Azure

Azure Stack Secret/Certificate Rotation

by

Whoh…! It has been a very long time since I wrote a blog on my site, last blogs were from Ignite, and the 2018 edition is about to start. So time to end the blog silence 🙂

Azure Stack Certificates

Certificates all have there lifetimes fortunately otherwise it will miss it’s goal entirely, so it’s inevitable that we have to rotate some certificates on Azure Stack. I had to rotate the public certificates recently. A public certificate on a multi node Azure Stack POC environment that is of the type Multi SAN Wildcard certificate.  Best practice is to have a separate Wildcard certificate for the different roles of Azure Stack but since this is a POC al names are in one certificate. A lot about the Certificate requirements is describe here.

In this blog I am not explaining how to create the CSR or request the certificate, this is just about testing and rotating the public certificate. More details about generating a CSR can be found here

Prepare Certificate folder

Azure Stack expects a certain folder structure for all certificates and some properties on the .PFX file. The test tool will check for this. There is a powershell file on GitHub called CertDirectoryMaker.ps1 that you could use to create the folder structure. Then add your certificates to the right folder. In this case it was simple 1 certificate in all the folders.

Read more

Ignite 2017 @ Orlando Day 4

by

Day 4:

Azure High Performance Networking

This was a very interesting session with lots of good info. It started of wit VNet integration of Azure Container Service and the ability to give an IP to a single container instead of sharing the IP with several containers.

VNet Service endpoints is also new which gives you the ability to deny internet access to VM’s but allow specific Azure services as Endpoint. So your VM’s can talk to Azure Services or Paas Services without you trying to figure out behind what IPs the endpoints are located and talking to the rest of the internet.

Then NSG’s got a bit less dumber then they were. The applied service tags to NSG’s. So what it means is that you can for example set a tag SQL Servers, or IIS Servers and make all IIS or SQL Servers being tagged by the policy. So you setup one rule with a tag SQL and all your SQL servers wil be bound to that NSG rule instead of creating several rules based on source IP’s of that SQL server.

Read more

Ignite 2017 @ Orlando Day 3

by

The third day at Ignite was kind a hard to start up, it were long day’s and fun long nights but 2 double espresso kind a pushed me out of my morning dip. Ready to start the day!

Azure High Performance Networking:

This sessions was initially not about new stuff. It’s was more to make things more clear about Azure networking. Near the end there was a lot of new stuff about ExpressRoute though!

Public and Microsoft Peering

Earlier I hear some noise from several people that the Office 365 peering, or Public Peering was to be canceled. But now we know that it’s not cancelled but that the 2 peerings have merged. That makes things simpler, but also more complex, because one of the most issue’s I hear customers talking about is that they don’t want to peer with all Azure or Office 365 services and now there is no choice in those either. It’s either none ore all in! But Microsoft must have heard this complaint because the came up with a new feature for ExpressRoute called Route Filters. With the filters you can choose what routes you want advertise to use only the service you want over the ExpressRoute connection. Nicely done! 🙂

Finally monitoring on ExpressRoute!

Read more

Ignite 2017 @ Orlando Day 1

by

Today was the first day of Ignite 2017 which was about to kick off with a key note from Satya Nadella. Unfortunately it was a lot of the same slides and info as from Inspire 2017, so it was a bit of a waste of time, and since we had a lot of drinks at some very nice places in Orlando and a sprinkler fight with some InSpark colleague’s the night before it would have been nice to get a couple of more hours of sleep 😉 .

Empower IT and Developer Productivity with Azure
After the keynote i started with the session from Scott Gutherie. It was packed with info but a couple of things besides the session from Corey with Massive VM sizes with 128 Cores and multiple Terrabytes of memory were interesting to me:

  • Update management:
    Update Management is in preview now, and as i noticed in my own subscription not available for all machines, don’t no the prereqs for that yet. But you can enable Update management to scan vm’s for updates it needs on Windows and Llinux. You can also include Onprem Machines. It’s then displayed in a nice dashboard
  • Change Tracking
    With Azure Change Tracking in the OMS suite you can track changes in a VM through Log Analytics on a big nummer of resource. For example on File level, Registry, process and service level. Here to a slick displayed dashboard to get a good overview of what happend.

After a horrible lunch experience the real sessions would start. Here is a quick overview with some valuable take away for myself within my focus

Virtual Machine Diagnostics on Microsoft Azure
This was a short 20 minute session in the OCCC South hall Expo Theather #10. A new powershell script is release to get the health from a VM and output it to a json formated overview. With Get-AzureRMVmHealth.ps1 you can get a quick overview of several details like is my nic up, whats the ip, what port is used for RDP, is the admin account disabled, whats the username, are all vital services for remote access running and lots more! Give it a try with the following command

Read more

Azure Stack TP2 November refresh

by

Last week Microsoft published a new release of Microsoft Azure Stack TP2. This release included support for features like SQL RP, MySQL and Azure App Services so a bunch of PaaS services.

First it though yeah.. new features 🙂 !! But then I looked back and though.. o man this is gonna cost me a lot of deployment time again. Considering the previous issue’s I had before which you can read on this blog.

After downloading, extracting, copying and processing (which you can read all about here) i executed my deployment last night (my hosts are in a different time zone, so my last night was not yet server night 🙂 ).

azurestacktp2novemberdeploy

This morning I checked my server to see what the deployment did and I was pleasantly surprised

Read more

Azure Stack TP2 Deployment Issue with Timezone

by

Oke, let me first start of a special thanks to my colleague’s Hans Vredevoort, Darryl van der Pijl and Mark Scholman for leading me to the solution!

Since the release of Azure Stack TP2 i did not found the time to start a deployment and play around with Azure Stack TP2. Tp1 was unstable and had a lot of strange issue’s were TP2 was much more stable I was told.. But for the past view weeks I have ben struggling with the deployment!

I’ve deployed it over and over and it keept failing on error in step 60.140.145 were the VM’s were registered at the Compute Controller.

2016-10-24 04:38:18 Error 1> 2> Task: Invocation of interface 'Migrate' of role 'Cloud\Fabric\VirtualMachines' failed: 
Function 'Add-CpiObjects' in module 'Roles\VirtualMachine\VirtualMachine.psd1' raised an exception:
Failed to register virtual machine 'MAS-NC01' with compute controller. Operation failed with: 
Exception calling "GetResult" with "0" argument(s): "MakeReservation VM:36fae812-1703-4198-b0ae-39075e77e2ef Cluster:S-Cluster"
At C:\CloudDeployment\Roles\VirtualMachine\VirtualMachine.psm1:2118.
+ $eceVm.Name
at Trace-Error, C:\CloudDeployment\Common\Tracer.psm1: line 52
at Add-CpiObjects, C:\CloudDeployment\Roles\VirtualMachine\VirtualMachine.psm1: line 2118
at <ScriptBlock>, <No file>: line 18

Since I was on a VLAN tagged network and had no DHCP I was suspecting that one of these parameters –PublicVLan -NatIPv4Subnet -NatIPv4Address -NatIPv4DefaultGateway were giving me a hard time deploying TP2. But after adding a DHCP and change my VLAN to native/untagged so I wouldn’t need the parameters I still ended up at the same error!

Read more