Ivan Mc Kinley ivanthelad

Recommendation when ensuring a workload adheres to automountServiceAccountToken" policy

if using azure policy on aks you can get tripped up with automountServiceAccountToken been violated by most containers

If container does not need to access API

Ensure service account "automountServiceAccountToken: false".
Its not possible to set this on the default SA so the pod spec needs to updated to not mount the credentials.
If using a specific SA. disable automounting on SA level and pod Level
automountServiceAccountToken https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

Ensuring business critical IPs are not deleted by an kubernetes deployments/deletes

Background:

Kubernetes azure cloud provider will dynamically create public IPs when a service of type=Loadbalancer is created. From the Kubernetes cloud provider perspective it owns this dynamically created IP, meaning it is responsible for updates and deletes to this IP. If I delete the service in Kubernetes the cloud provider will cascade the delete by deleting also the Public IP in Azure. (The cloudprovider calls this process reconciliation). Once an IP is deleted in azure it is returned to azures global pool of IP. You have no guarantees that you will get this IP again

This behaviour unfortunately can cause challenges if your application now relies on this public IP and it is accidentally deleted. To ensure a system critical Azure IP is not deleted when modifying deployments in Kubernetes the following steps should be performed.

using the csi secret driver with a private registry

Pull and push images

Images need to be pulled from public repos and pushed to private repo. these will be referenced in the chart late

docker pull   quay.io/k8scsi/csi-node-driver-registrar:v1.2.0
docker pull  us.gcr.io/k8s-artifacts-prod/csi-secrets-store/driver:v0.0.12 
docker pull quay.io/k8scsi/livenessprobe:v2.0.0

docker tag   quay.io/k8scsi/csi-node-driver-registrar:v1.2.0 $IMAGE_REPO/k8scsi/csi-node-driver-registrar:v1.2.0
docker tag  us.gcr.io/k8s-artifacts-prod/csi-secrets-store/driver:v0.0.12 $IMAGE_REPO/k8s-artifacts-prod/csi-secrets-store/driver:v0.0.12

	apiVersion: v1
	kind: Pod
	metadata:
	name: security-context-demo-4
	spec:
	containers:
	- name: sec-ctx-4
	image: nginx:latest
	securityContext:
	privileged: true

	#!/bin/bash
	## neable app insights https://github.com/microsoft/Application-Insights-K8s-Codeless-Attach
	source ./env.sh
	uuid=$(openssl rand -hex 32 \| tr -dc 'a-zA-Z0-9' \| fold -w 5 \| head -n 1)
	clusternameparam=$1
	function isempty ()
	{
	paramname="$1"
	paramvalue="$2"

	{
	"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
	"contentVersion": "1.0.0.0",
	"parameters": {
	"workspacesubscriptionid": {
	"defaultValue": "Insert_Subscription_Id",
	"type": "String",
	"metadata": {
	"description": "Subscription id of the log analytics workspace is deployed. Can be found under 'Log Analytics Workspace -> Overview' "
	}


	#Variables
	location="westus"
	RG_Name="UA-TEST-RG2"
	ASP_Name="UA-TEST-ASP2"
	Web_Name="UA-TEST-Web-1012"
	ACR_Name="UAtestACR2"
	ID_Name="UA-TEST-Identity2"

	#Resource Creation

	FROM locustio/locust:1.4.1
	##e TARGET_URL=http://localhost:8080 runtest:latest
	## can be master, slace, standalone
	## run on ACIU using , where -f i referencing runs/errors.py
	## az container create --registry-username $registry_username --registry-password $registry_password -g $RG --image $IMAGE --ports 8089 5557 -l $LOCATION --name $MASTER_NAME --ip-address public --dns-name-label $DNS_LABEL -e URL=$URL URLPATH=$URLPATH --command-line="locust --master -f ${locustfile} "

	EXPOSE 5557 8089
	## tell the slace how to connect
	#ENV LOCUST_MASTER_HOST=
	ENV URL="http://192.168.1.115:8080"

	---
	apiVersion: v1
	kind: Service
	metadata:
	annotations:
	service.beta.kubernetes.io/azure-load-balancer-internal: "true"
	creationTimestamp: null
	labels:
	run: helloworld
	name: helloworld