Reduce Wastages for Non Prod Environment

Hi and welcome back to my blog

It's roughly two years since I last blogged, and during that period, I've been busy with family and personal matters. But today I got some time to spare and share

As cloud engineers, platform engineers, or simply "cloud magicians" such as myself, we've seen the shift: more workloads in the cloud means more to manage. And yes, with that comes more cloud consumption.

Increased workload equals increased consumption and it does to some extent. With a new mindset, however, comes FinOps.

What is FinOps?

FinOps is an operational framework and cultural practice which maximizes the business value of cloud and technology, enables timely data-driven decision making, and creates financial accountability through collaboration between engineering, finance, and business teams.  (https://www.finops.org/introduction/what-is-finops/)

As we are able to appreciate the cloud's scalability and elasticity, we should also be cautious with costs. Non-prod environments are ideal for this kind of optimization for the following reasons:

1 . Multiple Environments of “Non Prod”

Most companies have multiple non-prod environment (SIT, UAT, PreProd)

2. Internal Use Only

These kinds of systems are typically internal-facing, and therefore scheduled downtime after work hours does not impact end-users.

3. Freedom to Experiment

You can try out optimization methods without committing your App teams or affecting production workloads.

The Goal: 🠟 Wastage 🠟 Cost 

1. Run Only During Working Hours

Instead of running services 24/7 (730 hours/month), I reduced this to roughly 180 hours/month (Mon to Fri, 9 AM to 6 PM).

 2. Automate Start/Stop

     2.1 automated the start and shutdown of the environment through scheduled pipelines

     2.2 no manual intervention needed with cron job like 0 9 * * 1-5 or you can set the time if your         automation tools support that. 

 3. Transparency across the teams

Since the automation is pipeline-based, there is full transparency. The teams can look back in history to confirm what was triggered, when, and by whom (or what) this goes to App Team , FinOps Team and Cloud team in some cases.

Sample calculation 

 

With breaking a bit of sweat because of try and error for this pipeline and try to get the right parameter and command , cost can be reduce up to 75 % . 

so if you are running service like  Application Gateway and Azure Database for MySQL , you may try this Azure Command 

1 . https://learn.microsoft.com/en-us/cli/azure/network/application-gateway?view=azure-cli-latest#az-network-application-gateway-start

2. https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-restart-stop-start-server-cli#start-a-stopped-server

Or Make an API CALL

1. https://learn.microsoft.com/en-us/rest/api/application-gateway/application-gateways/start?view=rest-application-gateway-2024-05-01&tabs=HTTP

2. https://learn.microsoft.com/en-us/rest/api/mysql/flexibleserver/servers/start?view=rest-mysql-flexibleserver-2024-06-01-preview&tabs=HTTP

Apart of this , if your organization strive for ESG on Cloud, this might help also , i have not deep dive into that but let see 😁 

   

empty_dir = {} is not expected here - Terraform

 Hi all, i did some conversion from yaml to tf using tool called k2tf . As part of code conversion and i use to be in my terraform module. so if you have this line with "empty_dir = {}" terraform cannot read as it is not part of the syntax. 

as first i was just commenting the line like below 

 spec {

        volume {

          name      = "tmp-dir"

          #empty_dir = {}

        }

turn out everytime i run terraform plan it will be part of changes . 

so i was trying to ignore this line code using a ignore_changes function but could find the right class to put into. so i look back the line like picture above and change  from empty_dir = {} to empty_dir {} and it workkkk.. 

so my lesson to me here is other than commenting, i should also pay attention to syntax to replace it .

btw if any of you interested in using k2tf, i already made container image , you may pull it using this command - docker pull pra8/k2tf 

* i have just compile the tool and make it a container 

that all for now and see you guys on next post

Do this on your AGIC

 Hi all, 

i would like to share some finding you are deploying application gateway ingress controller or AGIC in short form. 

There behavior of it keep deploying defaultaddresspool and the address pool that u specify in your terraform code. 

 backend_address_pool {

   name = "${var.agname}-beap"

   fqdns = [

        "dummy"

      ]

So let say your var.agname is AGIC.. so defaultaddresspool  and AGIC-beap backend pool will replacing each other everytime you  run terraform apply. 

After searching then i found there some workaround which some lifecycle management has been added to ignore the changes of the block listed in it. 

  lifecycle {

  ignore_changes = [

    backend_address_pool,

    backend_http_settings,

    frontend_port,

    http_listener,

    probe,

    redirect_configuration,

    request_routing_rule,

    ssl_certificate,

    tags,

    url_path_map,

  ]

}

source : stackoverflow 

some other workaround i tested before getting to this is edit the gateway time and set the agic reconcile  

after all been added according and i try to deploy 3 sample with agic, it is all running smoothly,,

 so why not i reshare the finding on stackoverflow and what i done here for your reading, sample to try this available on my terraform github .

Adding an S make it work

 Hi all, 

this is just quick sharing on the issue i just face this morning . While creating and NSG rule for terraform i for an error mentioning that the parameter should be in string but i have already put it in string format 

after a while searching, i found this github issue - [HELP WANTED] NSG - Multiple Ports in One Rule · Issue #4518 · Azure/azure-quickstart-templates · GitHub

so to make it works, just and an S to it, from range becomes ranges .

yup, that all needed..

Thanks for reading and enjoy the rest of your day 

Win-Kex with Windows Terminal

 As WSL2 release a while back, many people has excited about it and some linux distribution does support GUI mode . So i will be writing a bit of my preference that i just solve while using WSL2  with windows terminal. 

Requirement 

1. WSL2 is enable - click here to enable and read about it  

2. Windows Terminal  - click here to get it 

3. Install GUI on your Linux Distro - click here 

So here is my case, i have kali linux distro downloaded and run. Apart from that , i also install win-kex to experience the GUI. however, it goes to full screen and take all my screen as the result of launching that . 

while searching on the solution, i found a paramater needed to be add to make it work like RDP. 

resulting this 

 

 so it does reach my preference to use it but how do i make it work if i try to launch this via windows terminal and my answer to that is add a specific profile with command to it. 

Here is my version 

{

                "commandline": "wsl -d kali-linux kex --wtstart esm",

                //wsl -d kali-linux kex --wtstart -s

                "guid": "{55ca431a-3a87-5fb3-83cd-11ececc031d2}",

                "hidden": false,

                "name": "Win-KeX"

            }

Then, another profile will be listed for you to use 

that all for my sharing this time. and here are some reading material before i can come out with this 

1. Win-KeX ESM | Kali Linux Documentation  *ps i found this right after setting my profile in terminal

2. How to install Win-Kex (Kali Linux on Windows 10) with WSL - Hack Forums

3. Kali in WSL + WiN KeX 

4. Setup Kali Linux in Windows 10 WSL2 Setup Kali Linux in WSL2 (techtutsonline.com) 

check out my previous writing on windows terminal here until then , thanks for reading and stay safe 

Azure Windows VM not Activated !!!

Hi, this article will be more like a review on what consideration that need to be include in planning especially on some service in azure that somehow need some connection to azure backend service . 

As for this case, quick background is this all traffic is redirected to Azure Firewall as an outbound , after few month of running turn out the windows vm status show not activated on the desktop . 

A quick check to rectify the issue is by running psping against Azure KMS ip or fqdn. 

 

or ping the ip is the DNS cannot be resolve - 23.102.135.246 with the same port 1688

or issue a Test-NetConnection kms.core.windows.net -Port 1688 on powershell 

As for these case, i did a firewall rule under network rule to allow this subnet to those IP. Here is the result after rule has been applied . 

The connection is successful now and one last step to instruct windows to activate via this command 

"1..12 | ForEach-Object { Invoke-Expression "$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ato" ; start-sleep 5 }"

So this give a a thought how the infrastructure should be design in proper manner in which ever public cloud service. If this kind of blocking is happening without proper plan it will block more feature to be able to use like having log analytic for metric and maybe azure update management for tracking and perform update. 

As for now, few scenario relate to this windows is not activated can be happen due few reason 

1. VM is behind Standard Private load balancer with is secured by default

2. Outbound traffic is via Azure Firewall or NVA but the necessary or i will say crucial is not implemented. 

Latest update from microsoft "The first DNS name of the KMS server for the Azure Global cloud is azkms.core.windows.net with two IP addresses: 20.118.99.224 and 40.83.235.53. The second DNS name of the KMS server for the Azure Global cloud is kms.core.windows.net with an IP address of 23.102.135.246"

More details solution can be found here at Microsoft document and few other

1. Troubleshoot Windows virtual machine activation problems in Azure - Virtual Machines | Microsoft Docs

2. Azure Windows Server license not activated - Stack Overflow

That is all for now have nice day ahead and stay safe 

Enable Boot Diagnostic Via Terraform Part 2

For this posting, it is more like an update as i recently found a better way in github (link here) to enable the boot diagnostic to Azure VM . 

This is code segment that i use previously 

  boot_diagnostics{

          enabled = true

          storage_uri = "Https://${azurerm_storage_account.hub-core-vmdiag.name}

                        .blob.core.windows.net"

}

so i did my own experiment to test that and turn out it is easier to be implemented 

here is code up 

1. AzureRM_virtual_machine resource block

 

 boot_diagnostics {

      enabled = true

      storage_uri = azurerm_storage_account.hub-core-vmdiag.primary_blob_endpoint

    }

2. AzureRM_windows_virtual_machine resource block 

 boot_diagnostics { 

      storage_account_uri = azurerm_storage_account.hub-core-vmdiag.primary_blob_endpoint

    }

that all.. thanks for reading and stay safe

Lesson Learn -- OS profile in Terraform

Hello All,

Throughout my journey on learning terraform and start deploying resources mainly Virtual Machine, i just realize that i miss out one of most important parameter in OS Profile config which did not specify the code as below.

         os_profile_windows_config{

             enable_automatic_upgrades = false # For windows Update

             provision_vm_agent = true  #install and enable Azure VM agent 

            }

The VM will be still be deploy as normal but you will notice the vm name would not appear .

Sample As below 

1 VM01 was deploy without the specify the code as mention on top 

2. VM02 was deploy with the code 

 after certain research done and end up i found the solution in the github but one thing to clarify, even if you add the code into VM01 code in Terraform it wont be able to change it anymore. There a few way to solve it either via redeploy it , PowerShell and azure resourcer explore. 

Hope this will help for those who is still beginner in terraform like me, Cheer 😊😊

Enable Boot Diagnostic Via Terraform

Hello all,

today i will be sharing a bit on my experience dealing with terraform on deploying resource on azure.

My problem on building these terraform is to enable boot diagnostic for azure vm .

i try to dig into terraform documentation but seem like it just appear on description without any sample, so i think i would share the way to do that here. Lets start

1. Create a storage account for vm/boot diagnostic purposes

resource "azurerm_storage_account" "hub-core-vmdiag" {

  name                     = "azusgcorestrdiagnostic01"

  location            = azurerm_resource_group.azusg-core-vnet-rg.location

  resource_group_name = azurerm_resource_group.azusg-core-vnet-rg.name

  account_tier             = "Standard"

  account_replication_type = "LRS"

}

2. Create a VM

  

resource "azurerm_network_interface" "AD01-nic" {

  name                 = "AD01-nic"

  location             = azurerm_resource_group.azusg-core-vnet-rg.location

  resource_group_name  = azurerm_resource_group.azusg-core-vnet-rg.name

  enable_ip_forwarding = true

  ip_configuration {

    name                          = "AD01-ipconfig"

    subnet_id                     = azurerm_subnet.core-share-subnet.id

    private_ip_address_allocation = "Static"

    private_ip_address            = "172.30.0.197"

  }

 // tags {

   // environment = local.prefix-core

  //}

} 

resource "azurerm_virtual_machine" "AD01-vm" {

  name                  = "AD01"

  location              = azurerm_resource_group.azusg-core-vnet-rg.location

  resource_group_name   = azurerm_resource_group.azusg-core-vnet-rg.name

  network_interface_ids = [azurerm_network_interface.AD01-nic.id]

  vm_size               = "Standard_F4s"

  

  storage_image_reference {

    publisher = "MicrosoftWindowsServer"

    offer     = "WindowsServer"

    sku       = "2019-Datacenter"

    version   = "latest"

  }

  storage_os_disk {

    name              = "AD01-osdisk"

    caching           = "ReadWrite"

    create_option     = "FromImage"

    managed_disk_type = "Standard_LRS"

}

os_profile {

computer_name = "AD01"

admin_username = "xxxxxxx"

admin_password = "xxxxxx"

}

os_profile_windows_config{}

}

3. Add boot diagnostic option into your code (after the os profile)

   os_profile_windows_config{}

          boot_diagnostics{

          enabled = true

          storage_uri = "Https://${azurerm_storage_account.hub-core-vmdiag.name}

                        .blob.core.windows.net"

           }

you are done, now after you run terraform apply, this vm will be created, boot diagnostic will be enable with this storage account.

Happy testing and see you all again.

updated version is here on part 2 - Click here 

Deployment of Arcsight Connector on Azure

Hello all, welcome again to my blog and this time, the topic will be a bit out of norm..

SIEM tool is widely use in most of organization to manage their security and event management. Microsoft has their SIEM solution but for this round we gonna go  with ArcSight due to my latest testing and deployment.

without talking further, lets start

1)      Pre Deployment

           a)       Windows Server or Windows 10

i)        Set-execution policy to unrestricted or bypass

ii)       Running PowerShell atleast version 5

iii)     Loaded with Azure RM modules (Install-Module -Name AzureRM -AllowClobber -Scope AllUsers)

            b)      Azure Active Directory

i)        Roles assignment (either one)

(1)    Global administrator

(2)    Security administrator

(3)    Security reader

(4)    Reports reader

            c)       Azure Subscription

i)        Either Owner or Contributor

            d)      Download all preloaded file and script (refer here )

            e)      Copy app.properties , arcsight-cloud-functions-7.14.0 .zip and arcsight-monitor-functions-7.14.0 .zip to user directory

2)      Deployment

            a)       Edit app.properties file

    *for smoother deployment, please make sure the function app name use all small letter

            b)      Run the script

           c) Result

3)      Post deployment

             a)       Configure always on for azure function

b          b) Setup the diagnostic log

    C)Update the certificate use

*delete the existing one and upload the new remote_management.p12 that can get from syslog NG

    d) Restart both azure function and your arcsight syslog NG will start receiving the log from Azure platform and Azure AD.

Happy deployment. Till we meet again.