July 2019 Summaries

Managing secret configuration values in .NET Core applications running in Azure is crucial for application security, particularly when sensitive data such as API keys and connection strings are involved. Various methods for managing these secrets include hard-coding them in the application, using configuration files, environment variables, and leveraging Azure services such as Azure Key Vault and Managed Identities. Hard-coding secrets poses significant risks, especially with version control systems that might expose them inadvertently. Configuration files like appsettings.json can segregate development and production settings, but still risk accidental exposure. Environment variables offer an alternative by allowing CI/CD systems to inject secrets during deployment, while Azure Key Vault provides a more robust solution by securely storing secrets, which can be accessed by applications via Service Principals or Managed Identities. Managed Identities simplify credential management by automatically handling Service Principal creation and secret rotation. Additionally, integrating Key Vault with Application Settings secures the secret values further by keeping them out of the application code. Role-Based Access Control (RBAC) in Azure can eliminate the need for storing sensitive information by managing permissions directly, offering a highly secure alternative. Infrastructure as Code tools like Pulumi support these practices by facilitating secure configuration management and integration of Azure features, enhancing the overall security and reliability of applications.

Managed Kubernetes services, like Amazon's EKS, simplify cluster management but require additional steps for app lifecycle management. Using Pulumi for Day 2 Kubernetes administration, this guide demonstrates setting up an EKS cluster with node groups and migrating workloads without downtime. Initially, an EKS cluster with two node groups is created to host applications like EchoServer and NGINX Ingress Controller. The process involves defining infrastructure dependencies with Crosswalk for AWS and deploying workloads using Pulumi. The guide then explores migrating NGINX to a new node group with an updated configuration, ensuring continuous operation during the transition. Pulumi's code-driven approach facilitates the management of Kubernetes infrastructure, offering benefits such as simplified resource management and adherence to best practices. The document emphasizes conducting load tests to ensure no requests are lost during the migration and provides steps for decommissioning unused node groups, highlighting Pulumi's utility for infrastructure management and application deployment in Kubernetes environments.

Pulumi has introduced support for managing DigitalOcean resources, and this guide demonstrates how to deploy load-balanced Droplets on DigitalOcean using Pulumi with TypeScript. The process involves creating a new Pulumi project, installing the Pulumi DigitalOcean provider, and setting up infrastructure with resource imports. Users can define the number of Droplets and specify the region, utilizing a loop to create web servers with a common user data script for server initialization. Additionally, a public load balancer is configured to forward traffic to the Droplets using tags, eliminating the need to know Droplet IDs. The load balancer's configuration includes forwarding rules and health checks to ensure service availability on port 80. Pulumi facilitates attaching instances by Droplet tag, enhancing ease of management. The setup concludes with the deployment of infrastructure resources, resulting in a functional endpoint accessible via a web browser or command-line tool. Pulumi is open-source and available for use, with ongoing efforts to boost productivity with DigitalOcean.

Last Wednesday, Pulumi HQ in Seattle hosted the July Pulumi Up meetup, bringing together local community members for networking, pizza, and presentations by Pulumi engineers. Despite not being able to attend in person due to travel issues, Paul Stack delivered a remote talk titled "Application code isn't the only code that can have APIs," highlighting how programming languages aid in creating infrastructure code and demonstrating a Pulumi program for an RDS instance. Matt Ellis, the Pulumi API team lead, followed with a presentation on "Automating your troubles away with Webhooks and Pulumi," showcasing a bot he developed using GitHub Webhooks and Pulumi to maintain an up-to-date changelog with every pull request. The event concluded with further networking, discussions, and an invitation to join future meetups or watch the recorded talks on the Pulumi TV YouTube Channel.

The blog post discusses setting up and using the Amazon Elastic File System (EFS) Container Storage Interface (CSI) Driver with Kubernetes workloads on Amazon EKS using Pulumi libraries. It outlines the process of installing the Pulumi CLI, initializing a new project, and creating two Pulumi stacks: one for the EKS cluster and EFS components, and another for the application and its storage resources. The post details steps to create an EKS cluster, configure an EFS endpoint and mount targets, install the EFS CSI Driver components, and deploy a sample application using the EFS volume mounts. The approach ensures high availability and durability by storing data across multiple Availability Zones, leveraging the EFS CSI Driver as a Kubernetes SIG-AWS subproject, and utilizing Pulumi's infrastructure-as-code capabilities to automate the setup.

The blog post discusses the application of test-driven development (TDD) techniques to infrastructure using Node.js with TypeScript, the Mocha test framework, and the Chai assertion library. The focus is on how to test infrastructure components such as an Amazon EKS cluster, ensuring it meets specific criteria like running a particular Kubernetes version and being provisioned inside a private VPC. Using Pulumi's infrastructure-as-code capabilities, tests are embedded alongside code definitions, enabling robust validation and enforcement of team standards and security guidelines. The post provides a step-by-step guide on setting up tests, running them during the deployment process using Pulumi's preview and update commands, and handling potential challenges such as unknown values during previews. This approach allows for catching configuration errors early, leveraging Pulumi's integration with general-purpose programming languages to apply software development best practices to infrastructure management.

Kubernetes Ingress is an API object that facilitates the management of HTTP[s] access to services within a Kubernetes cluster, while the Amazon Elastic Load Balancing Application Load Balancer (ALB) is a service that distributes incoming application traffic across multiple targets like Amazon EC2 instances. The AWS ALB Ingress controller, a subproject of Kubernetes SIG-AWS, automates the creation of an ALB and associated AWS resources when a Kubernetes Ingress resource is declared. The guide provides a step-by-step example of setting up ALB-based Kubernetes Ingress using Pulumi, AWS, and AWSX packages, including initializing a Pulumi project, creating an Elastic Kubernetes Service (EKS) cluster, deploying the AWS ALB Ingress Controller, and deploying a sample application. It highlights the use of Pulumi to manage infrastructure through code and demonstrates deploying an application with traffic routing managed by the ALB, emphasizing the integration of AWS services with Kubernetes to enhance application traffic management.

Pulumi was utilized to build a serverless URL shortener application, leveraging managed Azure services to ensure efficient performance by placing data stores and HTTP endpoints close to end users. Initially, a non-distributed version was created with Cosmos DB for storing URL mappings and Azure Functions to manage HTTP requests. Despite Cosmos DB being more robust than necessary for a simple key-value store, its multi-region capabilities were advantageous for reducing latency in a global setup. The application was extended to multiple Azure regions using Azure Traffic Manager to distribute incoming traffic based on performance, thus optimizing response times. Although this setup improved latency overall, some regions like Tel-Aviv and Brisbane still faced higher response times due to geographical limitations and unexpected routing. The project demonstrated the capabilities of Pulumi and TypeScript in creating scalable, globally distributed applications by integrating cloud services efficiently.