DexterPOSH's Blog

Welcome file Original Post here Background 🧐 I like ARM templates, I use it a lot to deploy Azure cloud resources but as all things it has some pain points associated with it. In this post, let’s see how you can iterate over based on certain logic and deploy multiple resources using linked templates. As it stands out this logic of iterating over and deploying multiple instances of a resource tripped me a lot in the beginning. Walkthrough 🏃 Let’s work through the whole process of writing an ARM template which deploys multiple resources. Github Repository - ArmTemplateLoopExample This is a simple post demonstrating looping logic I often use, feel free to sprinkle your own best practices & modifications on top e.g. storing templates in a private Cloud blob container, adding more parameters, names etc. Scenario Let’s take a scenario of deploying many storage accounts based on the user input. Ideally, if you’re in this situation you should write 2 temp...

Welcome file Original Post Why use Resource Graph instead Az CLI/ PowerShell? If we want to search for resources meeting certain criteria across all our subscriptions, we can’t use Az CLI or Az PowerShell to do this type of queries since it would require a lot of overhead to filter and switch between subscription contexts. Pesudo-Code (not so performant) Foreach subscription in subscriptions: set Az Context Get the VMs, Filter based on criteria Resource Graph queries can help here, as they can be used to fetch metadata about the resource and then after their presence is validated, maybe perform some operation on it. With PowerShell we can even group these resources together based on SubscriptionID and then iterate over each subscription (set the right context) and perform actions. Pesudo-Code (single query and performant) Query Azure Graph for resources based on criteria across all the subscriptions In this post, I share some of the Resource Graph Que...

Welcome file Background 🐼 Recently, I found out that there is no sane way to perform adding a public IP address to the authorized IP address ranges using either the Az CLI or Az.Aks PowerShell (no cmdlets available yet) module. From the official docs it says to use something like below format with Az CLI. az aks update \ --resource-group myResourceGroup \ --name myAKSCluster \ --api-server-authorized-ip-ranges 73.140.245.0/24 But it doesn’t tell you how to append the IP to the range, instead you need to supply a comma separated value of public IP addresses. Challenge ☁️ Well, this is can be done by using Az CLI with PowerShell or Bash and parsing output then generating a comma separated string and passing it back to Az CLI 😞 Solution ⚡️ Often, when I am hit with such limitations with cmdlets or Az CLI making life hard. I go back to using simply the 2 cmdlets provided by Az.Resources module. Behold mighty! Get-AzResource - Gets the Az ...

Original source -  Azure DevOps Tip - Find private APIs Often working with Azure DevOps, I hit a wall trying to automate some tasks but there are no REST API's made public yet. It was one of those task of automating creation of Environments in multi-stage YAML based pipelines in AzDO. Quick research reveals that this has been requested in uservoice  (please upvote). Let's see one of the very simple ways to discover some of these APIs.

I wrote a sample PowerShell code snippet to crawl across all opened Pull requests in multiple repositories inside an Azure DevOps project and list the ones out where myself or the team/group I am part of assigned as a reviewer. End result is this:

Someone, asked me at work if I could generate a list of Release pipelines definitions which did not have a specific task ( AzSK SVT task ) missing or disabled. This was more for an internal audit purpose and can definitely be built upon. I recently read that Az CLI got an extension support for Az DevOps . Please read on the GitHub repository on how to install this extension for Az CLI. Time to put this to try. Below gist describes the steps I used in pwsh (PowerShell Core) with Az CLI & DevOps extension installed. The above script should be self explanatory (read the comments). Please leave a comment if you have any queries.

The auth package lives at "github.com/Azure/go-autorest/autorest/azure/auth" In the above package, at the moment I have explored below two functions (my notes): NewAuthorizerFromFile method NewAuthorizerFromEnvironment method (this post)  This function definition looks like below :

Azure Resource Graph is an amazing tool in the belt of Az Ops team. It allows to quickly search across all your subscriptions (does it?). Started using Az Resource graph with that pretext that the queries I ran will be run against all the subscriptions I have read access to, Yes it will but there is a catch here! I mostly use Az.ResourceGraph PowerShell module (Why? another post) Found the solution by digging into the source code for the Search-AzGraph cmdlet, if the subscriptions are not specified explicitly then the cmdlet uses a method named GetSubscriptions() Below is a snippet of the method def: The catch is that if no subscriptions are supplied it defaults to subscriptions in the default context. I am not really sure but some of the subscriptions which I can see when running Get-AzSubscription were missing when I ran the below: (Get-AzContext).Account.ExtendedProperties.Subscriptions So, the trick is to set the PSDefaultParameterValues for the Search-AzGraph cmdl...

My personal notes on how to authenticate to Azure in the GoLang code.  The auth package lives at "github.com/Azure/go-autorest/autorest/azure/auth" In the above package, at the moment I have explored below two functions: NewAuthorizerFromFile method NewAuthorizerFromEnvironment method

To be fair Python's REPL mode allows you to explore objects pretty easy. But since PowerShell has been my first language, I often tend to crib for similar experience. P.S. - I do know that PowerShell language specs picked up quite many things from Python. Also, Python is my goto language on Linux platform as well. So back to cribbing, I tend to miss most the exploring aspects of  PowerShell e.g. Get-Member and Format-* cmdlets until one day I sat down and wrote few functions in Python to give me a similar experience.

Well, below are my notes on using account Shared access signatures in Azure using Azure PowerShell modules. Theory Let's get the basics out of the way first. A shared access signature is a way to delegate access to resources in a storage account, without sharing the storage account keys. SAS gives us granular control over the delegated access by : Specifying the start and expiry time. Specifying the permissions granted e.g Read/Write/Delete Specifying the Source IP address where the requests will originate from. Specifying the protocol to be used e.g HTTP/HTTPS.

What is environment configuration data? Well, you might have heard the term 'configuration data' in usage with PowerShell DSC. The case for using configuration data is wherein all the input arguments are abstracted from the code being written so that this configuration data can be generated on the fly and passed to the underlying scripts or framework like DSC. For some of our solutions being deployed at the customer site, we require a lot of input parameters e.g. different network subnets for management and storage networks, AD/DNS information etc. Adding all these parameters to our input argument collector script was an error prone and tedious task since there were far too many input arguments. So instead of having a file to specify all input arguments was the preferred method. This also helped us while troubleshooting the deployments since a local copy of the input arguments always persisted.

This is a long overdue post (previous one here ) on how to use certificates to do an automated login to A zure R esource M anager. Not rocket science but easy to setup, so that you use a cert to authenticate to Azure RM automatically. It seems the Azure docs are already up to date on how to do few bits involved in this, please read the section ' Create service principal with a certificate ' in the docs. The process is almost the same as mentioned in the docs, except the fact that when we do the role assignment, we instead assign the contributor role definition to the service principal, since we want the ability to manage the resources in Azure RM. Also, we will author a function add it to our profile so that PowerShell authenticates automatically to Azure RM each time it opens.  So let's begin with it: Create the self-signed certificate. If you are running this on Windows 8.1, then you have to use the script by MVP Vadims Podans from the gallery. ...

Problem Do you have a central network share, where you store all the scripts or PowerShell modules ? What happens if you try to run the script from a network share ? or if you have scripts (local) which invoke scripts or import PowerShell modules stored on this network share ? Well you would see a security warning like below (Note - I have set execution policy as 'Unrestricted' not 'bypass' here): Run a .ps1 from the network share Well this is a similar warning, which you get when you download scripts from Internet. As the message says run Unblock-File cmdlet to unblock the script and then run it, let's try it.

Making a quick note to document the version gotcha encountered while running puppet client on Windows. I downloaded the latest and greatest available version of the puppet client on a Windows Server 2012 R2 box, but when running the puppet agent for the first time interactively to generate the certificate request to the puppet master server it blew up with below error message. Quickest way to get the puppet binaries all accessible is " Start Command Prompt with Puppet " shortcut. Once in the cmd prompt, run puppet_interactive. This will run the puppet agent on demand and when run for the first time issue a certificate request to the puppet master to sign. But this threw up the below error : Error: Could not request certificate: Error 400 on SERVER: The environment must be purely alphanumeric, not 'puppet-ca'

I have been looking at learning puppet for a while now and to try it out, wanted to quickly deploy a puppet master & node (Ubuntu) on top of my Hyper-V host. Below are the quick & easy steps I followed mostly for my own reference (n00b alert) : Enable Hyper-V on the node, this goes without saying :) (reboot after this step). 001 002 003 004 #region enable Hyper-V                                                                         Add-WindowsFeature   -Name   Hyper-V   -IncludeAllSubFeature   -IncludeManagementTools #endregion Install Vagrant using chocolatey. 001 002 003 004 005 #region install vagrant Import-Module   PackageManagement                      ...

Recently, I have been writing/ reading a lot of Pester tests (both Unit and Integration) for infrastructure validation. One of the classic limitation hit during mocking with Pester is that you can have different mocks based on different arguments to a parameter (e.g using parameterFilter with Mock ) but not based on a counter. For Example - See below, I have two mocks for Get-Process cmdlet based on the name passed to it. Mock   -CommandName   Get-Service  -ParameterFilter   { $Name   -eq   'winrm' }   -mockwith   {[PSCustomObjet]@{Status='Running'} } Mock   -CommandName   Get-Service   -ParameterFilter   { $Name   -eq   'bits' }   -mockwith   { [PSCustomObjet]@{Status='Stopped' } This is really helpful, but there is a case where we want different mocks to occur based on a an incremental counter (number of times) a function/Cmdlet etc. are called in our script.

If you are authoring scripts targeting Nano server specifically then there are two checks which you can bake into (maybe add them to the default nano authoring snippet in ISE) them.

Do you remember ? In the older Azure Service Management model, we had an option to import the publish settings file and use the certificate for authenticating. It saved a lot of hassle. That method is deprecating now but we have something better which we can use in the newer ARM model. BTW for record I find it really annoying to enter credentials each time when I want to quickly try something out on Azure. So I have been using two techniques for automated login to the AzureRM portal. Storing Service principal creds locally (encrypted at rest using Windows Data Protection API) and using that to login. Using Certificate based automated login .