Catégorie : Kubernetes (Page 24 of 37)

[English Below]

Bonjour,

Dans cet article, je vais vous présenter comment créer un cluster AKS en utilisant des machines virtuelles de type gen2.

L’avantage d’utiliser des machines de types Gen2 est de pouvoir bénécifier de fonctionnalités de sécurité comme:

•  Intel Software Guard Extensions (Intel SGX)
• virtualized persistent memory (vPMEM)
• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/generation-2

Pour cela, je vous invite à saisir les commandes suivantes depuis Azure Cloud Shell par exemple (https://shell.azure.com)

az feature register --name "Gen2VMPreview" --namespace "Microsoft.ContainerService"    

# wait for the feature to register
az feature show --name Gen2VMPreview --namespace "Microsoft.ContainerService"

# Re-register the AKS namespace by performing the below
az provider register --namespace 'Microsoft.ContainerService'

# Finally create the cluster
az aks create -n aks -g aks -s Standard_D2s_v3 --aks-custom-headers usegen2vm=true

Maxime.

---

Hello,

In this article, I would like to share with you how you can create an AKS cluster with gen2 virtual machines.

With Azure Gen2 Virtual Machines, you can use advance security features like:

•  Intel Software Guard Extensions (Intel SGX)
• virtualized persistent memory (vPMEM)
• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/generation-2

From Azure Cloud Shell (https://shell.azure.com), please use this commands:

az feature register --name "Gen2VMPreview" --namespace "Microsoft.ContainerService"    

# wait for the feature to register
az feature show --name Gen2VMPreview --namespace "Microsoft.ContainerService"

# Re-register the AKS namespace by performing the below
az provider register --namespace 'Microsoft.ContainerService'

# Finally create the cluster
az aks create -n aks -g aks -s Standard_D2s_v3 --aks-custom-headers usegen2vm=true

Maxime.

Hi,

In this article, I would like to share with you a security notice about a new security vulnerability. This vulnerability has been identified in the container networking implementation (CNI) in CNI plugin versions v0.8.6 and older that may affect older AKS clusters.

Details

An AKS cluster configured to use an affected container networking implementation is susceptible to man-in-the-middle (MitM) attacks. By sending “rogue” router advertisements, a malicious container can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker-controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond.

This vulnerability has been given an initial severity of Medium with a score of 6.0.

Vulnerability analysis and verification

All AKS clusters created or upgraded with a Node Image Version later or equal than “2019.04.24” are not vulnerable, as they set net.ipv6.conf.all.accept_ra to 0 and enforce TLS with proper certificate validation.

Clusters created or last upgraded before that date are susceptible to this vulnerability.

You can verify if your current Node Image is vulnerable by running: https://aka.ms/aks/MitM-check-20200601  on a machine that has CLI access to the cluster’s nodes.

Windows nodes are not affected by this vulnerability.

Mitigation

If you identify nodes that are vulnerable, you can mitigate the vulnerability by performing a cluster upgrade using the following command:
$ az aks upgrade -n <cluster name> -g <cluster resource group> -k <newer supported kubernetes version>.

In addition, a permanent fix for this CVE is available at: https://github.com/containernetworking/plugins/releases/tag/v0.8.6 . AKS is rolling out this fix on the most recent VHD version.

Source: https://azure.microsoft.com/en-gb/updates/cni-security-vulnerability-in-older-aks-clusters-and-mitigation-steps/

Maxime.

Salut!

Dans cet article, je vais vous présenter un nouveau concept du monde AKS, les system node pool et les user node pool. Mais avant tout chose, commençons ensemble par redéfinir le concept de Node Pool (pools de nœuds). Ls nœuds (node) d’une même configuration sont regroupés dans des pools de nœuds. Ces pools de nœuds contiennent les machines virtuelles sous-jacentes qui vont exécuter vos containers.

Un cluster AKS peut supporter plusieurs Node Pools, on retrouve plus souvent des architectures ou les node pools sont utilisés pour segmenter les applications critiques ou encore les application utilisants des ressources matériels spécifiques comme des GPUs.

Il est désormais possible de créer deux nouveaux types de node pools:

• Node Pool System: Ce premier type de node pool va héberger l’ensemble des pods nécessaires au bon fonctionnement du cluster, c’est à dire Tunnelfront ou encore CoreDNS.

• Node Pool User: Second type de node pool va héberger les pods de vos applications.

Si vous créer un cluster AKS, avec un seul node pool, ce node pool sera de type système. Il hébergera vos l’ensemble des pods nécessaire au bon fonctionnement du cluster ainsi que les pods de vos applications.

Dans ce premier exemple, nous allons créer un node pool de type system au sein d’un cluster AKS existant.

# - Add AKS Node Pool System to an existing AKS cluster
az aks nodepool add -g myResourceGroup --cluster-name myAKSCluster -n mynodepool --mode system

# - Show Node Pool Spec
az aks nodepool show -g myResourceGroup --cluster-name myAKSCluster -n mynodepool

Dans ce second exemple, nous allons créer un node pool de type user au sein d’un cluster AKS existiant.

# - Add AKS Node Pool System to an existing AKS cluster
az aks nodepool add -g myResourceGroup --cluster-name myAKSCluster -n mynodepool --mode user

# - Show Node Pool Spec
az aks nodepool show -g myResourceGroup --cluster-name myAKSCluster -n mynodepool

Maxime.

---

Hello,

In this article I would like share with you a new AKS concept: System Node Pool and User Mode Pool.

System node pools and user node pools are two different node pool modes for your AKS clusters.

• System node pools serve the primary purpose of hosting critical system pods such as CoreDNS and tunnelfront.
• User node pools serve the primary purpose of hosting your application pods.

However, application pods can be scheduled on system node pools if you wish to only have one pool in your AKS cluster. Every AKS cluster must contain at least one system node pool with at least one node.

In this first example, we will create system node pool inside our existing AKS cluster.

# - Add AKS Node Pool System to an existing AKS cluster
az aks nodepool add -g myResourceGroup --cluster-name myAKSCluster -n mynodepool --mode system

# - Show Node Pool Spec
az aks nodepool show -g myResourceGroup --cluster-name myAKSCluster -n mynodepool

In this second example, we will create user node pool inside our existing AKS cluster.

# - Add AKS Node Pool System to an existing AKS cluster
az aks nodepool add -g myResourceGroup --cluster-name myAKSCluster -n mynodepool --mode user

# - Show Node Pool Spec
az aks nodepool show -g myResourceGroup --cluster-name myAKSCluster -n mynodepool

Maxime.