh.enabled=true \
--set "appmesh.backends[0]=podinfo" \
--set "appmesh.backends[1]=podinfo-canary"
</code></pre>
<h3 id="setup-canary">Setup Canary</h3>
Create a canary definition of the deployment we created. In this yaml, we are creating canary api targeting specific deployment. In analysis configuration, we are instructing canary analysis to do every 1m interval - and increase step weight to 5 to 50 based on request thresholds scraped from metrics.
<pre><code class="lang-bash">apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
 name: podinfo
 namespace: test
spec:
 provider: appmesh:v1beta2
 targetRef:
 apiVersion: apps/v1
 kind: Deployment
 name: podinfo
 service:
 # container port
 port: 9898
 timeout: 15s
 match:
 - uri:
 prefix: /
 rewrite:
 uri: /
 # define the canary analysis timing and KPIs
 analysis:
 # schedule interval (default 60s)
 interval: 1m
 # max number of failed metric checks before rollback
 threshold: 5
 # max traffic percentage routed to canary
 # percentage (0-100)
 maxWeight: 50
 # canary increment step
 # percentage (0-100)
 stepWeight: 5
 # App Mesh Prometheus checks
 metrics:
 - name: request-success-rate
 # minimum req success rate (non 5xx responses)
 # percentage (0-100)
 thresholdRange:
 min: 99
 interval: 1m
 - name: request-duration
 # maximum req duration P99
 # milliseconds
 thresholdRange:
 max: 500
 interval: 30s
</code></pre>
<h3 id="validation-testing-on-progressing">Validation Testing on Progressing</h3>
And also, you can see webhooks configured to perform acceptance on pre rollout and load tests while canary traffic routing is performed.. This will run the load test on the canary deployment before progressing stages and call the pre rollout webhooks before routing traffic to the canary.
<pre><code class="lang-bash"> analysis:
 ....
 webhooks: #optional
 - name: acceptance-test
 type: pre-rollout
 url: http://flagger-loadtester.test/
 timeout: 30s
 metadata:
 type: bash
 cmd: "curl -sd 'test' http://podinfo-canary.test:9898/token | grep token"
 - name: load-test
 url: http://flagger-loadtester.test/
 timeout: 5s
 metadata:
 cmd: "hey -z 1m -q 10 -c 2 http://podinfo-canary.test:9898/"
</code></pre>
<h3 id="successful-deployments">Successful Deployments</h3>
Trigger the canary deployment by updating the image version. The canary deployment will be triggered by deployment pod specs, configmaps and secrets.
<pre><code class="lang-bash">kubectl -n test set image deployment/podinfo \
podinfod=stefanprodan/podinfo:3.1.1
</code></pre>
Flagger detects the container version change and perform the canary analysis.
<pre><code class="lang-bash">kubectl -n test describe canary/podinfo

Status:
 Canary Weight: 0
 Failed Checks: 0
 Phase: Succeeded
Events:
 New revision detected! Scaling up podinfo.test
 Waiting for podinfo.test rollout to finish: 0 of 1 updated replicas are available
 Pre-rollout check acceptance-test passed
 Advance podinfo.test canary weight 5
 Advance podinfo.test canary weight 10
 Advance podinfo.test canary weight 15
 Advance podinfo.test canary weight 20
 Advance podinfo.test canary weight 25
 Advance podinfo.test canary weight 30
 Advance podinfo.test canary weight 35
 Advance podinfo.test canary weight 40
 Advance podinfo.test canary weight 45
 Advance podinfo.test canary weight 50
 Copying podinfo.test template spec to podinfo-primary.test
 Waiting for podinfo-primary.test rollout to finish: 1 of 2 updated replicas are available
 Routing all traffic to primary
 Promotion completed! Scaling down podinfo.test
</code></pre>
<h3 id="automated-rollback">Automated Rollback</h3>
When the number of failed checks reaches the canary analysis threshold, the traffic is routed back to the primary, the canary is scaled to zero, and the rollout is marked as failed.
<h2 id="conclusion">Conclusion</h2>
Progressive delivery unlocks rapid releases. Using flagger, it's more simple now to enable the automated canary deployments with your favorite service mesh you are using in your kubernetes cluster. It will give you full control over your feature rollout process. You can extend the progressive delivery process by extending the validation, manual approval, notifications to slack or MS teams, etc. We will take a look at extensible settings with approval and notifications in upcoming blog posts.

Hello everyone 👋  !! In this blog post, we will see how to implement Progressive Delivery with AWS AppMesh in EKS using Flagger. Before getting deep dive into the blog, let's see some of the concepts behind it. - Continuous Delivery, Continuous Depl...

Progressive Delivery with AWS AppMesh in EKS using Flagger

In this blog post, let's see how the IP Address prefix assignment functions enable EKS to support more pods per node. 
By default, the number of IP addresses available to assign to pods is based on the number of IP addresses assigned to Elastic network interfaces and the number of network interfaces attached to your Amazon EC2 node. The <a target="_blank" href="https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.9.0">Amazon VPC CNI add-on (v1.9.0 or later) </a> can be configured to assign /28 (16 IP addresses) IP address prefixes, instead of assigning individual IP addresses to network interfaces. 
The CNI v1.9.0 release will support higher pod density per node and also reduces the number of EC2 calls to create and attach more ENIs by leveraging the recent EC2 feature - <a target="_blank" href="https://aws.amazon.com/about-aws/whats-new/2021/07/amazon-virtual-private-cloud-vpc-customers-can-assign-ip-prefixes-ec2-instances/">Assigning prefixes to Amazon EC2 network interfaces</a>. A (/28) prefix will replace each secondary IP. IPAMD will derive a (/32) IP from these prefixes for pod IP allocation.
<h3 id="prerequisites">Prerequisites</h3>
<ol>
<li>New or Existing EKS Cluster. You can follow the guidelines documented <a target="_blank" href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html">here</a> to create an EKS cluster using the portal or eksctl.
</li>
<li>Amazon VPC CNI (v1.9.0 or later) add-on added to your cluster. To add or update the add-on on your cluster, see <a target="_blank" href="https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html">Managing the Amazon VPC CNI add-on</a>. If you want to update the version in the existing cluster, run the below command.
<pre><code class="lang-bash">eksctl update addon \
 --name vpc-cni \
 --version &lt;1.9.x-eksbuild.y&gt; \
 --cluster &lt;my-cluster&gt; \
 --force
</code></pre>
</li>
<li><a target="_blank" href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances">Amazon EC2 Nitro instances </a> for node groups in the cluster.</li>
</ol>
<h3 id="how-to-enable-the-feature">How to enable the feature?</h3>
To enable the IP prefix assignment feature, run the below command.
<pre><code class="lang-bash">kubectl set env daemonset aws-node \
 -n kube-system ENABLE_PREFIX_DELEGATION=true
</code></pre>
<h3 id="calculate-the-number-of-maximum-pods-per-node">Calculate the number of maximum pods per node.</h3>
Download the max pods per node calculator script and change the access mode.
<pre><code class="lang-bash">curl -o max-pods-calculator.sh https://raw.githubusercontent.com/awslabs/amazon-eks-ami/master/files/max-pods-calculator.sh
chmod +x max-pods-calculator.sh
</code></pre>
Calculate the max pods using the max pods calculator script. You can pass the instance type and CNI version to calculate the max pods per node.
<pre><code class="lang-bash">./max-pods-calculator.sh \
--instance-type &lt;m5.large&gt; \
--cni-version &lt;1.9.x-eksbuild.y&gt; \
--cni-prefix-delegation-enabled
</code></pre>
You can take a look at the max pods calculator script. Without enabling the prefix delegation feature or non-nitro instance types, the calculation of the pods are 
ENI * (# of IPv4 per ENI - 1) + 2. 
The calculation changed into ENI ((# of IPv4 per ENI - 1) 16) + 2 where 16 is IPS_PER_PREFIX. The pod density per node is significantly more than before.
<h3 id="create-node-groups-with-ec2-nitro-amazon-linux-2-instance-type">Create Node Groups with EC2 Nitro Amazon Linux 2 Instance Type</h3>
Create one of the following node groups with at least one Amazon EC2 Nitro Amazon Linux 2 instance type. See the list of <a target="_blank" href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances">Nitro Amazon Linux 2 Instance Types</a>.
<pre><code class="lang-bash">eksctl create nodegroup \
 --cluster &lt;my-cluster&gt; \
 --region &lt;us-east-1&gt; \
 --name &lt;my-nodegroup&gt; \
 --node-type &lt;m5.large&gt; \
 --managed \
 --max-pods-per-node &lt;110&gt; -- Count from the max pods calculator
</code></pre>
Once your nodes are deployed, you can run the <code>kubectl describe</code> command in the node to see the max pods in the allocatable.
<h2 id="conclusion">Conclusion</h2>
The advantages of using EKS are huge. When you move into complex and big architectures, EKS can end up consuming a lot of IPs. One of the most discussed EKS concerns is solved using the IP Address prefixes feature with VPC CNI version 1.9 or later. I'm looking forward to experimenting more on the EKS cluster to see how it behaves with cluster auto-scalers.

In this blog post, let's see how the IP Address prefix assignment functions enable EKS to support more pods per node. 
By default, the number of IP addresses available to assign to pods is based on the number of IP addresses assigned to Elastic netwo...

EKS VPC CNI Addon - Support for high pod density in node

<h2 id="introduction">Introduction</h2>
The Center for Internet Security provides many guidelines and benchmark tests for best practices in securing your code. The CIS has published a <a target="_blank" href="https://www.cisecurity.org/benchmark/kubernetes/">benchmark for Kubernetes</a>. The <a target="_blank" href="https://github.com/aquasecurity/kube-bench">kube-bench</a> is an open-source tool that checks whether Kubernetes is deployed securely by running the <a target="_blank" href="https://www.cisecurity.org/benchmark/kubernetes/">CIS benchmark for Kubernetes</a> checks. It's written as a Go application and also distributed as a container. Each test is defined in the YAML and also supports JSON-format output that can be used to evolve along wiht Kubernetes and to integrate with automaton tools.
<h2 id="managed-kubernetes-and-cis-amazon-eks-benchmark">Managed Kubernetes &amp; CIS Amazon EKS Benchmark</h2>
The CIS Kubernetes Benchmark is scoped for implementations managing both the control plane, which includes etcd, API server, controller, scheduler, and the data plane, which is made up of one or more nodes or EC2 instances.
The managed Kubernetes clusters provide a level of CIS hardening already in place, and it delegates some settings to the user. It works best when you want to understand whether your workloads and the worker nodes are appropriately set up to implement these guidelines. <a target="_blank" href="https://aws.amazon.com/blogs/containers/introducing-cis-amazon-eks-benchmark/">CIS Amazon EKS Benchmark v1.0.0</a> provides guidance for node security configurations for Kubernetes and aligns with CIS Kubernetes Benchmark.
<h2 id="running-kube-bench">Running kube-bench</h2>
We will deploy the Kubernetes Job using the below YAML file. We can install the kube-bench directly in the nodes as well. In this blog, we are going to run the kube-bench as a kubernetes job.
<pre><code class="lang-yaml"># eks-kube-bench-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
 name: kube-bench
spec:
 template:
 spec:
 hostPID: true
 containers:
 - name: kube-bench
 image: aquasec/kube-bench:latest
 command: ["kube-bench", "--benchmark", "eks-1.0"]
 volumeMounts:
 - name: var-lib-kubelet
 mountPath: /var/lib/kubelet
 readOnly: true
 - name: etc-systemd
 mountPath: /etc/systemd
 readOnly: true
 - name: etc-kubernetes
 mountPath: /etc/kubernetes
 readOnly: true
 restartPolicy: Never
 volumes:
 - name: var-lib-kubelet
 hostPath:
 path: "/var/lib/kubelet"
 - name: etc-systemd
 hostPath:
 path: "/etc/systemd"
 - name: etc-kubernetes
 hostPath:
 path: "/etc/kubernetes"
</code></pre>
Run the job in your EKS cluster
<pre><code class="lang-bash">kubectl apply -f eks-kube-bench-job.yaml
</code></pre>
Once the kube-bench job is completed, you can view the pod's logs to see the results of the kube-bench.
<pre><code class="lang-bash">[INFO] 3 Worker Node Security Configuration
[INFO] 3.1 Worker Node Configuration Files
[PASS] 3.1.1 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
[PASS] 3.1.2 Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
[PASS] 3.1.3 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
[PASS] 3.1.4 Ensure that the kubelet configuration file ownership is set to root:root (Scored)
[INFO] 3.2 Kubelet
[PASS] 3.2.1 Ensure that the --anonymous-auth argument is set to false (Scored)
[PASS] 3.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
[PASS] 3.2.3 Ensure that the --client-ca-file argument is set as appropriate (Scored)
[PASS] 3.2.4 Ensure that the --read-only-port argument is set to 0 (Scored)
[PASS] 3.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)
[PASS] 3.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Scored)
[PASS] 3.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Scored) 
[PASS] 3.2.8 Ensure that the --hostname-override argument is not set (Scored)
[WARN] 3.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Scored)
[PASS] 3.2.10 Ensure that the --rotate-certificates argument is not set to false (Scored)
[PASS] 3.2.11 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)

== Remediations ==
3.2.9 If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service


== Summary ==
14 checks PASS
0 checks FAIL
1 checks WARN
0 checks INFO
</code></pre>
Delete the job
Run the below commands to delete the kube-bench job.
<pre><code>kubectl delete -f job-eks.yaml
</code></pre><h2 id="integrating-kube-bench-with-aws-security-hub">Integrating kube-bench with AWS Security Hub</h2>
You can configure kube-bench with the --asff to send findings to AWS Security Hub. Before, that, we've to enable the AWS Security Hub integration and set the required IAM role and policies to forward the findings to the AWS Security Hub.
<h3 id="enable-the-aws-security-hub-integration">Enable the AWS Security Hub integration</h3>
You will need AWS Security Hub to be enabled in your account. In the Security Hub console, under Integrations, search for kube-bench. Click on Accept findings to enable the "Aqua Security kube bench" to integrate with AWS Security Hub.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1615888910692/u8CvF2DyZ.png" alt="kube-bench-security-hub.png" />
Now let's configure the kube-bench job to send the report to AWS Security Hub.
<h3 id="iam-policy-to-send-to-aws-security-hub">IAM Policy to send to AWS Security Hub</h3>
<pre><code>{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "securityhub:BatchImportFindings",
 "Resource": [
 "arn:aws:securityhub:us-east-1::product/aqua-security/kube-bench"
 ]
 }
 ]
}
</code></pre><h3 id="create-service-account-iam-role-and-policy">Create Service Account IAM Role and Policy</h3>
Please use <a target="_blank" href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html">this guide</a> creating the IAM role and policy to attach to the service account for the pod running the kube-bench job.
<h3 id="kube-bench-with-asff">kube-bench with asff</h3>
<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
 name: kube-bench
 # If using a dedicated IAM role for kube-bench, uncomment the annotations
 # block below and replace the ROLE_ARN
 # annotations:
 # eks.amazonaws.com/role-arn: "&lt;ROLE_ARN&gt;"

---
apiVersion: v1
kind: ConfigMap
metadata:
 name: kube-bench-eks-config
data:
 config.yaml: |
 AWS_ACCOUNT: "&lt;AWS_ACCT_NUMBER&gt;"
 AWS_REGION: "&lt;AWS_REGION&gt;"
 CLUSTER_ARN: "&lt;AWS_CLUSTER_ARN&gt;"

---
apiVersion: batch/v1
kind: Job
metadata:
 name: kube-bench
spec:
 template:
 spec:
 hostPID: true
 containers:
 - name: kube-bench
 image: aquasec/kube-bench:latest
 command: ["kube-bench", "node", "--benchmark", "eks-1.0", "--asff"]
 volumeMounts:
 - name: var-lib-kubelet
 mountPath: /var/lib/kubelet
 readOnly: true
 - name: etc-systemd
 mountPath: /etc/systemd
 readOnly: true
 - name: etc-kubernetes
 mountPath: /etc/kubernetes
 readOnly: true
 - name: kube-bench-eks-config
 mountPath: "/opt/kube-bench/cfg/eks-1.0/config.yaml"
 subPath: config.yaml
 readOnly: true
 restartPolicy: Never
 serviceAccountName: kube-bench
 volumes:
 - name: var-lib-kubelet
 hostPath:
 path: "/var/lib/kubelet"
 - name: etc-systemd
 hostPath:
 path: "/etc/systemd"
 - name: etc-kubernetes
 hostPath:
 path: "/etc/kubernetes"
 - name: kube-bench-eks-config
 configMap:
 name: kube-bench-eks-config
 items:
 - key: config.yaml
 path: config.yaml
</code></pre>Run the job using the above yaml to send the findings to AWS Security Hub. 
<h3 id="security-hub-findings">Security Hub Findings</h3>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1615889119501/PHxDWx38m.png" alt="asff-example-finding.png" />
<h2 id="conclusions">Conclusions</h2>
In this blog post, we had a walkthrough on running kube-bench tests against EKS worker nodes and forwarding the kube-bench summary to AWS Security Hub. You can use the CIS Amazon EKS Benchmark to assess Amazon EKS cluster nodes' security configuration accurately.

Introduction
The Center for Internet Security provides many guidelines and benchmark tests for best practices in securing your code. The CIS has published a benchmark for Kubernetes. The kube-bench is an open-source tool that checks whether Kubernete...

Amazon EKS Security Assessment - Kube Bench

Hello all, this post details my 2020 year in review. 
<h3 id="survived">🙏 Survived</h3>
I'm grateful for this life I have. 
Yes, It's one of the unique years. 
<ul>
<li>Meeting a lot of new people turned into never meet anyone other than my family in person. </li>
<li>Commuting to work for an hour every day turned into a couple of steps to my home office</li>
<li>Running to the meeting rooms turned into joining Zoom meetings.</li>
</ul>
It's crazy. At the same time, it's the new normal or new future of working remotely. I'm very glad that the industry I've worked in found a way to accommodate these new changes. How did I feel for the first three months in remote? It's a mixed feeling. I watched a lot of news, read the stories of how humanity survived with previous pandemics, and worried a lot. At the same time, I stopped worrying by hoping this pandemic will end soon by God's grace and the power of science.
On a positive note, I've spent a lot of time with my family. My expenses went low. I spent time learning new things, doing life hacks, and playtime with my kid. I see that gave the new perspective of the life ahead. Pretty sure the perspective of work and life got changed and made me grateful for what I've.
<h3 id="talks">🎙Talks</h3>
I'm a speaker at technical meetups and conferences. I've presented 17 talks this year. The last meetup I've attended in person in February 2020 at South Florida Developers Conference. All the other talks I've presented are online. The good news is I got the opportunity to speak at the amazing communities in India about Flutter, Kubernetes, GraphQL in Google Developer Groups, and Flutter Meetups.
Check out my talks here I've done on 2020 and the previous year's talks.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.sivamuthukumar.com/talks">https://www.sivamuthukumar.com/talks</a></div>
<h3 id="blog-posts">📚Blog Posts</h3>
I've started my blogging platform in Hashnode towards the end of the year. My blog articles are focused on AWS, Containers, Auth0, Google ML, and more. I've focused on writing more articles consistently. Hopefully, I will write more technical articles in the year 2021.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://blog.sivamuthukumar.com">https://blog.sivamuthukumar.com</a></div>
<h3 id="certifications">📖 Certifications</h3>
Technical Certifications will keep you updated. This year, I've done a lot of certifications with online proctoring.
<ul>
<li>Azure Devops Professional</li>
<li>Azure Security Specialty</li>
<li>Azure IoT Specialty</li>
<li>AWS ML Specialty</li>
<li>Boomi Professional and Architect Exams</li>
</ul>
Check my earned certification badges here.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.youracclaim.com/users/sivamuthukumar-kaliappan-arumugavel/badges">https://www.youracclaim.com/users/sivamuthukumar-kaliappan-arumugavel/badges</a></div>
<h3 id="open-source-contributions">🚚 Open source contributions</h3>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1609455873200/Jn38JMtJX_.png" alt="Screen Shot 2020-12-31 at 6.04.08 PM.png" />
I've contributed to Dapr and other open-source projects this year.
<h3 id="member-of-dapr-project">🚀Member of Dapr project</h3>
Dapr (Distributed Application Runtime) is a portable, event-driven runtime that makes it easy for developers to build resilient, microservice stateless, and stateful applications that run on the cloud. 
I've become a member of the Dapr project. I've contributed AWS and Azure components of Dapr.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/dapr/dapr">https://github.com/dapr/dapr</a></div>
<h3 id="auth0-ambassador">🧑‍🚀Auth0 Ambassador</h3>
I became Auth0 Ambassador in December 2020. I'm looking forward to a Developer Relations career and giving back to the community by sharing identity and security knowledge in meetups, videos, and conferences.
That's pretty much contributions this year. Hoping for a wonderful year ahead.

Hello all, this post details my 2020 year in review. 
🙏 Survived
I'm grateful for this life I have. 
Yes, It's one of the unique years. 

Meeting a lot of new people turned into never meet anyone other than my family in person. 
Commuting to work fo...

My 2020 Year in Review

<h2 id="building-event-driven-apps-with-dapr-in-kubernetes">Building Event-Driven Apps with Dapr in Kubernetes</h2>
In this article, I will summarize the tech talk I've done in various meetups on Building Event-Driven Apps with Dapr in Kubernetes
<h3 id="talk-abstract">Talk Abstract</h3>
In this talk, we will go through an overview of Dapr, how it enables distributed application development. Dapr brings proven patterns and practices to you. It unifies event-driven actors' semantics into a simple, consistent programming model, and Dapr supports all programming languages without framework lock-in. This talk goes more in-depth into these building blocks of distributed microservices such as state stores, messaging, resource bindings, etc., with demos and workflow of the deployment of services and runtime.
<h3 id="details">Details</h3>
This talk covers Dapr in the below points.
<h3 id="1-what-is-dapr">1. What is Dapr?</h3>
Dapr (Distributed Application Runtime) is a portable, event-driven runtime that makes it easy for developers to build resilient, microservice stateless, and stateful applications that run on the cloud. 
<h3 id="2-what-problem-does-dapr-solve">2. What problem does Dapr solve?</h3>
Microservices have different capabilities when it comes to a distributed system. Each capability is abstracted through a Dapr Building Blocks that defines a simple HTTP / gRPC API decoupled from the technology chosen to implement it through the use of pluggable components. 
This best practice of decoupling frees developers from the burden of integrating and having a deep understanding of the underlying technologies they use. The use of building blocks also allows swapping implementations when the application is deployed in different hosting environments or when needs change as the application evolves without affecting your code or without any vendor lock-in.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608779062829/sxaT5gXCC.png" alt="image.png" />
<h3 id="3-how-does-it-run-sidecar">3. How does it run? Sidecar?</h3>
Dapr can run as a sidecar as a process to standalone apps and as sidecar containers to the apps in kubernetes (using sidecar architecture).
Standalone app
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608779345065/KHR8f2J3o.png" alt="image.png" />
Kubernetes app
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608779376867/OC_cwC7a_.png" alt="image.png" />
<h3 id="4-dapr-in-kubernetes">4. Dapr in Kubernetes</h3>
Dapr can be configured to run on any Kubernetes cluster. In Kubernetes, the <code>dapr-sidecar-injector</code> and <code>dapr-operator</code> services provide first-class integration to launch Dapr as a sidecar container in your deployments.
The dapr-sidecar-injector also injects the environment variables DAPR_HTTP_PORT and DAPR_GRPC_PORT into all the containers in the pod to enable user-defined applications .to communicate with Dapr without hardcoding Dapr port values easily.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608779543555/yoTc0vAnc.png" alt="image.png" />
You've to add the below annotations in your deployment YAML to enable the dapr sidecar injection in your pod.
<pre><code> annotations:
 dapr.io/enabled: "true"
 dapr.io/app-id: "nodeapp"
 dapr.io/app-port: "3000"
</code></pre><h3 id="5-configuring-components">5. Configuring Components.</h3>
Dapr components can be configured using YAML. Each building block has the type and the metadata to configure the implementation.
You can add more components and switch the component's type at the higher / other environments.
E.g., The below-configured message bus component configured with Redis type can be changed later to Kafka without changing any application code.
Redis
<pre><code class="lang-yaml">apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: messagebus
spec:
 type: pubsub.redis
 metadata:
 - name: redisHost
 value: localhost:6379
 - name: redisPassword
 value: ""
</code></pre>
Kafka
<pre><code class="lang-yaml">apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: messagebus
spec:
 type: pubsub.kafka
 version: v1
 metadata:
 - name: brokers
 value: "kafka.default.svc.cluster.local:9092"
 - name: authRequired
 value: "false"
</code></pre>
<h3 id="6-food-delivery-app-dapr-demo">6. Food Delivery App - Dapr Demo</h3>
The demo runs three microservices in the kubernetes cluster. The demo explains how the order service, kitchen service, delivery service works together to process the food delivery system powered by Dapr.
<ol>
<li>Dapr Runtime - Sidecar Injection Annotations</li>
<li>State Store Demo - Redis</li>
<li>Pub-Sub Demo - Redis &amp; Kafka / NATS</li>
<li>Bindings Demo - Twillio SMS</li>
<li>Github Actions - Deploying Dapr Components and Microservices in AKS (Azure Kubernetes Service)</li>
</ol>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608780373269/IlA_vEBED.png" alt="image.png" />
<h3 id="7-open-source-contributions">7. Open Source Contributions</h3>
I'm one of the contributors and members of the Dapr team in Github. This talk also explains how to contribute to Dapr and the different repositories you can look for to make contributions. If you are new to Golang, that's fine. Everyone is more welcome to contribute. Look at the issues you can start contributing. Please reach me or anyone on the Dapr team for any help. 
<h3 id="source-code">Source Code</h3>
The source code of the demo is here. Slides are in the repo.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/cloud-dapr-demo">https://github.com/ksivamuthu/cloud-dapr-demo</a></div>
<h3 id="video-recordings">Video Recordings</h3>
Atlanta .NET User Group
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.youtube.com/watch?v=SBumJ9KT8Pk">https://www.youtube.com/watch?v=SBumJ9KT8Pk</a></div>
St.Pete .NET User Group
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.youtube.com/watch?v=5zuNhx1ye0s">https://www.youtube.com/watch?v=5zuNhx1ye0s</a></div>
Orlando .NET User Group
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.youtube.com/watch?v=jSFAdn1UmPI">https://www.youtube.com/watch?v=jSFAdn1UmPI</a></div>
The same talk is presented in various meetup groups - Columbus App Dev User Group, New Hampshire .NET User Group, and internal presentations. This talk is also scheduled for 2021 to talk in meetups and user groups.
Do you want me to talk at your meetups/conferences? Reach me out at my Twitter DM <a target="_blank" href="https://twitter.com/ksivamuthu">@ksivamuthu</a> or <a target="_blank" href="https://linkedin.com/in/ksivamuthu">Linkedin</a>. Happy to have a conversation with you all.
<blockquote>
Hello, I'm Siva. I'm speaking in meetups and tech conferences on technical topics - Kubernetes, Mobile - Flutter / Xamarin, and others. I decided to create the <a target="_blank" href="https://hashnode.com/series/tech-talks-and-demos-ckj29avqn03p025s1gv6o6932">Tech Talk Blog series</a> in my <a target="_blank" href="https://blog.sivamuthukumar.com">blog</a> summarizing the talk I've done with the abstract, the notes, or layout on how I structured the talk, the demo, and the video recordings if any. It would be beneficial for me to document. Also, I hope it's helpful for you to learn, review, and provide feedback on the technologies you love.
</blockquote>

Building Event-Driven Apps with Dapr in Kubernetes
In this article, I will summarize the tech talk I've done in various meetups on Building Event-Driven Apps with Dapr in Kubernetes
Talk Abstract
In this talk, we will go through an overview of Dapr, ...

Tech Talk: Building Event-Driven Apps with Dapr in Kubernetes

Hello 👋, Application Monitoring is critical for your business. It gives vital information on your customer experience. Monitoring your system and infrastructure is essential to ensure the performance of your services. As software development moves faster and faster, alerting and monitoring becomes an indispensable practice for modern DevOps teams.
The cloud applications' monitoring platform has to bring together data from servers, containers, databases, identity management, and third-party services to make the stack entirely observable.
In this post, we will see how we can stream Auth0 logs to Datadog to monitor, alert, and analyze Auth0 events.
<h3 id="prerequisites">Prerequisites</h3>
<ul>
<li><a target="_blank" href="https://auth0.com">Auth0 Account</a></li>
<li><a target="_blank" href="https://www.datadoghq.com">Datadog Account</a></li>
<li><a target="_blank" href="https://docs.datadoghq.com/account_management/api-app-keys/">Datadog - API Key</a></li>
</ul>
<h3 id="setup-auth0-log-streaming">Setup Auth0 Log Streaming</h3>
The first step is to setup log streaming from the Auth0 dashboard. 
<ol>
<li>Log in to the Auth0 Dashboard.
</li>
<li>Navigate to Logs &gt; Streams.
</li>
<li>Click "Create Stream."
</li>
<li>Select Datadog, and enter a unique name for your new Datadog Event Stream.
</li>
<li>On the next screen, provide the following settings for your Datadog Event Stream: API Key &amp; Region. Click Save.
</li>
</ol>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608418385273/C542r19kU.png" alt="Screen Shot 2020-12-19 at 5.44.34 PM.png" />
The setup is done. When Auth0 writes the next log event, the log events are streamed to Datadog.
<h3 id="monitor-auth0-activities">Monitor Auth0 Activities</h3>
As Auth0 streaming the logs to Datadog to ingest, it sends them through a log processing pipeline. The pipeline automatically parses each log to extract key data as standard attributes, which provide a naming convention you can use to correlate events from multiple sources easily.
Auth0 has a <a target="_blank" href="https://auth0.com/docs/logs/log-event-type-codes">set of event types with code and description</a>. Datadog automatically maps the Auth0 event type code to the event name. You can use this Event Name facet to analyze user activity such as account creation and deletion, password changes, and more.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608418484291/LbQxYmrV4.png" alt="Screen Shot 2020-12-19 at 5.51.42 PM.png" />
<h3 id="security-dashboard-visualization">Security Dashboard Visualization</h3>
If you want to visualize the Auth0 events using Datadog dashboards, Auth0 is providing the dashboard template to import in Datadog to visualize the metrics captured from the log stream.
The dashboard provides the recommended aggregations to view, and you can customize the visualization based on your needs.
Download the <a target="_blank" href="https://cdn.auth0.com/website/docs/logs/streams/datadog/Auth0SecurityDashboard.json?_ga=2.54375016.1952945764.1608340101-189280238.1605710959">dashboard template</a> here. Import the JSON file in the Datadog Dashboard section created using the Screen Board Dashboard type.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608419138036/BT1BAC5Za.png" alt="Screen Shot 2020-12-19 at 6.05.00 PM.png" />
<h3 id="alerts-and-threat-notification">Alerts and Threat Notification</h3>
Datadog's new Detection Rules give you a powerful way to detect security threats and suspicious behavior within all ingested logs in real-time. You can create the detection rules by defining conditional logic to the Auth0 log stream. If the rule is matched, Datadog evaluates the security and notify.
Datadog has pre-defined detection rules for Auth0 source.
<ul>
<li>Auth0 user authenticating from multiple countries - High</li>
<li>Auth0 user logged in with a breached password - Medium</li>
<li>Brute force attack on an Auth0 user - Medium</li>
<li>Credential stuffing attack on Auth0 - High</li>
</ul>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1608419863776/kaUJ7lgla.png" alt="Screen Shot 2020-12-19 at 6.17.05 PM.png" />
You can also create custom rules with conditions. Datadog analyzes Auth0 logs to detect any violations and alert your team via notification channels or incident management system.
<h3 id="conclusion">Conclusion</h3>
Auth0's log streaming service streams the events and logs to a host of integration partners, such as Amazon EventBridge, Azure EventHub, Datadog, Splunk, Sumologic, and custom webhooks.
Log / Event streaming helps to export the log, take decisions based on the events for threat detection and notifications, and also process identity-information in near real-time. It also helps to set up the additional data pipelines for processing based on the Auth0 events using Amazon Event Bridge or Amazon Event Hub in Event-driven applications.
<blockquote>
Please follow me on my <a target="_blank" href="https://www.twitter.com/ksivamuthu">twitter</a>, <a target="_blank" href="https://www.linkedin.com/in/ksivamuthu/">linkedin</a> and <a target="_blank" href="https://www.github.com/ksivamuthu">github</a> for more articles/demos on security, cloud native, containers and mobile/web apps.
</blockquote>

Hello 👋,  Application Monitoring is critical for your business. It gives vital information on your customer experience. Monitoring your system and infrastructure is essential to ensure the performance of your services. As software development moves ...

Streaming Auth0 Logs to Datadog to monitor

Hello, 👋 In this final post of the AWS Copilot series, we will see how to add addons like storage and additional resources, if any, and monitor the logs of the application.
If you want to check the previous posts of this series, please check them out here.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://hashnode.com/series/aws-copilot-ecs-ckhskugtp07r2s6s14k1l6s56">https://hashnode.com/series/aws-copilot-ecs-ckhskugtp07r2s6s14k1l6s56</a></div>
<h2 id="addons-storage-dynamodb">Addons - Storage (DynamoDB)</h2>
We've created the demo application running in the container, and we've deployed the container to run in ECS Fargate using AWS Copilot CLI. If we need to add storage like S3 or DynamoDB so that our services can store state, AWS Copilot provides the storage options as add-ons.
Run the below command under coffee service.
<pre><code>copilot storage init
</code></pre>It creates a new storage resource attached to one of your services, accessible from inside your service container via a friendly environment variable. You can specify either S3 or DynamoDB as the resource type.
For this demo, let's choose DynamoDB as the resource type and add the table name <code>Coffee</code> with <code>CoffeeId</code> as the hash key. After running this command, the CLI creates an addons subdirectory inside your copilot/service directory if it does not exist. 
<pre><code class="lang-YAML">Parameters:
 App:
 Type: String
 Description: Your application's name.
 Env:
 Type: String
 Description: The environment name your service, job, or workflow is being deployed to.
 Name:
 Type: String
 Description: The name of the service, job, or workflow being deployed.
Resources:
 Coffee:
 Type: AWS::DynamoDB::Table
 DeletionPolicy: Retain
 Properties:
 TableName: !Sub ${App}-${Env}-${Name}-Coffee
 AttributeDefinitions:
 - AttributeName: CoffeeId
 AttributeType: "S"
 BillingMode: PAY_PER_REQUEST
 KeySchema:
 - AttributeName: CoffeeId
 KeyType: HASH

 CoffeeAccessPolicy:
 Type: AWS::IAM::ManagedPolicy
 Properties:
 Description: !Sub
 - Grants CRUD access to the Dynamo DB table ${Table}
 - { Table: !Ref Coffee }
 PolicyDocument:
 Version: 2012-10-17
 Statement:
 - Sid: DDBActions
 Effect: Allow
 Action:
 - dynamodb:BatchGet*
 - dynamodb:DescribeStream
 - dynamodb:DescribeTable
 - dynamodb:Get*
 - dynamodb:Query
 - dynamodb:Scan
 - dynamodb:BatchWrite*
 - dynamodb:Create*
 - dynamodb:Delete*
 - dynamodb:Update*
 - dynamodb:PutItem
 Resource: !Sub ${ Coffee.Arn}
 - Sid: DDBLSIActions
 Action:
 - dynamodb:Query
 - dynamodb:Scan
 Effect: Allow
 Resource: !Sub ${ Coffee.Arn}/Index/*

Outputs:
 CoffeeName:
 Description: "The name of this DynamoDB."
 Value: !Ref Coffee
 CoffeeAccessPolicy:
 Description: "The IAM::ManagedPolicy to attach to the task role."
 Value: !Ref CoffeeAccessPolicy
</code></pre>
If you want to deploy the newly created storage add-ons, run <code>copilot svc deploy</code> of the service you've added the addons. The DynamoDB Table <code>Coffee</code> will be created.
<h3 id="net-core-amazon-dynamodb-client">.NET Core Amazon DynamoDB Client</h3>
Configure the Amazon DynamoDB .NET Client to use the Coffee Table Name. As you've seen, the table name is <code>Coffee</code> prefixed with the <code>ApplicationName-EnvironmentName-ServiceName.</code> These values are exposed in the environment variable to the ECS containers.
<pre><code class="lang-csharp"> var config = new DynamoDBContextConfig { 
 TableNamePrefix = $"{Environment.GetEnvironmentVariable("COPILOT_APPLICATION_NAME")}" + 
 $"-{Environment.GetEnvironmentVariable("COPILOT_ENVIRONMENT_NAME")}" + 
 $"-{Environment.GetEnvironmentVariable("COPILOT_SERVICE_NAME")}-"
 };
 services.AddAWSService&lt;IAmazonDynamoDB&gt;();
 services.AddTransient&lt;DynamoDBContext&gt;(c =&gt; new DynamoDBContext(c.GetService&lt;IAmazonDynamoDB&gt;(), config));
</code></pre>
Add the necessary annotations for using the model with DynamoDB Client.
<pre><code>public class Coffee
{
 [DynamoDBHashKey]
 public string CoffeeId { get; set; }
 public string CoffeeName { get; set; }
}
</code></pre>You can do the CRUD operations on the DynamoDB model created by AWS Copilot addons.
<pre><code class="lang-csharp"> public async Task&lt;List&lt;Coffee&gt;&gt; GetAll() {
 var result = this._context.ScanAsync&lt;Coffee&gt;(new List&lt;ScanCondition&gt;());
 return await result.GetRemainingAsync();
 }

 public async Task&lt;Coffee&gt; GetById(string coffeeId) {
 return await this._context.LoadAsync&lt;Coffee&gt;(coffeeId); 
 }

 public async Task&lt;Coffee&gt; Create(Coffee coffee) {
 await _context.SaveAsync(coffee);
 return await _context.LoadAsync&lt;Coffee&gt;(coffee.CoffeeId);
 }
</code></pre>
Access the CoffeeService Endpoints that do the CRUD operations on the DynamoDB models.
<h2 id="additional-resources">Additional Resources</h2>
You can add your own custom CloudFormation templates in the addons directory of the services. 
An addon template can be any valid CloudFormation template. However, by default, Copilot will pass the App, Env, and Name Parameters; you can customize your resource properties with Conditions or Mappings.
If you need to access your Resources from your ECS task, make sure to:
<ol>
<li>Define an IAM ManagedPolicy resource in your template that holds the permissions for your task and add an Output so that the permission is injected into your ECS Task Role.</li>
<li>Create an Output for any value you want to be injected as an environment variable to your ECS tasks.</li>
</ol>
E.g., For this, we will create the EventBridge - EventBus Cloudformation template as an additional resource.
<pre><code> OrderEventBus:
 Type: 'AWS::Events::EventBus'
 Properties: 
 Name: !Sub ${App}-${Env}-OrderEventBus

 OrderEventBusAccessPolicy:
 Type: AWS::IAM::ManagedPolicy
 Properties:
 Description: !Sub
 - Grants Push access to the EventBus ${OrderEventBus}
 - { EventBus: !Ref OrderEventBus }
 PolicyDocument:
 Version: 2012-10-17
 Statement:
 - Sid: EventBusActions
 Effect: Allow
 Action:
 - events:PutEvents
 Resource: !Sub ${ OrderEventBus.Arn}
</code></pre>Output:
<pre><code>Outputs:
 OrderEventBus:
 Description: "The name of the EventBusName."
 Value: !Ref OrderEventBus
</code></pre><h2 id="monitor-the-service">Monitor the Service</h2>
When you deploy the service, you've to monitor the service logs to observe the application errors and messages to understand what's going on. Copilot has the option to monitor the service logs.
Run the below command to display the logs of a deployed service.
<pre><code class="lang-bash">copilot svc logs --follow
</code></pre>
<h2 id="conclusion">Conclusion</h2>
In this series, we see AWS Copilot powers up the building's entire infrastructure and workflow, pushing and launching your container on AWS. You can build an entire application infrastructure with microservices, load balancer, container registries, storage add-ons, and additional resources.
The source code of this demo is <a target="_blank" href="https://github.com/ksivamuthu/copilot-ecs-dotnet-core-demo/">here</a>. Follow the repo for more updates on this demo.
If you like this post, please do follow me, like, and comment. Your suggestions are welcome. And if you have any questions, please feel free to ask or reach me at my Twitter <a target="_blank" href="https://twitter.com/ksivamuthu">ksivamuthu</a>.
<blockquote>
Follow the light of life. You will never walk in the darkness.
</blockquote>

Hello,  👋 In this final post of the AWS Copilot series, we will see how to add addons like storage and additional resources, if any, and monitor the logs of the application.
If you want to check the previous posts of this series, please check them o...

AWS Copilot - Addons, Additional Resources & Monitor

Hello 👋. The software has never been more complex than it is today. Why? The monolithic is broken into microservices, distributed systems, heterogeneous tech stacks, cloud-native services, and so - to build resilient, powerful, efficient services and infrastructures. As the cloud adoption model grows, the need to monitor and observe the system is the precise requirement. In this blog post, let's see the overview of Observability, Open Telemetry, and the demo of integrating the Open Telemetry in .NET Core Apps.
<h2 id="observability">Observability</h2>
Observability is proactive introspection of distributed systems for greater operational visibility, beyond monitoring. It's not just collecting the data - observability is about what data is important by looking at how the system actually behaves in production over time. Observability starts from the ad-hoc questions the developers/stakeholders asking for to observe the system from the outside.
Examples:
<ul>
<li>Did our visit count increase?</li>
<li>What's the average session time?</li>
<li>Any changes in Key Performance Indicators?</li>
<li>How do we know the calls between different microservices?</li>
<li>CPU and/or memory usage?</li>
<li>Tracing requests and errors?</li>
<li>What logs should we look at right now?</li>
<li>What changed? Why has performance degraded after the latest release?</li>
<li>What did my service look like at a particular time point or time range?</li>
<li>Performance Optimizations on the critical path?</li>
</ul>
The Observability can be defined in three foundation elements: Metrics, Logging, and Tracing.
<h2 id="open-telemetry">Open Telemetry</h2>
There are a lot of challenges when it comes to observability. The vendor-specific locking and maintaining the specific vendor SDKs across the distributed systems are a nightmare. We need standards. That standard is OpenTelemetry - for telemetry as a Cloud Native Computing Foundation project since May 2019 with the merger of OpenCensus and OpenTracing projects. 
OpenTelemetry is a vendor-neutral standard for collecting telemetry data for applications, their supporting infrastructures, and services. The Open Telemetry is used to instrument, generate, collect, and export telemetry data (metrics, logs, and traces) for analysis in order to understand your software's performance and behavior.
<h3 id="how-does-it-work">How does it work?</h3>
<ul>
<li>API: Used to generate telemetry data. Follows Open Telemetry Specification</li>
<li>SDK: Implementation of the API with processing and exporting capabilities. </li>
<li>Data: Defines semantic conventions to provide vendor-agnostic implementations as well as the OpenTelemetry protocol (OTLP).</li>
<li>Exporter: Exports the telemetry data and send it directly or through the collector to the telemetry backend.</li>
<li> Collector: The vendor-specific or OTLP exporters are used for data filtering, aggregation, batching, and communication with various telemetry backends. </li>
</ul>
<h2 id="open-telemetry-in-net-core-apps">Open Telemetry in .NET Core Apps</h2>
In this demo, we will build .NET core apps containing interconnected microservices and trace the system using OpenTelemetry .NET. 
What are we going to build?
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1607114382811/yH1AfrWIg.png" alt="OrderService.png" />
<ul>
<li>Order Service - The microservices that creates an order for the passed item code and quantity.</li>
<li>Inventory Service - The microservices that verifies whether the requested quantity available in inventory and reduce the quantity when the inventory is claimed.</li>
</ul>
The Order service will call the Inventory service to verify and also claim the requested quantity for the order for the item code.
We have these two .NET core app running in docker containers. Now, let's add the OpenTelemetry .NET library in these projects and observe the trace in the Jaeger.
To run the Jaeger in local using Docker, please refer to <a target="_blank" href="https://www.jaegertracing.io/docs/1.18/getting-started/">this page</a> or you can use the docker-compose file I've added in the demo repo referred below.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/opentelemetry-dotnet-demo">https://github.com/ksivamuthu/opentelemetry-dotnet-demo</a></div>
<h3 id="install-nuget-packages">Install Nuget packages</h3>
<ul>
<li>Install the OpenTelemetry .NET and OpenTelementry ASPNetCore Instrumentation libraries from NuGet packages.</li>
</ul>
<pre><code class="lang-bash">dotnet add package OpenTelemetry.Instrumentation.AspNetCore
dotnet add package OpenTelemetry.Extensions.Hosting
</code></pre>
<ul>
<li>As we are calling the external HTTP services, we need to instrument the HttpClient libraries as well. Add the Http Instrumentation OpenTelemetry libraries.</li>
</ul>
<pre><code class="lang-bash">dotnet add package OpenTelemetry.Instrumentation.Http
</code></pre>
You can add other instrumentation open telemetry libraries also - such as Redis, SqlClient, GrpcClient, and other community contributed projects. 
<ul>
<li>Since we are going to use the Jaeger as our exporters, let's add the JaegerExporter</li>
</ul>
<pre><code class="lang-bash">dotnet add package OpenTelemetry.Exporter.Jaeger
</code></pre>
You can use the other exporters such as Prometheus, Zipkin, Console, OTLP, and other exporters that have OTLP standards.
<h3 id="configure-your-net-core-application">Configure your .NET Core Application</h3>
ASP.NET Core instrumentation must be enabled at the application startup. Configure the OpenTelemetry Tracing in the ConfigureServices method using the ServiceCollection extension method provided by OpenTelemetry.Extensions.Hosting.
<pre><code class="lang-csharp">using Microsoft.Extensions.DependencyInjection;
using OpenTelemetry.Trace;

var resourceBuilder = ResourceBuilder.CreateDefault().AddService("OrderService");
services.AddOpenTelemetryTracing((builder) =&gt; builder
 .AddAspNetCoreInstrumentation()
 .AddHttpClientInstrumentation()
 .AddJaegerExporter()
 .SetResourceBuilder(resourceBuilder)
);
</code></pre>
<h2 id="jaeger">Jaeger</h2>
Now let's run the applications and launch the Jaeger locally. I've created the docker-compose file that runs all.
<pre><code class="lang-bash">docker-compose up --build
</code></pre>
Now create an order using the Order Service. This Order service will verify the inventory, create an order, and claim the inventory to get processed.
<pre><code class="lang-bash">curl --location --request POST 'http://localhost:4500/api/Order' \
--header 'Content-Type: application/json' \
--data-raw '{
 "itemCode": "PIZZA",
 "quantity": "1",
 "username": "Siva"
}'
</code></pre>
Let's navigate to the Jaeger UI. See, how the traces are created and you can take a single trace and see what are the different spans, any external API calls, custom traces, and span. 
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1607220353384/1en7uVlMH.png" alt="Screen Shot 2020-12-05 at 8.57.08 PM.png" />
<h2 id="conclusion">Conclusion</h2>
Using OpenTelemetry SDK gives you more flexibility, offering integration with multiple monitoring backends. 
You can explore and understand the APIs and concepts of it. Using in the production will take some time till the packages are in a stable state. OpenTelemetry’s .NET packages are in beta state and the APIs will be subject to change. 
The OpenTelemetry efforts are promising and moving in the right direction for the observability - logs, metrics, and traces. The OpenTelemetry is majorly supporting traces now. The metrics are still in the early stage and .NET Core Metrics APIs are compatible with the OpenTelemetry Metrics API Specification. The logging is relying on Microsoft.Extensions.Logging for .NET libraries. 
Checkout their repo for more details.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/open-telemetry/opentelemetry-dotnet">https://github.com/open-telemetry/opentelemetry-dotnet</a></div>
<blockquote>
This post is created as part of the <a target="_blank" href="http://www.csadvent.christmas">C# Advent Calendar 2020</a> Please check out the link to find other great articles posted in the series.
Please follow me on my <a target="_blank" href="https://www.twitter.com/ksivamuthu">twitter</a>, <a target="_blank" href="https://www.linkedin.com/in/ksivamuthu/">linkedin</a> and <a target="_blank" href="https://www.github.com/ksivamuthu">github</a> for more articles/demos on cloud native, containers and mobile/web apps.
</blockquote>

Hello 👋. The software has never been more complex than it is today. Why? The monolithic is broken into microservices, distributed systems, heterogeneous tech stacks,  cloud-native services, and so - to build resilient, powerful, efficient services a...

Open Telemetry - Observability in .NET Core Apps

Howdy !! In the <a target="_blank" href="https://ksivamuthu.hashnode.dev/aws-copilot-ecs">previous post</a> on <a target="_blank" href="https://hashnode.com/series/aws-copilot-ecs-ckhskugtp07r2s6s14k1l6s56">this series</a>, we had a walkthrough on how AWS Copilot facilitates creating the application infrastructure, container registry and build the container to deploy in the test environment. Yes, that's the Hello World .NET Core application - deployed in the test environment. 
Now, let's see how to set up the pipeline and automate the application release to test and production environments whenever the source code is committed. 
Let's start. We will add more to our demo code to build. That will also help us explore more in ECS like storage and service discovery in upcoming posts in this series. The "Hello World" .NET Core application is upgrading into "Coffee Service." Later we will add more services to our demo coffee shop application.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1606267559136/OnFTEjhdD.jpeg" alt="rob-laughter-LWiXD-81bIg-unsplash.jpg" />
<h2 id="coffee-shop-application-demo">☕️ Coffee Shop Application Demo</h2>
In this AWS Copilot series, we will develop the coffee shop application hosted in ECS Fargate using Copilot.
The microservices in this Coffee Shop Application demo is:
<ol>
<li>Coffee Order UI - Submitting Order</li>
<li>Coffee Service - API for Coffee types</li>
<li>Order Service - API for creating order and get the status of the order.</li>
<li>Barista Service - Processing order and update the status (Event Driven)</li>
</ol>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1606277832919/8mOAKqshn.png" alt="CoffeeService.png" />
When we are deploying to ECS, we will go through what are the types of service and route path rules for each service.
<ol>
<li>Coffee Order UI - / - It's the default route to navigate to the client application behind the load balancer.</li>
<li>Coffee Service - /coffee-service/* - The Coffee Service API is going to be prefixed with coffee-service behind the load balancer.
For, e.g., <code>https://awscopilotcoffeeshop.com/coffee-service/api/coffees</code> will be rewriting to the dot net core application <code>http://coffee-service.local:80/api/coffees</code>.</li>
<li>Order Service - /order-service/* - The Order Service API will be prefixed with order-service behind the load balancer.</li>
<li>Barista Service - Internal Backend Service that is not exposed to the internet. The services/instances in the VPC can access them.</li>
</ol>
In this post, we will focus only on Coffee Service &amp; Coffee Order UI development and setting up the pipeline to automatically deploy your container application.
<h3 id="coffee-service">Coffee Service</h3>
Here comes my favorite part... Let's add the services that list the types of coffee; users can choose to order. The .NET core app with the endpoint is ready that returns the list of coffee types. The application is running in a container. Now, it's a single command to add it our application and deploy.
<pre><code>copilot svc init -n coffee-service
</code></pre>Select the location of the docker file to create the service. Once the service is created, take a look at the manifest file created under the copilot directory. In the HTTP section of the below manifest, you can see the path prefix <code>coffee-service</code> add. This will reflect in your application load balancer rules. 
You may need to add the coffee-service as PathBase in your .NET Core app to handle the requests properly from serving behind the ALB (Application Load Balancer)
<pre><code class="lang-csharp"> app.UsePathBase(new PathString("/coffee-service"));
</code></pre>
<pre><code>## File Path: copilot/coffee-service/manifest.yml

# Your service name will be used in naming your resources like log groups, ECS services, etc.
name: coffee-service
# The "architecture" of the service you're running.
type: Load Balanced Web Service

image:
 # Docker builds arguments.
 # For additional overrides: https://aws.github.io/copilot-cli/docs/manifest/lb-web-service/#image-build
 build: CoffeeService/Dockerfile
 # Port exposed through your container to route traffic to it.
 port: 80

http:
 # Requests to this path will be forwarded to your service. 
 # To match all requests, you can use the "/" path. 
 path: 'coffee-service.'
 # You can specify a custom health check path. The default is "/."
 # For additional configuration: https://aws.github.io/copilot-cli/docs/manifest/lb-web-service/#http-healthcheck
 healthcheck: '/healthz'
 # You can enable sticky sessions.
 # stickiness: true
</code></pre>You can deploy the service using the below command.
<pre><code>copilot svc deploy -n coffee-service --environment test
</code></pre>Test the service with the curl command
<pre><code class="lang-bash">curl -s http://&lt;loadbalancer_url&gt;/coffee-service/api/coffee | jq
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1606279886100/UYgvoKmoj.png" alt="Screen Shot 2020-11-24 at 11.47.46 PM.png" />
<h3 id="add-more-containers-coffee-ordering-ui">Add more containers... Coffee Ordering UI</h3>
The Coffee Ordering UI is created as a React application that fetches the coffee types from the API and listing them for the user to choose from. The React application is built and serves as static files from the Nginx container. 
Create a new Load Balancer Web Service to serve this UI app to the internet. 
<pre><code>copilot svc init -n coffee-ordering-ui
</code></pre>Select the location of the docker file to create the service. Once the service is created, verify and modify the manifest file as needed, and you can deploy the service using the below command.
<pre><code>copilot svc deploy -n coffee-ordering-ui --environment test
</code></pre>The app looks like this... 
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1606338020747/vBHlVV264.png" alt="Screen Shot 2020-11-25 at 2.10.09 PM.png" />
<h2 id="setup-the-pipeline-to-automate-the-release">Setup the pipeline to automate the release</h2>
The key principle of the devops process is "Ship small, Ship often." The process of deploying small features on a regular cadence is crucial to DevOps. As the team is becoming more agile, we need to automate application releases as multiple developers, multiple services teams pushing the code into the source code repository. 
AWS Copilot tool can help you in setting up the pipeline to automate application releases. You can run these commands to create an automated pipeline for the application that builds and deploy the application on git push. You need to set up the github repo personal access token that has permissions includes reading the repo.
<pre><code class="lang-bash">copilot pipeline init
copilot pipeline update // To update
git push
</code></pre>
Check the status of the pipeline using copilot cli or in the AWS Code Pipeline console.
<pre><code class="lang-bash">copilot pipeline status
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1606281524686/6OdnYgEZT.png" alt="Screen Shot 2020-11-25 at 12.06.28 AM.png" />
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1606281490326/wtKFK9-jD.png" alt="Screen Shot 2020-11-25 at 12.18.01 AM.png" />
Now, it's ready to bring more developers to start rocking. They don't need to install a copilot to deploy the machine's service, as they are developing. The deployment steps are automated.
<h2 id="pushing-more-code">Pushing more code</h2>
I see the UI we've created needs more things to add. I'm going to add the image of the coffee in the app and service. Once I pushed the repository changes, the pipeline deploys the updated version of the app and service in the test or integration environment automatically.
The new version of the app deployed:
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1606337951506/83F-eMgPJ.png" alt="Screen Shot 2020-11-25 at 3.37.48 PM.png" />
<h2 id="deploying-to-production">Deploying to Production</h2>
In this application, we have a <code>test</code> environment in the pipeline. Let's add another environment <code>production</code>. We will set up the manual approval as the required action as the approval to the changes going into the gateway.
In the pipeline.yml created at the step of initializing the pipeline, add prod deploy as one stage with requires_approval as true. Update the pipeline using <code>copilot pipeline update</code> after these changes.
<pre><code class="lang-yml">stages:
 - name: test
 # Optional: flag for manual approval action before deployment.
 # requires_approval: true
 # Optional: use test commands to validate this stage of your build.
 # test_commands: [echo 'running tests', make test]
 - name: prod
 requires_approval: true
</code></pre>
You can run integration tests also at each stage using the test_commands in the stage yml configuration.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1606309477902/apn8brtVF.png" alt="Screen Shot 2020-11-25 at 8.03.53 AM.png" />
The app is shipped to the production environment after approval. 🚚🚀
<h2 id="conclusion">Conclusion</h2>
🚀 AWS Copilot supercharges your application - one cli tool to set up infrastructure, build your application with many services, setting up the pipeline to automate release, monitor the status of stack and application, and with add-ons. 
AWS Copilot v1.0 is officially released. See this announcement.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://twitter.com/nathankpeck/status/1330979599614959620">https://twitter.com/nathankpeck/status/1330979599614959620</a></div>
In this article, we walked through how to set up the automated deployments of your applications. The source code of this demo is <a target="_blank" href="https://github.com/ksivamuthu/copilot-ecs-dotnet-core-demo/tree/part-2">here</a>.
What's next? In the upcoming articles of this series, we are going to complete our Coffee Shop Demo application by adding Order Service and Barista Service with event-driven architecture. That also includes the steps how AWS copilot adds storage, access other AWS services, environment variables, and more.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://hashnode.com/series/aws-copilot-ecs-ckhskugtp07r2s6s14k1l6s56">https://hashnode.com/series/aws-copilot-ecs-ckhskugtp07r2s6s14k1l6s56</a></div>
<blockquote>
Give the world a smile each day 
If you’ve liked this post please share and clap 👏. Also, if you have any questions, please ask in the comments. Thank you! 
Please follow me on my <a target="_blank" href="https://www.twitter.com/ksivamuthu">twitter</a>, <a target="_blank" href="https://www.linkedin.com/in/ksivamuthu/">linkedin</a> and <a target="_blank" href="https://www.github.com/ksivamuthu">github</a> for more articles/demos on cloud native, containers and mobile/web apps.
</blockquote>

Howdy !! In the previous post on this series, we had a walkthrough on how AWS Copilot facilitates creating the application infrastructure, container registry and build the container to deploy in the test environment. Yes, that's the Hello World .NET ...

AWS Copilot - Automate Application Releases

<h2 id="introduction">Introduction</h2>
You've your application running in containers. What are the steps you are taking to deploy the containers? How much time does it take to create the infrastructure, pipelines to build, release, and operate production-ready containerized applications? Do we've any toolkit available for developers to accelerate the deployment of containerized applications in AWS ECS &amp; Fargate? 
Yes. AWS Copilot CLI is a tool for developers to build, release, and operate production-ready containerized applications on Amazon ECS and AWS Fargate. From getting started, pushing to staging, and releasing to production, Copilot can help manage the entire lifecycle of your application development.
In this blog post, I'm going to walk through the steps of how AWS Copilot helps developers/customers focus on building the applications rather than setting up their infrastructure.
<h2 id="installing-cli">Installing CLI</h2>
Install the AWS Copilot CLI in your Mac through Homebrew or Cloud 9 IDE
<pre><code class="lang-bash">brew install aws/tap/copilot-cli
</code></pre>
As well as, you'll need the basic tools to use AWS Copilot, such as - Docker Desktop, AWS Credentials with necessary permissions, your favorite code editor (VSCode), etc. Make sure that you have a default profile for your AWS credentials. 
Okay. The CLI is installed. What's next? It should be easy with few commands in your terminal. Before looking into our demo, let's go through a few concepts in Copilot that help us understand what's going on behind the scenes.
<h2 id="features">Features</h2>
What are the features the containerized application requires to run?
<ul>
<li>Network Resources - VPC, Subnets, Security Groups, etc</li>
<li>ECS Cluster - Cluster of Containerized applications/services - Containers running on EC2 or use Fargate for serverless containers</li>
<li>Load Balancer - To access the production environment from the internet.</li>
<li>Internal Load Balancer - To access the non-production / QA environment from the internal network.</li>
<li>Environments - Different environments to deploy your code.</li>
<li>Container Registry - Registry for your application containers</li>
<li>Pipeline - Pipeline to build, release your applications.</li>
</ul>
Pretty much, we need the above items to set up the production-grade applications. 
The AWS Copilot will take care of setting up the whole infrastructure that's required. The core concepts of AWS Copilot help you to set them up.
<h3 id="applications">Applications</h3>
An Application is a collection of services and environments. It's a high-level product name. You can create multiple services under the application.
<h3 id="environments">Environments</h3>
You can deploy your service to the test environment and then deploy it to your production environment. The environment isolation is required to gate what features you want to release to your end customers. You can deploy multiple services in separate environments - the services will share the same network and cluster for your environment.
<h3 id="services">Services</h3>
You can choose different service types when Copilot CLI asks whether your service is a back-end service or load balancer web service or the scheduled job for ephemeral workloads. 
<h2 id="net-5-application-and-dockerfile">.NET 5 Application &amp; Dockerfile</h2>
Now, let's start with the demo. I've created a simple Hello World .NET Core 5 API code and the dockerfile running the .NET 5 API code in the container. Check out this repo. Now we are going to get it deployed to AWS using AWS Copilot.
<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/ksivamuthu/copilot-ecs-dotnet-core-demo">https://github.com/ksivamuthu/copilot-ecs-dotnet-core-demo</a></div>
In the directory run, 
<pre><code class="lang-bash">copilot init
</code></pre>
Answer the questions the CLI is asking.
<ul>
<li>the application name</li>
<li>what type of service</li>
<li>which docker file you like to use for your service.</li>
</ul>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605929527151/dUYkntqL6.png" alt="Screen Shot 2020-11-20 at 10.31.06 PM.png" />
Once you answered the questions, Copilot will start setting up the AWS infrastructure to manage your service. It's using Cloudformation to create and manage the infrastructure your application and services require.
<h2 id="deploy-in-ecs">Deploy in ECS</h2>
Once Copilot finishes setting up the infrastructure to manage your app, you’ll be asked if you want to deploy your service to a test environment type yes.
Copilot sets up all the resources needed to run your service in the test environment. After the environment infrastructure is created, Copilot will build your docker image, push it to Amazon ECR, and start deploying to Amazon ECS.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605931280344/q5b8Yyc-0.png" alt="Screen Shot 2020-11-20 at 11.01.00 PM.png" />
Now, your service will be up and running on AWS Fargate. You can create production or other environments using copilot commands.
<h2 id="conclusion">Conclusion</h2>
Copilot is doing the heavy lifting for us - the developers. So we can focus on the application. Copilot will take care of the building, pushing, and launch your container on AWS. It's easy, right. You can build an entire application infrastructure with microservices, load balancer, container registries. 
Okay. I hear from you. It's a simple service, and the deployment has been done from your computer. What about multiple services? How to do automatic deployment from Git repository? How to provision the storage? Can we access the logs of the container? How to monitor the applications? Let's see in detail in the next post. 
If you like this post, please do follow me, like, and comment. Your suggestions are welcome. And if you have any questions, please feel free to ask or reach me at my Twitter <a target="_blank" href="https://twitter.com/ksivamuthu">ksivamuthu</a>
<blockquote>
Encourage one another and build each other up !!!
</blockquote>

Introduction
You've your application running in containers. What are the steps you are taking to deploy the containers? How much time does it take to create the infrastructure, pipelines to build, release, and operate production-ready containerized a...

AWS Copilot - Containerized Applications in AWS ECS

We are always asking questions to expand our knowledge. We need quick and relevant answers to our questions in everyday life. What's the time now? How is the weather today? What's the travel time to work? How many cups of sugar in this recipe? When will this pandemic end? And we have smart search engines to ask.
Machine learning is continuously making search engines smarter. And we are expecting the speedy, accurate and personalized results. The search interface is available on traditional platforms, websites, and modern conversational platforms such as chatbots and voice assistant devices.
Great so far. But let's talk about enterprise search use cases. The search seems a lot more troublesome when it comes to enterprise. The data from the various data sources and legacy applications hamper internal data searches.
The promising Amazon Kendra is a highly accurate and easy to use enterprise search that's powered by machine learning. Kendra delivers powerful natural language search capabilities to your websites and applications so your end users can easily find the information they need within the vast amount of content spread across your enterprise.
Are you ready to see the benefits of AWS Kendra in action? Let's start.
<h2 id="prerequisites">Prerequisites</h2>
<ol>
<li>AWS Account</li>
<li>Sample Documents / FAQs in one of the supported data sources (S3, Onedrive, Sharepoint Online, Salesforce, ServiceNow, RDS)</li>
<li>☕️ Coffee to sip when you are waiting on creating an index.</li>
</ol>
<h2 id="setup-amazon-kendra">Setup Amazon Kendra</h2>
<h3 id="create-index">Create Index</h3>
Open the Amazon Kendra console at https://console.aws.amazon.com/kendra. Create an index by specifying the index name, description, and role with <a target="_blank" href="https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html#iam-roles-index">required policies</a>.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923104847/gRpbyeqD7.gif" alt="create index" />
<h3 id="add-data-sources">Add data sources</h3>
Amazon Kendra provides an easy way to add your data sources that it should index. You can schedule the sync periodically or sync on demand. The sync will update the index of new, updated, and deleted files from your document source repositories.
Supported data sources:
<ol>
<li>Amazon S3</li>
<li>RDS</li>
<li>Microsoft OneDrive</li>
<li>Salesforce</li>
<li>ServiceNow</li>
<li>Microsoft SharePoint</li>
</ol>
You can directly add the documents to the index through the document addition API. And also, you can upload the FAQs with answers and an optional link to the document.
In this demo, I've added publicly available documents from Wikipedia and websites to the S3 bucket. Now let's add S3 bucket as the data source to the index. 
Click "Add data sources" in the index. Choose "Amazon S3" from the list of data source connectors and enter the data source location, IAM role, and set sync run schedule. Review the attributes and create the data source. 
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923108051/J83J2PaJ7.gif" alt="add data source" />
<h3 id="test-and-deploy">Test and deploy.</h3>
You can test and tune the search experience directly in the search console. In the Amazon Kendra console, choose your index and then select Search console.
Enter your search text and click the search icon. Amazon Kendra returns the results of the search.
Amazon Kendra - ML-powered Enterprise search differs from the traditional search by understanding the context of the question and return the most relevant data. The powerful natural language processing behind Amazon Kendra processes the user's natural language questions or keywords to search the specific answers anywhere in data. 
In this demo, I'm searching for questions such as 
<ul>
<li>How long are the ISS missions?</li>
<li>How fast the space stations travel?</li>
<li>What is the pH of pure water?</li>
<li>When is Walt Disney World founded?</li>
</ul>
Amazon Kendra brought up the specific answer for the question we asked using powerful ML and NLP capabilities and highlighted the response as below. Isn't that cool?
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923110727/BpOvAqdrp.png" alt="Alt Text" />
And another question...
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923113010/SduZ10UGJ.png" alt="Alt Text" />
<h3 id="feedback-and-retrain">Feedback &amp; Retrain</h3>
Amazon Kendra powered search results get better as end-users use the service. Kendra actively retrains the deep learning models build for your data set. The usage and feedback patterns improve search accuracy. You can also have the option to fine-tune results by adjusting the importance of specific data sources.
<h2 id="production-workloads">Production workloads</h2>
You pay only for what you use for Amazon Kendra Service. Amazon Kendra comes in two editions.
<ol>
<li>Kendra Enterprise Edition provides a high-availability service for production workloads.</li>
<li>Kendra Developer Edition provides developers with a lower- cost option to build a proof-of-concept. </li>
</ol>
You can add more capacity - query-based or storage-based in Enterprise Edition based on scale. Please checkout the Amazon Kendra pricing options <a target="_blank" href="https://aws.amazon.com/kendra/pricing/">here</a>.
<h2 id="demo">Demo</h2>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923115692/6rng0lVbD.gif" alt="Demo" />
<h2 id="final-thoughts">Final Thoughts</h2>
Amazon Kendra uses deep learning models to understand natural and complex language queries and document content and structures for a wide range of internal use cases like IT, financial services, insurance, pharmaceuticals, industrial manufacturing, energy, legal, media and entertainment, travel and hospitality, healthcare, HR, news, telecommunications, and automotive. Its benefits are great.
<ol>
<li>Natural Language Understanding</li>
<li>Easy to add - connectors to the popular data sources</li>
<li>Relevance Tuning</li>
<li>Document Ranking</li>
<li>Reading comprehension</li>
<li>Focusing on the answer - not on links</li>
<li>Incremental learning</li>
</ol>
Do you want to see the demo live? Do you want to know how to integrate the Amazon Kendra search into your enterprise chatbot? Please join, as I'm going to present a live session at my youtube channel / <a target="_blank" href="https://twitch.tv/ksivamuthu">twitch</a> on June 15, 2020 - 6.30 pm ET discussing Amazon Kendra and demo integrated with the chatbot. 
{% youtube yqABUbUahN0 %}
Please do like, share, and comment. DM me at my twitter @ksivamuthu if you've any questions or to discuss ML/IoT use cases for your business to solve.

We are always asking questions to expand our knowledge. We need quick and relevant answers to our questions in everyday life. What's the time now? How is the weather today? What's the travel time to work? How many cups of sugar in this recipe? When w...

Amazon Kendra - Enterprise Search powered by ML

The viral epidemics are a severe threat to the entire world. It's causing the significant loss, but COVID is not the first one, and it's not the last one too. The promising hope to this, Humanity has so far survived every microbe we came across, and human species will survive this one also. 
If the history is repeating, what differs from previous epidemics? The answer is Data. Yes, saying again - Data. The recent innovations and infrastructure facilitate dealing with the massive amount of data to analyze. We are collecting and sharing what we learn about the virus, identify who is at more risk, locations to track contacts, wearable technologies to monitor vitals, our behaviors that cause the terrible spread pattern, and more including predicting the next pandemic.
As we gather an enormous amount of data, Machine Learning plays a crucial role in analyzing the data, train the model to predict the risks with high accuracy. Hear more from <a target="_blank" href="https://www.geekwire.com/2020/ai-vs-coronavirus-artificial-intelligence-now-helping-fight-covid-19/">Geekwire Health Tech</a> podcast on how AI is helping in the fight against COVID'19.
{% spotify spotify:episode:5JxnMVcHLX8Pb8ZFS2OO3a %}
<h2 id="face-touch-warning-system">Face Touch - Warning System</h2>
Let me explain why I want to create a warning system against face touching personally. One of the COVID'19 prevention advice is to avoid touching the face. Face touching is an automatic reflex. It's tough to avoid touching. Notably, the one wearing correction glasses like me can easily relate them on face touching. 
So I decided to build the ML model using Google Cloud AutoML Vision, which alerts me when I'm going to touch my face. In this blog series, I will explain the steps to build the model and do high-quality inference using Tensorflow JS and also in Raspberry Pi using Edge TPU.
<h3 id="google-cloud-automl-vision">Google Cloud AutoML Vision</h3>
<a target="_blank" href="https://cloud.google.com/vision/automl/docs">Google Cloud AutoML Vision</a> enables developers with limited machine learning expertise to train high-quality models specific to your business needs. It relies on Google's state-of-the-art transfer learning and neural architecture search technology to find the best network architecture and the optimal hyperparameter configuration that minimizes the loss function of the model.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923120416/3AaX9I2qE.png" alt="How AutoML works" />
Steps to create an image classification model using AutoML Vision API:
<ol>
<li>Data preparation and labeling</li>
<li>Training the model</li>
<li>Evaluate</li>
<li>Deploying models in the cloud / Exporting your models to use in Edge.</li>
</ol>
<h4 id="data-preparation">Data preparation</h4>
I've taken pictures of my family and me under two significant categories. One with touching the face and another one without touching the face. Later, I've added more different faces under these labels from the public datasets such as [Open Image Dataset] (https://opensource.google/projects/open-images-dataset) and <a target="_blank" href="https://www.kaggle.com/datasets">Kaggle</a>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923122701/uJnKLjpTO.png" alt="Datasets" />
<h4 id="training-the-model">Training the model</h4>
Now it's time to train the model. Click on the <code>Train</code> tab and start training. 
When you start training, you need to provide the below settings
<ol>
<li>Model Name - Name of the model</li>
<li>Type - the model type you want to train</li>
<li>Cloud-hosted for online prediction</li>
<li>Edge for device and offline use.</li>
<li>Model Optimization Type - If you are training for the edge, choose the optimization type higher accuracy or best trade-off or fast predictions with low accuracy </li>
<li>Node hours - Enter the maximum number of node hours you want to spend training your model.</li>
</ol>
Google Cloud recommends using 3 node hours for your dataset. However, the model training process now stops earlier by default when the search process is no longer finding better performing models. In this case, it took 0.264 hours to train the model, even though I specified 3 node hours for the budget.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923125191/BxDCxuq9X.png" alt="Alt Text" />
<h4 id="evaluate">Evaluate</h4>
Once the model is trained, navigate to the <code>Evaluate</code> tab to explore the analysis of the trained model and precision/recall percentages. You can drag the score threshold slider to adjust the precision-recall tradeoff. The confusion matrix explains how often the model classified each label correctly (in blue), and which labels were most often confused for that label. You can analyze the confusion matrix and modify the dataset to train further to avoid false positives and false negatives on prediction.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923127039/mKD8K5lP3.png" alt="Alt Text" />
<h4 id="exporting-your-models-to-use-in-edge">Exporting your models to use in Edge</h4>
After you have trained a model, you can export your custom model to predict on your edge devices. After exporting your model, you can then deploy the model to a device.
You can export an image classification model in either generic Tensorflow Lite format, general TensorFlow format, or TensorFlow.js for Web format and CoreML. It also supports to run the model predictions on Google Coral USB Accelerator, and containers.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923128834/zzSLJlxZa.png" alt="Alt Text" />
<h3 id="demo">Demo</h3>
I've exported this model to Tensorflow.js format to make the predictions on the website. See the below demo where it alerts me when I'm touching my face.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923132451/VEXk1gDlS.gif" alt="Alt Text" />
<h3 id="conclusion">Conclusion</h3>
This article provided a walkthrough to design powerful vision models for custom use-cases by leveraging Google Cloud Platform AutoML Vision. It's a great tool to quickly prototype and builds image classification and object detection uses-cases with AutoML capabilities. 
I will cover how to run the predictions using Tensorflow.js to run on the web browser and also how to run the inference pretty fast using Raspberry PI and Coral USB Edge TPU Accelerator in the next post of this series.
Do you want to see the demo live? I'm going to present this demo at <a target="_blank" href="https://www.meetup.com/iot-orlando/events/269875620/">GDG Central Florida + Orlando IoT Virtual Meetup</a> on April 15, 2020 - 6.30 pm ET. The event is streaming live at <a target="_blank" href="https://www.youtube.com/channel/UC72P7IF7oRrr7c1eQuR6zqw">Orlando IoT Youtube Channel</a>
We don't want to stop learning, sharing, and being a community in tough times. Everyone, stay safe and healthy. Please do like, share and comment. DM me at my twitter <a target="_blank" href="https://twitter.com/ksivamuthu">@ksivamuthu</a> if you've any questions or to discuss ML/IoT use cases for your business to solve.

The viral epidemics are a severe threat to the entire world. It's causing the significant loss, but COVID is not the first one, and it's not the last one too. The promising hope to this, Humanity has so far survived every microbe we came across, and ...

Google Cloud AutoML Vision - Warn Against Face Touching

In this blog post, I will walk through how to integrate Dapr - Distributed application runtime in Kubernetes with Azure Event Hubs.
<h2 id="what-is-dapr">What is Dapr?</h2>
Dapr is a portable, event-driven runtime that makes it easy for developers to build resilient, microservice stateless and stateful applications that run on the cloud and edge.
Dapr consists of a set of building blocks accessed by standard HTTP or gRPC APIs that can be called from any programming language. Dapr building blocks include the capabilities needed for building microservices applications. Dapr provides some of the building blocks such as Service Invocation, State management, Pub/Sub, Event-driven resource binding, Virtual actors, and Distributed tracing.
{% github dapr/dapr no-readme %}
<h2 id="key-features-of-dapr-and-building-blocks">Key features of Dapr &amp; Building blocks.</h2>
<ul>
<li>Pluggable component model</li>
<li>Standard APIs using HTTP and gRPC.</li>
<li>Portable across different supported infrastructures</li>
<li>Extensibility </li>
<li>Ease of integration</li>
<li>Runs anywhere as a process / in a docker container.</li>
<li>Dynamically choose different implementation.</li>
</ul>
Dapr provides a dedicated CLI for easy debugging and clients for Java, .NET, Go, Javascript, Python, Rust, and C++. 
<h2 id="binding">Binding</h2>
In event-driven applications, your app can handle events from external systems or trigger events in external systems. Input and Output bindings help you to receive and send events through Dapr runtime abstraction.
Bindings remove the complexities of integrating with external systems such as queue, message bus, etc., and help developers focus on business logic. You can switch between the bindings at runtime and keep the code free from vendor SDKs or libraries to create portable applications. 
<h2 id="prerequisites">Prerequisites</h2>
<h3 id="getting-started-with-dapr-on-kubernetes">Getting started with Dapr on Kubernetes</h3>
Install Dapr on the Kubernetes cluster using a helm chart. You can install in minikube or managed kubernetes cluster such as AKS or any.
<ul>
<li>Make sure <a target="_blank" href="https://helm3.sh">Helm 3</a> is installed on your machine.
</li>
<li>Add daprio Azure Container Registry as a Helm repo.
<pre><code>$ helm repo add dapr https://daprio.azurecr.io/helm/v1/repo
$ helm repo update
</code></pre></li>
<li>Create dapr-system namespace on your kubernetes cluster.
<pre><code>$ kubectl create namespace dapr-system
</code></pre></li>
<li>Install the Dapr chart on your cluster in the dapr-system namespace
<pre><code>$ helm install dapr dapr/dapr --namespace dapr-system
$ kubectl get pods -n dapr-system -w // Verify the pods are created
</code></pre></li>
</ul>
<h3 id="setup-kafka-enabled-azure-event-hubs">Setup Kafka Enabled Azure Event Hubs</h3>
The first step is to create the <a target="_blank" href="https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-create">Azure Event Hubs in Azure Portal</a> and get <a target="_blank" href="https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string#get-connection-string-from-the-portal">Event Hub Connection String</a>
After you complete the steps from above links from Microsoft Docs, you will have
<ol>
<li>Event Hub Connection String</li>
<li>Event Hub Namespace Name</li>
</ol>
You need this to configure the input bindings. 
<h2 id="demo">Demo</h2>
In this demo, we are going to create an application that pushes the event to Azure Event Hub and the microservice that receives the event through Dapr input binding. 
The event hub consumer microservice is deployed into the kubernetes cluster. The Dapr input binding - Azure Event Hub spec triggers the event hub consumer HTTP endpoint when an event is triggered from Event Hub. 
To demo the portability, we are going to change the Azure EventHub input binding spec to Kafka input binding spec.
{% github ksivamuthu/dapr-demo no-readme %}
<pre><code class="lang-bash">git clone https://github.com/ksivamuthu/dapr-demo.git
</code></pre>
<h3 id="event-hub-producer">Event Hub Producer</h3>
Event Hub Producer application - <a target="_blank" href="https://github.com/ksivamuthu/dapr-demo/tree/master/bindings/eventhub-producer">eventhub-producer</a> is using Azure EventHubs NodeJS SDK to connect with Azure Event Hub.
Configure the connection string and event hub name in .env file or in your environment variables to load it in the nodejs process.
<pre><code class="lang-bash">EVENTHUB_NAME= &lt;EVENTHUB_NAME&gt; //Replace
EVENTHUB_CONNECTION_STRING= &lt;EVENTHUB_CONNECTION_STRING&gt; //Replace
</code></pre>
Then, create the <code>EventHubProducerClient</code> to send the individual events to Azure Event Hub with a delay of two seconds for this demo purpose.
<pre><code class="lang-javascript"> const producer = new EventHubProducerClient(connectionString, eventHubName);

 const events = [
 'Order received',
 'Being prepared',
 'On the way',
 'Delivered'
 ];

 for (let index = 0; index &lt; events.length; index++) { 
 console.log(`Sending event: ${events[index]}`) 
 const batch = await producer.createBatch();
 batch.tryAdd({ body: { msg: events[index] }});
 await producer.sendBatch(batch); 
 await delay(2000);
 }

 await producer.close();
</code></pre>
<h3 id="event-hub-consumer">Event Hub Consumer</h3>
Event Hub Consumer is the microservice application that is going to be deployed in the Kubernetes cluster. 
It's the simple express application with a post endpoint which logs the data received.
<pre><code class="lang-javascript">const express = require('express')
const app = express()
app.use(express.json())

const port = 3000

app.post('/receive-event', (req, res) =&gt; {
 console.log(req.body)
 res.status(200).send()
})

app.listen(port, () =&gt; console.log(`Kafka consumer app listening on port ${port}!`))
</code></pre>
<h4 id="deploy-the-app-in-kubernetes">Deploy the app in Kubernetes</h4>
To build the container image with the eventhub-consumer application, 
<pre><code class="lang-bash">cd bindings/eventhub-consumer
docker build -t eventhub-consumer:latest .
</code></pre>
Deploy the app using a YAML file that has deployment, service objects.
<pre><code class="lang-bash">kubectl apply -f bindings/yamls/eventhub-consumer.yaml
</code></pre>
In the deployment YAML file, I would like to show you the annotations Dapr runtime requires to know which app and port the input binding should call.
<pre><code class="lang-yaml">---
apiVersion: apps/v1
kind: Deployment
metadata:
 name: eventhub-consumer
 labels:
 app: eventhub-consumer
spec:
 replicas: 1
 selector:
 matchLabels:
 app: eventhub-consumer
 template:
 metadata:
 labels:
 app: eventhub-consumer
 annotations:
 dapr.io/enabled: "true"
 dapr.io/id: "eventhub-consumer"
 dapr.io/port: "3000"
 spec:
 containers:
 - name: node
 image: eventhub-consumer:latest
 ports:
 - containerPort: 3000
 imagePullPolicy: IfNotPresent
</code></pre>
<h3 id="azure-event-hub-input-binding">Azure Event Hub Input Binding</h3>
Now it's time to integrate the producer and consumer through Dapr runtime. There are different specs available for input binding. In this demo, we are going to create the input binding with <a target="_blank" href="https://github.com/dapr/docs/blob/master/concepts/bindings/specs/eventhubs.md">Azure Event Hub spec</a>. 
Update the connection string in the below YAML with the Azure Event Hub Connection String. The metadata.name is nothing but your post endpoint of eventhub-consumer application.
Apply this YAML in your kubernetes cluster.
<pre><code class="lang-yaml">apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: receive-event
spec:
 type: bindings.azure.eventhubs
 metadata:
 - name: connectionString 
 value: CONNECTION_STRING # replace
</code></pre>
Run the eventhub-producer application to send the events. You may also need to watch the logs of the eventhub-consumer pod to see the received events.
<pre><code class="lang-bash">cd eventhub-producer
node index.js

//and in another tab
kubectl logs &lt;pod_name&gt; -f &lt;container_name&gt;
</code></pre>
You should see the output like below
<pre><code class="lang-bash">// eventhub-producer
Sending event: Order received
Sending event: Being prepared
Sending event: On the way
Sending event: Delivered
</code></pre>
<pre><code class="lang-bash">// eventhub-consumer kubernetes logs
Kafka consumer app listening on port 3000!
{ msg: 'Order received' }
{ msg: 'Being prepared' }
{ msg: 'On the way' }
{ msg: 'Delivered' }
</code></pre>
<h3 id="kafka-input-binding">Kafka Input Binding</h3>
It's clear how Dapr abstracts the runtime binding in which the eventhub-consumer is not aware of the vendor libraries and abstracted through HTTP/gRPC endpoints.
Now, we are going to switch the input bindings from Azure Event Hub to Kafka. For brevity of this demo, the same Azure Event Hub is used to connect, but this time through Kafka API of Azure Event Hub. 
So what will change? - Only the input binding.
Delete the Azure Event Hub Input binding spec in kubernetes. 
<pre><code>kubectl delete -f yamls/eventhub-input-binding.yaml
</code></pre>Create the <a target="_blank" href="https://github.com/dapr/docs/blob/master/concepts/bindings/specs/kafka.md">Kafka Input binding spec</a> in Kubernetes. Use the below YAML to configure Kafka binding with Azure Event Hub Connection String and Namespace.
BROKER_URL=EVENT_HUB_NAME.servicebus.windows.net:9093
EVENTHUB_NAMESPACE= EventHub Namespace Name
CONNECTION_STRING= EventHub Connection String
<pre><code class="lang-yaml">apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: receive-event
spec:
 type: bindings.kafka
 metadata:
 - name: brokers
 value: BROKER_URL # replace
 - name: topics
 value: EVENTHUB_NAMESPACE # replace
 - name: consumerGroup
 value: $Default
 - name: authRequired
 value: "true"
 - name: saslUsername
 value: $ConnectionString
 - name: saslPassword
 value: CONNECTION_STRING # Replace
</code></pre>
Run the eventhub-producer application to see you got the below output from Kafka Input binding spec. 
You should see the output like below
<pre><code class="lang-bash">// eventhub-producer
Sending event: Order received
Sending event: Being prepared
Sending event: On the way
Sending event: Delivered
</code></pre>
<pre><code class="lang-bash">// eventhub-consumer kubernetes logs
Kafka consumer app listening on port 3000!
{ msg: 'Order received' }
{ msg: 'Being prepared' }
{ msg: 'On the way' }
{ msg: 'Delivered' }
</code></pre>
<h2 id="conclusion">Conclusion</h2>
In this post, you saw how to use Dapr bindings to connect Azure Event Hubs and the portability of using different binding specs without changing the application code. 
Stay tuned for more posts on Dapr and Kubernetes. Like, follow and comment, DM me at my <a target="_blank" href="https://twitter.com/ksivamuthu">Twitter @ksivamuthu</a>, your feedback is most welcome.

In this blog post, I will walk through how to integrate Dapr - Distributed application runtime in Kubernetes with Azure Event Hubs.
What is Dapr?
Dapr is a portable, event-driven runtime that makes it easy for developers to build resilient, microserv...

Event-Driven App with Dapr & Azure Event Hubs

<ul>
<li><a class="post-section-overview" href="#Overview">Overview</a></li>
<li><a class="post-section-overview" href="#Getting-Started">Getting Started</a><ul>
<li><a class="post-section-overview" href="#Install-Pulumi-CLI">Install Pulumi CLI</a></li>
<li><a class="post-section-overview" href="#Prerequisites">Prerequisites</a></li>
</ul>
</li>
<li><a class="post-section-overview" href="#Create-a-new-EKS-cluster">Create a new EKS cluster</a></li>
<li><a class="post-section-overview" href="#Setting-up-NGINX-Ingress-Controller">Setting up NGINX Ingress Controller</a></li>
<li><a class="post-section-overview" href="#Deploy-Node-RED-in-Cluster">Deploy Node-RED in Cluster</a></li>
<li><a class="post-section-overview" href="#Thoughts--Conclusion">Thoughts &amp; Conclusion</a></li>
</ul>
<h2 id="overview">Overview</h2>
I'm going to share my initial thoughts and impressions of <a target="_blank" href="https://pulumi.io">Pulumi</a> on coding infrastructure using Typescript. I have been coding AWS EKS infrastructure recently using Terraform. I really like Terraform how it helps on the building, changing and versioning infrastructure and its portability. It's a great tool with no doubt, but I'm exploring other options including <a target="_blank" href="https://github.com/awslabs/aws-cdk">AWS CDK</a> which are more convenient to code in my favorite language (Javascript/Typescript) instead of YAML or DSLs (Domain Specific Language) and multi-cloud infrastructure coding.
I come across <a target="_blank" href="https://pulumi.io">Pulumi</a> - a tool to code infrastructure using Typescript. Pulumi's SDK is fully open source and extensible, enabling you to participate in a rich ecosystem of libraries that ease common tasks, ranging from containers to serverless to infrastructure, and everything in between. 
In this post, let's walk through how to get started with Pulumi and create the AWS EKS infrastructure and deploy Node-Red - Flow-based programming for the Internet of Things (IoT) in Kubernetes cluster.
<h2 id="getting-started">Getting Started</h2>
<h3 id="install-pulumi-cli">Install Pulumi CLI</h3>
To get started, you've to install the <a target="_blank" href="https://pulumi.io">Pulumi</a> CLI tool. If you are using macOS, you can use homebrew to install it.
<pre><code class="lang-bash">$ brew install pulumi
</code></pre>
If you want to install it in Linux​ run the below script to install.
<pre><code class="lang-bash">$ curl -fsSL https://get.pulumi.com | sh
</code></pre>
or run the below script in Cmd to install it in Windows.
<pre><code class="lang-bash">@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://get.pulumi.com/install.ps1'))" &amp;&amp; SET "PATH=%PATH%;%USERPROFILE%\.pulumi\bin"
</code></pre>
Once installed, print the version of pulumi to verify everything is in working order by running the pulumi CLI:
<pre><code class="lang-bash">$ pulumi version
</code></pre>
<h3 id="prerequisites">Prerequisites</h3>
Install other prerequisites to create AWS EKS and develop the infrastructure using Typescript.
<ul>
<li>Install <a target="_blank" href="https://nodejs.org/en/download/">NodeJS</a> (10.x or later)</li>
<li>Install <a target="_blank" href="(https://nodejs.org/en/download/">npm</a>) - NodeJS Package Manager</li>
<li>Install &amp; Configure <a target="_blank" href="https://aws.amazon.com/cli/">AWS CLI</a></li>
<li>Install <a target="_blank" href="https://github.com/kubernetes-sigs/aws-iam-authenticator">AWS IAM Authenticiator</a> for Kubernetes</li>
</ul>
<hr />
The sample code used in this blog post is in this repo:
{% github ksivamuthu/eks-pulumi-demo %}
<h2 id="create-a-new-eks-cluster">Create a new EKS cluster</h2>
<ul>
<li>Create an empty project with <code>pulumi new</code> and choose a template <code>aws-typescript</code> to create a minimal AWS Typescript Pulumi program.
<pre><code class="lang-bash">$ pulumi new
</code></pre>
</li>
<li>Install required package.json dependencies.
<pre><code class="lang-bash">$ npm install --save @pulumi/eks @pulumi/kubernetes
</code></pre>
</li>
<li>Add the below code in <code>index.ts</code>
```typescript
import as pulumi from "@pulumi/pulumi";
import as eks from "@pulumi/eks";
import as awsx from "@pulumi/awsx";
import as k8s from "@pulumi/kubernetes";
</li>
</ul>
const name = "smart-iot";
const vpc = new awsx.ec2.Vpc("vpc", { subnets: [{ type: "public" }] });
const cluster = new eks.Cluster(name, {
 vpcId: vpc.id,
 subnetIds: vpc.publicSubnetIds,
 desiredCapacity: 2,
 minSize: 1,
 maxSize: 2,
 storageClasses: "gp2",
 deployDashboard: false,
});
// Export the clusters' kubeconfig.
export const kubeconfig = cluster.kubeconfig
<pre><code>
* To preview and deploy changes, run `pulumi up` and select “yes.” The up sub-command shows a preview of the resources that will be created and prompts on whether to proceed with the deployment.

* To access your EKS cluster using kubectl, we need to set up the kubeconfig file and download kubectl
```bash
$ pulumi stack output kubeconfig &gt; kubeconfig
$ export KUBECONFIG=`pwd`/kubeconfig

$ kubectl version
$ kubectl cluster-info
$ kubectl get nodes
</code></pre>Now, our EKS cluster is ready. Now let's deploy nginx-ingress controller to setup and ingress.
<h2 id="setting-up-nginx-ingress-controller">Setting up NGINX Ingress Controller</h2>
Install <code>nginx-ingress</code> helm chart to bootstrap an nginx-ingress deployment on a Kubernetes cluster using the Helm package manager. Just add helm chart resource options using the Pulumi Kubernetes provider pointing at the newly provisioned EKS cluster.
<pre><code class="lang-ts">const resourceOptions: ComponentResourceOptions = {
 providers: { kubernetes: cluster.provider }
};

const nginxIngressChartOpts = {
 repo: 'stable',
 chart: 'nginx-ingress'
};

const nginxIngress = new k8s.helm.v2.Chart('nginx-ingress', nginxIngressChartOpts, resourceOptions);
</code></pre>
Get the ingress URL and export it to pulumi output.
<pre><code class="lang-ts">export const appUrl = nginxIngress.getResourceProperty('v1/Service', 'nginx-ingress-controller', 'status')
 .apply(status =&gt; status.loadBalancer.ingress[0].hostname);
</code></pre>
<h2 id="deploy-node-red-in-cluster">Deploy Node-RED in Cluster</h2>
Node-RED is a programming tool for wiring together hardware devices, APIs, and online services in new and exciting ways. It provides a browser-based editor that makes it easy to wire together flows using the full range of nodes in the palette that can be deployed to its runtime in a single click.
Node-RED helm chart ( not maintained by node-red ) is available at helm charts stable repository.
<pre><code class="lang-ts">const chartOpts = {
 repo: 'stable',
 chart: 'node-red',
 values: {
 config: {
 timezone: 'America/New_York'
 },
 ingress: {
 enabled: true,
 hosts: ['*.elb.amazonaws.com']
 }
 }
};

const nodeRed = new k8s.helm.v2.Chart('node-red', chartOpts, resourceOptions);
</code></pre>
To preview and deploy the updated changes, run <code>pulumi up</code> and select “yes.” The up sub-command shows a preview of the resources that is created.
Get the app URL of the node-red using by running pulumi stack output command.
<pre><code class="lang-bash">$ pulumi stack output appUrl
</code></pre>
You can navigate to the app URL to see the Node-RED application running in kubernetes cluster.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1605923141004/D9x1RU-4d.png" alt />
<h2 id="thoughts-and-conclusion">Thoughts &amp; Conclusion</h2>
And, that's the overall code for creating EKS Cluster, setting up ingress controller and Node-RED application in EKS cluster. The primary lift of EKS cluster is magically done on <code>@pulumi/eks</code> and <code>@pulumi/awsx</code> Pulumi Crosswalk for AWS. As in terraform, Pulumi also supports local and remote backends to store your <a target="_blank" href="https://pulumi.io/reference/state/">state</a>. Finally, you are going to code the infrastructure​ in your favorite language, that is awesome.
You should give it a try Pulumi, build your infrastructure using Typescript/Javascript.

Overview
Getting Started
Install Pulumi CLI
Prerequisites


Create a new EKS cluster
Setting up NGINX Ingress Controller
Deploy Node-RED in Cluster
Thoughts & Conclusion

Overview
I'm going to share my initial thoughts and impressions of Pulumi on co...

Pulumi - Coding Infrastructure in Typescript

Cover image by: <a href="https://unsplash.com/@kaip?utm_medium=referral&amp;utm_campaign=photographer-credit&amp;utm_content=creditBadge" target="_blank">unsplash-logoKai Pilger</a>
<h2 id="overview">Overview</h2>
I recently started exploring ChirpSDK - SDK for transmitting data through audio when I explore one of the non-internet or less costly hardware options for IoT solutions to transmit the data. 
Chirp enables your apps to send and receive information using sound. A "chirp" encodes an array of bytes as an audio signal, which can be transmitted by any device with a speaker and received by any device with a microphone and Chirp SDK. It is designed to be robust over distances of several meters, and in noisy, everyday environments.
As the transmission takes place entirely via audio signals, no internet connection or prior pairing is required, and any device within hearing range can receive the data.
To keep it simple and fun, this demo project is developed in my <a target="_blank" href="https://twitch/tv/ksivamuthu">twitch streams</a> with this solution.
<h2 id="what-does-this-demo-app-do">What does this demo app do?</h2>
The idea of the project is we are going to send the data from mobile to another device through audio.
I've built this Flutter application that has a list of dev brand main colors. For e.g
<ul>
<li>Angular Red</li>
<li>React Blue</li>
<li>Vue Green</li>
<li>Chirp Yellow</li>
</ul>
When you tap one of the list items, the app is sending the HEX value of the color through the audio. Then the python application running in my machine receives the audio through a microphone, decodes the HEX value. Then it's calling Philips HUE Bridge API to set the color of the light.
If you tap the "Angular Red" list item, you can hear the audio and the python program receives and sets the light bulb color to the red.
<ul>
<li>Repository of the project:
<a target="_blank" href="https://github.com/ksivamuthu/chirp-flutter-dev-colors">Chirp Flutter Dev Colors</a>
{%twitter 1139635690143133696 %}
</li>
<li>Screenshot of the app:
</li>
</ul>
<img src="https://raw.githubusercontent.com/ksivamuthu/chirp-flutter-dev-colors/master/docs/screenshot.jpg" /><img />
<ul>
<li>Me pointing how the color of the light changed:</li>
</ul>
<img src="https://img.youtube.com/vi/XvyMYcOwpY8/maxresdefault.jpg" /><img />
<h2 id="prerequisites">Prerequisites</h2>
<ul>
<li><a target="_blank" href="https://flutter.dev/docs">Flutter</a></li>
<li><a target="_blank" href="https://developers.chirp.io">Chirp SDK</a></li>
<li><a target="_blank" href="https://code.visualstudio.com">VSCode</a> &amp; <a target="_blank" href="https://marketplace.visualstudio.com/items?itemName=Dart-Code.flutter">VSCode Flutter Extension</a></li>
<li><a target="_blank" href="https://www.python.org/downloads/">Python</a></li>
<li><a target="_blank" href="https://www2.meethue.com/en-us">Philips Hue Light Bulb &amp; Hue Smart Bridge</a> **</li>
<li>Mobile device - iOS or Android</li>
</ul>
<blockquote>
** You can use other bulbs or models. You might need to update the code to call the API of the light you are using.
</blockquote>
<h2 id="getting-started">Getting Started</h2>
<h3 id="configure-your-chirp-applications">Configure your Chirp Applications.</h3>
Signup/Login into <a target="_blank" href="https://developers.chirp.io">Chirp SDK Developer Portal</a>. To configure your chirp app, navigate to the <a target="_blank" href="https://developers.chirp.io/applications">applications</a> page and select a protocol. Take a note of the key, secret and config string. We need this to configure chirp SDK later in the app.
<h3 id="configure-your-wireless-light-bulb">Configure your Wireless Light Bulb</h3>
I've used Philips Hue Light Bulb and Philips Smart Bridge here.

<img src="https://thepracticaldev.s3.amazonaws.com/i/dk5ugts6c3e8hjl56os3.jpg" />
<img src="https://thepracticaldev.s3.amazonaws.com/i/txr43txo6jo4wwxcsukl.jpg" />


Please follow the instruction in <a target="_blank" href="https://developers.meethue.com/develop/get-started-2/">meethue developers page</a> to set up your bridge and connect your light bulb in your local WiFi Network.
<h3 id="flutter-project">Flutter Project</h3>
<h4 id="create-a-new-flutter-app">Create a new Flutter app</h4>
<ul>
<li>Create a flutter project.</li>
</ul>
<pre><code class="lang-bash">flutter create chirp_fluter_light
</code></pre>
<ul>
<li>Navigate the chirp_flutter_light directory and run "flutter run" or use VSCode to run the flutter app. </li>
</ul>
<pre><code class="lang-bash">cd chirp_flutter_light
flutter run ios
</code></pre>
<h4 id="add-chirpsdk-in-pubspecyaml">Add ChirpSDK in pubspec.yaml</h4>
<ul>
<li>To get started with Chirp in your own Flutter app, just add the plugin to your pubspec.yaml.</li>
</ul>
<pre><code class="lang-yaml">dependencies:
 flutter:
 sdk: flutter
 chirpsdk: ^0.1.0
</code></pre>
<h4 id="configure-chirpsdk">Configure ChirpSDK</h4>
<ul>
<li>To configure the SDK you will need to copy your app_key, app_secret, and app_config from the applications page and set this in main.dart file</li>
</ul>
<pre><code class="lang-dart">String _appKey = '&lt;Chirp_App_Key&gt;';
String _appSecret = '&lt;Chirp_App_Secret&gt;';
String _appConfig = '&lt;Chirp_App_Config&gt;';
</code></pre>
<h4 id="implement-chirpsdk">Implement ChirpSDK</h4>
<ul>
<li>Create some asynchronous functions to make calls to the SDK. ChirpSDK for Flutter uses platform channels to pass messages to the native iOS/Android SDKs. </li>
</ul>
<pre><code class="lang-dart"> Future&lt;void&gt; _initChirp() async {
 await ChirpSDK.init(_appKey, _appSecret);
 }

 Future&lt;void&gt; _configureChirp() async {
 await ChirpSDK.setConfig(_appConfig);
 }

 Future&lt;void&gt; _startAudioProcessing() async {
 await ChirpSDK.start();
 }

 Future&lt;void&gt; _stopAudioProcessing() async {
 await ChirpSDK.stop();
 }
</code></pre>
<ul>
<li>To send the data through audio, implement the below logic in ListViewItem Tap. </li>
</ul>
<pre><code class="lang-dart">onTap: () async {
 String identifier = '#${info.lightColor.value.toRadixString(16)}';
 var payload = new Uint8List.fromList(identifier.codeUnits);
 await ChirpSDK.send(payload);
 }
</code></pre>
<h4 id="permissions">Permissions:</h4>
ChirpSDK will require permission to use the device's microphone to receive data. Use the <code>simple_permissions</code> plugin to list and request permissions
<pre><code class="lang-yaml">dependencies:
 flutter:
 sdk: flutter
 chirpsdk: ^0.1.0
 simple_permissions: ^0.1.9
</code></pre>
Then create a function to request for microphone permissions within the State. This should be called before initializing the SDK.
<pre><code class="lang-dart">Future&lt;void&gt; _requestPermissions() async {
 bool permission = await SimplePermissions.checkPermission(Permission.RecordAudio);
 if (!permission) {
 await SimplePermissions.requestPermission(Permission.RecordAudio);
 }
}
</code></pre>
Please feel free to refer the Github repository on how the UI is built in this application.
<h3 id="python-program-listen-to-audio">Python program - listen to​ audio</h3>
<ul>
<li>To configure the python SDK you will need to copy your app_key, app_secret, and app_config from the applications page and paste into your ~/.chirprc file.</li>
</ul>
<pre><code>[default]
app_key = xXxXXxxxXXXxxXXXxXxXXxXxx
app_secret = xxXxXXXxXxxXXXxXXXXxXxXxxxXxxxXXxXxXxxxXXxXxXXxXxX
app_config = XxXXXXxXxXxxxXxxxXXxXxXxxxXXxXxXXxXxXxxXxXXXxXxxXXXxXXXXxXxXxxxXxxxXXxXxXxxxXXxXxXXxXxX
</code></pre><ul>
<li>Install the Chirp Python SDK and its dependencies. Please refer this <a target="_blank" href="https://developers.chirp.io/docs/getting-started/python">documentation</a></li>
</ul>
<pre><code class="lang-bash">brew install portaudio libsndfile //macOS
pip3 install sounddevice.whl //Windows

pip3 install chirpsdk
</code></pre>
<ul>
<li>Connect the SDK to start audio processing. When the data is received, the data is received in callbacks. You can call the Hue Bridge API to set the color here. I've used <a target="_blank" href="https://github.com/quentinsf/qhue">qhue</a> to call the Philips Hue Bridge API.</li>
</ul>
<pre><code class="lang-python">class Callbacks(CallbackSet):
 def on_received(self, payload, channel):
 if payload is not None:
 hex = payload.decode('utf-8')
 print('Received: ' + hex)
 // Call the Hue Bridge API here to set the color.
 else:
 print('Decode failed')


chirp = ChirpConnect()
chirp.start(send=True, receive=True)
chirp.set_callbacks(Callbacks())
</code></pre>
<ul>
<li>Run the python program to listen the audio<pre><code class="lang-bash">python3 index.py
</code></pre>
</li>
</ul>
<h2 id="demo">Demo</h2>
You can see the demo in action in below video.
{% youtube XvyMYcOwpY8 %}
<h2 id="action-items-for-you">Action Items for you</h2>
<ul>
<li>Learn Flutter &amp; Explore Chirp SDK
</li>
<li>Be Kind and Spread your awesomeness
</li>
<li>And comment below or create a <a target="_blank" href="https://github.com/ksivamuthu/chirp-flutter-dev-colors/issues">github issue</a> to add your favorite dev brand and its primary color (For e.g Android, Go, etc).
</li>
</ul>
Follow &amp; join me when I'm streaming on <a target="_blank" href="https://twitch.tv/ksivamuthu">Twitch</a> to have fun and learn together. Usually, I live code mobile and IoT solutions in my live streams.

Cover image by: unsplash-logoKai Pilger
Overview
I recently started exploring ChirpSDK - SDK for transmitting data through audio when I explore one of the non-internet or less costly hardware options for IoT solutions to transmit the data. 
Chirp ena...

Exploring Chirp SDK in Flutter - Data over audio

<hr />
title: Terraform - Tillerless Helm Deployment
published: true
description: This blog post explains why installing tiller on kubernetes cluster should not be done, how to install helm charts through locally running tiller server and terraform script to achieve tillerless helm deployment. 
tags: terraform, helm, kubernetes, devops
<h2 id="coverimage-httpsthepracticaldevs3amazonawscomif2xmqp7fe2zte0l0upv6jpg">cover_image: https://thepracticaldev.s3.amazonaws.com/i/f2xmqp7fe2zte0l0upv6.jpg</h2>
The helm package manager for Kubernetes helps you install and manage applications on your Kubernetes cluster. For more information, see the <a target="_blank" href="https://github.com/helm/helm">Helm documentation</a> 
Helm has two major components - Helm client and Tiller server.
As in documentation:
The Helm Client is a command-line client for end users. The client is responsible for the following domains:
<ul>
<li>Local chart development</li>
<li>Managing repositories</li>
<li>Interacting with the Tiller server</li>
<li>Sending charts to be installed</li>
<li>Asking for information about releases</li>
<li>Requesting upgrading or uninstalling of existing releases</li>
</ul>
The Tiller Server is an in-cluster server that interacts with the Helm client, and interfaces with the Kubernetes API server. The server is responsible for the following:
<ul>
<li>Listening for incoming requests from the Helm client</li>
<li>Combining a chart and configuration to build a release</li>
<li>Installing charts into Kubernetes, and then tracking the subsequent release</li>
<li>Upgrading and uninstalling charts by interacting with Kubernetes</li>
</ul>
In a nutshell, the client is responsible for managing charts, and the server is responsible for managing releases.
When you run the tiller server on your cluster, tiller server gets its full Kubernetes administrator permissions. Tiller server becomes an attack vector.
When you run the tiller server on your local machine, users don't inherit the tiller server permissions on the cluster. Instead, tiller inherits the Kubernetes permissions of the end-user. Its the recommended approach on installing helm chart in remote kubernetes cluster without tiller server on cluster.
<h2 id="install-tiller-and-helm-locally">Install tiller &amp; helm locally</h2>
<ul>
<li>Install helm locally using either homebrew on macOS or chocolatey on windows. 
<pre><code class="lang-bash">//macOS
$ brew install kubernetes-helm

//Windows
$ choco install kubernetes-helm

// Linux/Unix script
$ curl -LO https://git.io/get_helm.sh
$ chmod 700 get_helm.sh
$ ./get_helm.sh
</code></pre>
</li>
<li>Create a namespace called tiller with the following command.
<pre><code>kubectl create namespace tiller
</code></pre></li>
<li>Set the TILLER_NAMESPACE environment variable to the tiller.
<pre><code>export TILLER_NAMESPACE=tiller
</code></pre></li>
<li>Start the tiller server locally
<pre><code>tiller -listen=localhost:44134 -storage=secret
</code></pre></li>
<li>Initialize Helm client with --client-only flag to make sure, the tiller is not installed in kubernetes cluster
</li>
</ul>
<pre><code>export HELM_HOST=:44134
helm init --client-only
</code></pre><ul>
<li>Verify that helm is communicating with the tiller server properly.</li>
</ul>
<pre><code>helm repo update
</code></pre>At this point, you can run any helm commands in your helm client terminal window (such as helm install chart_name) to install, modify, delete, or query Helm charts in your cluster. 
<h2 id="helm-tiller-plugin">Helm Tiller Plugin</h2>
Rimas Mocevicius has developed a helm <a target="_blank" href="https://github.com/rimusz/helm-tiller">plugin</a> for this purpose. See the <a target="_blank" href="https://rimusz.net/tillerless-helm">blog post</a> for more details. 
<pre><code>$ helm plugin install https://github.com/rimusz/helm-tiller
</code></pre>It has commands such as <code>start</code>, <code>start-ci</code> &amp; <code>stop</code>
<code>start</code> command starts the tiller server. <code>start-ci</code> command is used to start the tiller server and ci environments. <code>stop</code> command stops the tiller server.
See more commands of this helm tiller plugin in its <a target="_blank" href="https://github.com/rimusz/helm-tiller">github documentation</a>
<h2 id="terraform-script-to-do-tillerless-helm-deployment">Terraform script to do tillerless helm deployment</h2>
The setup below is to use tiller server running on localhost with the <code>terraform-helm-provider</code> 
The helm-tiller plugin <code>start-ci</code> command is used for starting tiller on localhost, is invoked via local-exec provisioner resource.
Helm provider is configured with tiller server host as localhost:44134 and set <code>install_tiller</code> to false to not install tiller server in kubernetes cluster.
Running the terraform script spins the tiller server and install helm chart in kubernetes cluster configured in helm provider.
<pre><code>resource "null_resource" "tiller" {
 provisioner "local-exec" {
 command = "export KUBECONFIG=${var.kubeconfig_path} &amp;&amp; helm tiller start-ci &amp;"
 }
}

provider "helm" {
 host = "127.0.0.1:44134"
 install_tiller = false

 kubernetes {
 host = "${var.cluster_endpoint}"
 config_path = "${var.kubeconfig_path}"
 }
}

resource "helm_release" "redis" {
 name = "redis"
 chart = "stable/redis"
}
</code></pre><h2 id="wrap-up">Wrap Up</h2>
Helm v3 should be Tillerless. You can read the Helm v3 Design Proposal <a target="_blank" href="https://github.com/helm/community/blob/master/helm-v3/000-helm-v3.md">here</a>. The helm-tiller plugin and terraform script that uses helm-tiller commands to start the tiller server on localhost helps to do deployments securely on the Helm v2 release.
Happy coding and hope this post helps on setting up terraform script for tillerless helm deployment.

title: Terraform - Tillerless Helm Deployment
published: true
description: This blog post explains why installing tiller on kubernetes cluster should not be done, how to install helm charts through locally running tiller server and terraform script t...

All Posts