Setting Up Azure Workload Identity for Containers in Azure Kubernetes Services (AKS) Using Terraform - Improved Security for Containers in AKS

 Azure Workload Identity allows your containers in AKS touse amanaged identity to access Azure resources securely without having to depend on connection strings, passwords, access keys or secrets. In other works you can just use DefaultAzureCredential in your containers running in AKS, which will be using workload identity assigned to the container, to get access to the required Azure resource. The roale based access permissions will be in effect and the user assigned managed identity (we can use AD app registration as well bu user assigned managed identity is recommended) used to setup the workload identity in AKS should be given the necessary roles in the target Azure resource. This is far better than having to store secrets or connection stigs to utilized by the dotnet applications. In this post let's understand how to setup workload identity in AKS deployed containers and explore how it simplifies the dotnet application code allowing the application to access Azure resources securely with a managed identity.

Full example source code with terraform and a .NET application using default credentials to access app config service and keyvault is available here in my GitHub repo,

Getting Started with Secure DevOps Kit for Azure

Security is important aspect of any software development project. DevOps is essential part of software development. Improving security measures of software development, delivery and deployment is now can be enhanced with Secure DevOps kit for Azure. This security kit comes with PowerShell unitalities as well as CI CD extensions etc. for securing your software projects. Let’s explore the Secure DevOps Kit with couple of posts. In this first post let’s look at an overview as well as how to get started with Azure Subscription health scans using PowerShell utilities.

Finding Membership Information of a User/Group/Team in VSTS/TFS

Managing permissions of a VSTS/TFS sometimes become a nightmare specially if you have many teams groups etc. created in your account and in team projects. It is important to have a way to find group membership of an individual or group, so that you can analyze where the memberships are assigned in order to make required maintenance or change permission activities. Lets look at a command which can help you find that information quickly.

Securing Release Definitions When Multiple Teams Work on a Single Team Project

We have explored “Securing Build Definitions When Multiple Teams Work on a Single Team Project” in a previous post. Now the folders to group release definitions and applying permissions to isolate each team’s release definitions is also a possibility in VSTS. As we discussed in the “Securing Build Definitions When Multiple Teams Work on a Single Team Project” it is important to create the Build/Release admins VSTS permission group for each of the teams in the team project. Using the same admins group and the team we can setup permissions for release definitions folders. Let’s look at the steps in detail.

TFS15 RC1 (TFSvNext) - Resolving - There are no accessible team projects in this Team Project Collection. Contact your Team Foundation Server administrator.

In TFS15 RC1 (TFSvNext) when you setup a tem project with SharePoint site configured, you might see below error.

There are no accessible team projects in this Team Project Collection. Contact your Team Foundation Server administrator.

How to resolve.

To get the SharePoint read access to the team project, add “SharePoint Web Application Services” group to Team Project’s, Readers.

This will allow the SharePoint portal to read the team project information.

Create Non AD User in TFS in a Domain

If you want to create a non existing user for some purpose to TFS (For example assign all removed User Stories and Bugs to a non existing user, this was the requirement I got from a client :))  and if you do not like to add this user to Active Directory since there is no such actual Person, you can achieve this by creating the user in the TFS box as a windows user.

First create a windows user in TFS box



Add this user to the team project (do it inside the TFS box and you will not have any issues). My domain is ALM and my TFS box is TFS.

 

From any client machine having access to the TFS, login with the new user.




It works like a charm!