The Althoff Chronicles

Node Authorization in k8s I'm starting to get into the container world and I'm loving it. Recently we helped a client build out and deploy a micro-services application in Kubernetes. We created the cluster in Azure using the open source project  acs-engine . After we got the cluster set up, our client asked for some updates to the cluster for security reasons. One of those updates was to enable Node Authorization . What is Node Authorization? Node Authorization locks down each Node in the cluster to only be able to do actions on itself. If this is not turned on, its possible for a malicious pod to take actions on any other node, including reading secrets, deleting pods, etc. There is an excellent post by Antoine Cotten that explains this very well ( as well as RBAC, which is a different subject altogether). How do I set it up? Based on the current documentation, it looks like setting up Node Authorization should be easy. Basically follow these steps Turn on TLS ...

This week I was trying to containerize an existing java application. Part of "installing" the application  on the container required executing an PowerShell script in the container during the Image build. Based on the documentation here  I thought i could add the following command to my dockerfile and it would work: RUN install.ps1 However, when I went to build the image, it just hung on that step. I tried several other variations of the run command including: RUN ["Powershell", ".\install.ps1"] which resulted in the following error: '["Powershell"' is not recognized as an internal or external command,operable program or batch file. RUN ["Powershell.exe", ".\install.ps1"] which returned the same error as above. I was about to give up and move the PowerShell commands from the .ps1 file directly into the dockerfile itself as described here , but I had an "A HA!" moment and decided to give a simpler a...

There has been quite a lot of talk about security concerns as it relates to IOT devices and security. Businesses want to make sure that they are not opening themselves up to a ton of risk as they expand their data streams and to increase productivity. Thankfully Azure IOT suite makes securely connecting your IOT devices to the cloud quick and easy. Before we get too far, its important to explain exactly what IOT security means: IOT Security In its simplest form, IOT security is broken down into zones and trust boundaries. Typically the zones are defined as follows: Devices – IOT devices that capture and send data Field Gateway – Devices that can aggregate data to and from devices Cloud Gateways – Endpoint that receives / sends data and commands to Field Gateways or directly do devices Services – The services that “do work” on the data that is received from the IOT devices (via the gateways) Trust boundaries are where data moves between zones. During this movement ac...

This week i had to create a few new users for a SQL Azure database. I have to do this often, but I can never remember the exact steps that need to be run. If you've connected to a SQL Azure instance, you'll quickly see that some of the useful UI Options don't exist or work differently. For example, if you want to add a new user, you get a SQL script that just creates the user, but doesn't give them any access to the database: SQL: In order to actually give the user access to a database, you need to switch your connection to the database you want to the user to access and run the following command: CREATE USER [UserName] FOR LOGIN [ UserName] WITH DEFAULT_SCHEMA = dbo GO -- Add user to the database owner role EXEC sp_addrolemember N'db_owner', N'[ UserName] ' GO You can switch out the default schema and role to whatever fits your needs. After all of that, the user should work, but if you try to connect from SQL Mg...

I recently ran into an issue when trying to restart an Azure App Service from PowerShell. The command to do it is Restart-AzureWebsite , but when I attempted to run it, I got the following error: “Restart-AzureWebsite : Your Azure credentials have not been set up or have expired, please run Add-AzureAccount to set up your Azure credentials” I ran the Add-AzureAccount command but I continued to get the same error. After some digging I realized that I had more than 1 Azure subscription and the command was using the wrong one when attempting to restart the website. I ran the following command to retrieve the subscriptions that are cached on my PC: Get-AzureSubscription That returns all of the subscriptions for all of the accounts that you’ve added from Azure. I found the subscription that was correct for the website I was attempting to restart and then ran this command: Select-AzureSubscription -SubscriptionName "MySubscription" That set the sub...

For one of my current projects, we had a requirement to create track changes made to two tables in the database for auditing purposes. Initially I thought we could just use the built in SQL change tracking features ( here ), however we were deploying this application to Azure and as of now, that feature is not available in SQL Azure. I did some investigating into this and there were a few options: Option 1: Create my own triggers on these tables and write data to the audit tables when the rows were updated. This was some what straight forward, but I’m not a fan of triggers and I wanted to keep all of my code in C#/Entity Framework for ease of code management down the road. Also, I didn’t want to have to update the triggers when the table was altered Option 2: Implement this work around leveraging a Local data cache While this seems like an easier approach, I wouldn’t be fully in control of what was happening during updates. Also, this approach only tells you what rows have cha...

  One on of my current projects, we’re leveraging the Sitefinity CMS for our front end. Initially the setup went really smoothly and I was off to the races. There is a ton to learn and a lot of the functionality is fairly intuitive. I was super excited about it until I tried to deploy some code updates to our Development/Integration Server. We had already created a site on the development server directly and I didn’t need any of the content that I had created locally, so I figured it would be as easy as moving my code out to the DEV server. When I did this and went to fire up the site, I got a blank Login screen: We went back and reviewed the windows roles/features that need to be turned on and everything seemed to look fine. I recopied the code over and over with no success. Finally we did a folder compare between the initially deployed site on the DEV server and the code that I had moved. The only thing noticeable was that the GUID’s in some of the configuration files where...

Building and deploying a web service or website via TFS is pretty straight forward, but automatically deploying a windows service or console application takes a b it of setup. I’ve outlined the steps below to get your service deployed. Step 1: Set up Automated Build and MSDeploy on the Target server. If you are doing any sort of automated build/deploy I recommend using MSDeploy. You can follow steps 1-3 from a previous post here . Step 2: Edit the .csproj file The project file for the app you are trying to deploy needs to be edited so that TFS will create a directory for the output of the project. Otherwise the project will be built, but the assemblies will be placed in the code drop location with no organization to it. To edit the file, go to the open file dialog and locate the csproj file. Select it but don’t click “Open. Instead click on the dropdown arrow next to the Open button, select “Open with”, and choose the XML (Text) editor as shown: Once the file is open, add the fo...

We’ve all been there before. We set up our new web or application server with the latest code, update the connection strings with the proper SQL Server instance and password and fire up the application only to see all sorts of SQL connection/login issues.  These issues can be very frustrating to troubleshoot because you are not sure if the Login is incorrect, the db is spelled incorrectly or if there are network issues preventing you from seeing the SQL Server. On windows machines, there is a simple way to validate that the SQL server is accessible from the server. Remote desktop into the server having connection issues Click on “Start” and search for Folder Options. Click on Folder options, go to the View tab and validate that the “Hide extensions for known file types” is unchecked:   Go to the desktop, right click and select New –> Text Document Rename the file connection.udl and accept the rename warning Double click on the udl file and it will open the Data Li...

We recently migrated a production environment for a client to new Servers. I had previously been using MSDeploy to deploy the websites/services to the servers so I figured all I had to do was install MSDeploy, point Update my deploy scripts to point to the new servers, and deploy! I was using MSDeploy 2 on the previous servers so I figured it would work on the new ones. Unfortunately it didn’t turn out to be that easy. When I ran the updated scripts I got the following error: Fatal: Request to remote agent URL ' http://myserver/MSDEPLOYAGENTSERVICE ' failed. Fatal: The remote server returned an error: (401) Unauthorized. Fatal count: 1 I was using an admin account and I could hit that URL above in a browser so I knew it wasn’t an authorization issue. Here are the things I tried that DIDN’T work: Uninstall/Reinstall MSDeploy 2 Install MSDeploy 3 Create the fake user group on the server per these instructions: http://www.iis.net/learn/publish/troubleshooting-web-dep...

  Recently, We had a website that didn’t have frequent visitors, but when the visitors did come, the website would take a long time to load up the first time. This is expected behavior because IIS shuts down its worker threads. 1 approach would be to set the IdleTimeout to 0 which means the threads are never aborted (details here: http://technet.microsoft.com/en-us/library/cc771956(v=ws.10).aspx ). Instead of that though I decided to try my hand at PowerShell and came up with the following script: 1: # List of URLS to Ping 2: $urls = @( "Http://URL1.com" , "https://URL2.com" ) 3:   4: #Ping all URLs in the list 5: foreach ($objItem in $urls) { 6: $req=[system.Net.HttpWebRequest]::Create($objItem); 7: $res = $req.getresponse(); 8: $stat = $res.statuscode; 9: $res.Close(); 10: 11: #Pump it out to a text file 12: $res | Out-File pingresults.txt -append 13: } After that I set up a simple ...

  Ever want to add a control to the design surface, but you have so many controls that you have a difficult time finding them? I was shown this neat shortcut that has saved me a lot of time over the past few days. Click on the toolbox or use the Hotkey Alt+Ctrl+x Start typing the name of the control. The control will be highlighted If you have multiple controls that match the text, hit Tab to go to the next one. Simple and easy!

At my company we are in the process of migrating to a new TFS environment. As part of that we wanted to do some house cleaning and only migrate the projects that have been used recently. We’ve got a lot of clients, each with their own project that have been created over the past 3 years. We wanted an easy way to see what the latest activity was on the project. That will give us a good view into what projects can be archived and which ones need to be moved. I could have just gone to Source Control and did a “view history” for each project, but that would have taken a long time (and be very tedious). Instead I wrote a simple console app that digs into each project collection and project and exports some simple project/Check-in data to a CSV file. I can then open up the CSV in Excel and add other info like “Code Status”, and “Migration Status” easily. Here is the code I used. This is a pretty basic example and TFS provides a lot more, but it did what I needed it to. As I always say, Ke...

  When I first started deploying code from TFS I took the simple approach and created a batch file and deployed the websites via RoboCopy. I’m a very “Keep it simple” kind of guy, so this worked for us for a long time and so nothing was changed. With my most recent project however, we were deploying code over a slow VPN tunnel from our servers in Chicago to servers located in Europe. Due to this, the RoboCopy was taking over 4.5 hours to complete. I needed a better/faster way so I started looking into Web Deploy (MSDeploy). I was able to get it working fairly easily and I was pleasantly surprised how easy it was to get it working, and how much time its saved me! I can now deploy the code in less than 20 minutes! I’ve outlined the process in detail below, but in general you only need to do this: Add MSBuild parameters to your automated build Customize the deployment parameters for the website Create a batch file to an auto-generated MSDeploy script Execute the batch file fro...

We’ve all run into this issue before. We have a backup of a database that we need to restore into a DEV/QA environment, but when we attempt to restore, we get the “ System.Data.SqlClient.SqlError:  Exclusive access could not be obtained because the database is in use ” This error can be very frustrating to get around and a person can spend a LONG time trying to kill all of the attached queries/threads. I know I’ve (almost) lost my sanity on more than 1 occasiaion trying to do this. The good news is that I’ve found a simple/easy way to restore a backup when the database is in use Steps: Setting the database to single user (you!) restore the backup set it back to multiuser Here is the SQL Script I use. Simple and fast. Enjoy!

  In a recent post, I mentioned one of the advantages of using Entity Framework in your application is that you can build a generic repository class very easily. Of course, its not realistic to think that all access to the data will be a single table at a time. Most often it’s the case where you need to return data that spans multiple tables. I’m  going to show you how I created a simple repository class that spans tables. Creating the Summary/DTO Object The first thing I like to start with is to create the simple POCO object that will be used to transport the data. This is essential to define first so that you do not get caught up in data structures, but instead define the data as the application is going to need it. In the case with my database, I have a table called “Avail” that contains a ton of foreign keys to a contact table. I needed to display this data, but instead of a bunch of foreign keys, I needed to display the actual names of people. etc. I ended up defini...