Forem: Omkar Patil

Azure AKS cluster from scratch using Terraform

Omkar Patil — Thu, 12 May 2022 21:53:04 +0000

While working on creating training material on Azure IaC using Terraform, I created a small demo project to create an Azure AKS cluster from scratch and integrated it with Terraform Cloud. It came out quite nicely and therefore I thought I would share it with larger audience 🙂.

Detailed instructions can be found on the repo README. You'll need your own Azure account and a subscription. The AKS cluster code is a local module and the created cluster will have the following features:

Nodes with Ubuntu OS
Azure CNI
Separate vnet and subnet
Single nodepool with autoscaling enabled
AKS managed Azure AD integration
System-assigned managed Identity
Cluster auto-upgrade enabled

Quick note about Terraform Cloud - if you haven't tried it yet, you should. It has a free plan for smaller teams up to 5 and provides a way to manage state remotely and securely.

Happy coding 🤘.

ospatil / k8s-azure-devops

Experiments with K8s, Azure and DevOps tools like Terraform

Kubernetes, Azure, Terraform and DevOps Sandbox

Base setup

Install Azure CLI: brew install azure-cli.
Install terraform: brew install terraform.

Initial Steps

Login into Azure using the command az login The subscription list can be obtained using az account list Default subscription can be set using az account set --subscription <SUBSCRIPTION_ID>
Terraform Cloud has a free plan that allows managing remote state. Create a TF Cloud account and a workspace.
Login to Terraform Cloud using terraform login and follow the instructions.
Create and configure an Azure service principal in TF Cloud workspace. This will allow TF workspace to connect to and create resources in the Azure subscription.

Add the necessary permissions to the SP to get the AKS admin group name from the azuread provider. We only need Group.Read.All permission.

Examples

Each subdirectory represents one scenario and usually corresponds to one TF Cloud workspace.

…

View on GitHub

Folds in TypeScript

Omkar Patil — Tue, 08 Feb 2022 12:31:29 +0000

For past few days, folds were stuck in my head for some reason and needed some unfolding 😃. I did so and below is the summary of my understanding for the benefit of my future self.

Why

Consider the scenario where we have an array of numbers and we would like to add them together without using a loop. No loops, no problem, we can use recursion.



const sum = ([h, ...t]: number[]): number => h === undefined ? 0 : h + sum(t);

assert.equal(sum([1, 2, 3]), 6);
assert.equal(sum([5]), 5); // array with 1 element
assert.equal(sum([]), 0); // empty array

The function sum:

accepts an array of numbers.
destructures it into head h and tail t: [h, ...t].
returns 0 if the head is undefined. This serves as a base case for the recursion.
else carries on the sum operation with the tail: h + sum(t).

Now, let's define a function to multiply the numbers in an array:



const product = ([h, ...t]: number[]): number => h === undefined ? 1 : h * product(t);

assert.equal(product([2, 2, 3]), 12);

As we can see, both look almost same. The only bits that vary are:

Base case value: what to return when we get down to empty array i.e. the base case of recursion.
The operation: sum in one case and product in the other.

This is where folds come in. They generalize the traversing the array and carrying out some operation with combines the array elements in some way.

Folds

We can traverse an array in one of the two ways: from the right or the left.

Right Fold

Let's define right fold foldr:



const foldr = <A, B>(f: (x: A, acc: B) => B, acc: B, [h, ...t]: A[]): B => h === undefined ? acc : f(h, foldr(f, acc, t));

There is quite a bit that's going on there. Let's go over it step by step.

Arguments:

The combiner function f: (x: A, acc: B) => B: It accepts the current element of the array and existing accumulator, combines them in some fashion and produces new value of accumulator.
accumulator acc: B: Initial value and the one that should be returned for the base case of the recursion.
array [h, ...t]: A[]: that we need to traverse and combine in some fashion.

Coming to the generics types <A, B>(f: (x: A, acc: B) => B, acc: B, [h, ...t]: A[]): B, it could be surprising to see two separate types being used: A for the array elements and and B for the accumulator. The final return type of foldr is also B i.e. the generic type of the accumulator.

Why not only A, which is the type of array elements, when all we are doing is traversing the array and producing final result by combining the elements in some fashion.

It turns out it's very much possible to combine the array elements into a different type and the generic type B covers that usage. In some cases, A and B will be same, in some cases, not. We'll see an example later where it's not.

Now, let's see foldr in action. Let's define our sum and product functions in terms of foldr:



const sumFoldr = (xs: number[]) => foldr((x, acc) => x + acc, 0, xs);
assert.equal(sumFoldr([1, 2, 3]), 6);

const productFoldr = (xs: number[]) => foldr((x, acc) => x * acc, 1, xs);
assert.equal(productFoldr([2, 2, 3]), 12);

As we can see, we get expected results.

I found John Whitington's More OCAML book has one of the most straight-forward and to-the-point illustrations of folds execution.

The call trace makes one thing obvious: foldr is not tail-recursive. The call stack grows till we reach to the end of array before the combine operation starts and stack unwinds.

Left Fold

Let's define left fold foldl:



const foldl = <A, B>(f: (x: A, acc: B) => B, acc: B, [h, ...t]: A[]): B => h === undefined ? acc : foldl(f, f(h, acc), t);

The function signature is same as foldr, the difference being how the combiner function is applied: foldl(f, f(h, acc), t). We start with initial value of accumulator, apply the combiner function to produce new value for accumulator and use the new value to continue recursing over the remaining array.

Here is how the execution trace looks like:

Now, let's see foldl in action. Let's define our sum and product functions in terms of foldl:



const sumFoldl = (xs: number[]) => foldl((x, acc) => x + acc, 0, xs);
assert.equal(sumFoldl([1, 2, 3]), 6);

const productFoldl = (xs: number[]) => foldl((x, acc) => x * acc, 1, xs);
assert.equal(productFoldl([2, 2, 3]), 12);

And expected results.

Map and Reduce

Now that we have the fold implementation in place, lets implement two common functions, map and reduce in terms of fold. These are defined as Array instance methods in the standard JavaScript API, but we'll implement these as functions.



const map = <A, B>(xs: A[], cb: (x: A) => B): B[] => foldl((x, acc) => {
    acc.push(cb(x));
    return acc;
}, [] as B[], xs);

assert.deepEqual(map([1, 2, 3], x => x * 2), [2, 4, 6]);
// to demonstrate usage of return array containing different type
assert.deepEqual(map([1, 2, 3], _x => 'ho'), ['ho', 'ho', 'ho']);

// reduce
const reduce = <A>([h, ...t]: A[], cb: (pre: A, cur: A) => A) => foldl((x, acc) => cb(x, acc), h, t);

assert.deepEqual(reduce([7, 3, 8], (pre, cur) => pre + cur), 18);

The map example demonstrates the use of different type for accumulator. It's a rather contrived example, but demonstrates the point well.

Folding over functions

We went over folding over primitive values in the last section. Folding over functions is also quite common and useful operation. Function piping and composition are the two use cases where we can use folding over functions to create a new one.

Pipe

A pipe function of functions f1, f2 and f3 can be defined as: pipe([f1, f2, f3])(x) = f3(f2((f1(x)))).

We give input x to first function f1, take the result and pipe it as input to f2, get the result and pipe it as input to f3 to get the final result.

Let's create pipe creator function called plumber that takes two functions and returns their pipe function.



const plumber = <A>(fn1: IdType<A>, fn2: IdType<A>) => (x: A) => fn2(fn1(x));

What's this IdType<A> type of the functions and why it's needed?

If we have an array of functions and would like to create a pipe function using plumber function, we have a problem with kickstarting the process with the first function.

plumber expects 2 arguments and we have just one. That's where Identity function comes in. It's a function that simply returns the argument it gets.

We use the identity function as initial value with the first function in the array to kickstart the pipe formation.

Let's create a pipe function in imperative fashion first to understand it better.



type IdType<A> = (x: A) => A;

const double = (i: number) => i * 2;
const triple = (i: number) => i * 3;
const quadruple = (i: number) => i * 4;

const fns = [double, triple, quadruple];

const plumber = <A>(fn1: IdType<A>, fn2: IdType<A>) => (x: A) => fn2(fn1(x));

// since plumber needs two functions to form the pipeline, we need something to start with the
// first function in the array and that something is the id function.
const idNumber: IdType<number> = x => x; // id function for number type

let acc = idNumber;

for (const fn of fns) {
    acc = plumber(acc, fn);
}

assert.equal(acc(1), 24); // acc is the final pipe function

As we can see, we are traversing the array from left to right, assigning the composed pipe function up to that point to the accumulator and the final value of the accumulator is the final pipe function. As such, this is a perfect fit for foldl and below is the implementation based on foldl.



// pipe([f1, f2, f3])(x) = f3(f2((f1(x))))
const pipe = <A>(fns: Array<IdType<A>>) => foldl((fn, acc) => x => acc(fn(x)), (x: A) => x, fns);

const half = (x: number) => x / 2;
const third = (x: number) => x / 3;
const tenTimes = (x: number) => x * 10;

const pipeline = pipe([half, third, tenTimes]);
// this is equivalent to tenTimes(third(half(24))) === 40
assert.equal(pipeline(24), tenTimes(third(half(24))));

Compose

A compose function of functions f1, f2 and f3 can be defined as: compose([f1, f2, f3])(x) = f1(f2((f3(x)))).

We start traversing the array from right, give input x to function f3, take the result and provide it as input to f2, get the result and provide it as input to f1 to get the final result. It's a perfect fit for foldr and here is the implementation.



const compose = <A>(fns: Array<IdType<A>>) => foldr((fn, acc) => x => fn(acc(x)), (x: A) => x, fns);

const plusOne: IdType<number> = x => x + 1;
// or add type to the parameter to conform to IdType<number>
const fiveTimes = (x: number) => x * 5;

const composition = compose([plusOne, fiveTimes]);
// this is equivalent to plusOne(fiveTimes(10)) === 51
assert.equal(composition(10), plusOne(fiveTimes(10)));

Here is the complete code listing for quick reference.



import assert from 'node:assert/strict';

// recursive addition of elements of an array
const sum = ([h, ...t]: number[]): number => h === undefined ? 0 : h + sum(t);

assert.equal(sum([1, 2, 3]), 6);
assert.equal(sum([5]), 5); // array with 1 element
assert.equal(sum([]), 0); // empty array

// recursive multiplication of lements of an array
const product = ([h, ...t]: number[]): number => h === undefined ? 1 : h * product(t);

assert.equal(product([2, 2, 3]), 12);
assert.equal(product([5]), 5);
assert.equal(product([]), 1);

/* as we can see sum and product are almost same. The things that vary is the base case value -
 * (0 for sum and 1 for product) and the operation. Let's generalize it.
 */
const foldr = <A, B>(f: (x: A, acc: B) => B, acc: B, [h, ...t]: A[]): B => h === undefined ? acc : f(h, foldr(f, acc, t));

const sumFoldr = (xs: number[]) => foldr((x, acc) => x + acc, 0, xs);
assert.equal(sumFoldr([1, 2, 3]), 6);

const productFoldr = (xs: number[]) => foldr((x, acc) => x * acc, 1, xs);
assert.equal(productFoldr([2, 2, 3]), 12);

/* now let's look at foldl */
const foldl = <A, B>(f: (x: A, acc: B) => B, acc: B, [h, ...t]: A[]): B => h === undefined ? acc : foldl(f, f(h, acc), t);

const sumFoldl = (xs: number[]) => foldl((x, acc) => x + acc, 0, xs);
assert.equal(sumFoldl([1, 2, 3]), 6);

const productFoldl = (xs: number[]) => foldl((x, acc) => x * acc, 1, xs);
assert.equal(productFoldl([2, 2, 3]), 12);

/* let's implement a couple of JavaScript standard apis using folds: map, reduce, not exact but close enough. */
// map - the reason for two type parameters is the returned array can be of any type.
const map = <A, B>(xs: A[], cb: (x: A) => B): B[] => foldl((x, acc) => {
    acc.push(cb(x));
    return acc;
}, [] as B[], xs);

assert.deepEqual(map([1, 2, 3], x => x * 2), [2, 4, 6]);
// to demonstrate usage of return array containing different type
assert.deepEqual(map([1, 2, 3], _x => 'ho'), ['ho', 'ho', 'ho']);

// reduce
const reduce = <A>([h, ...t]: A[], cb: (pre: A, cur: A) => A) => foldl((x, acc) => cb(x, acc), h, t);

assert.deepEqual(reduce([7, 3, 8], (pre, cur) => pre + cur), 18);

/* pipe and compose */
/* define type for identity */
type IdType<A> = (x: A) => A;

const double = (i: number) => i * 2;
const triple = (i: number) => i * 3;
const quadruple = (i: number) => i * 4;

const fns = [double, triple, quadruple];

const plumber = <A>(fn1: IdType<A>, fn2: IdType<A>) => (x: A) => fn2(fn1(x));

// since plumber needs two functions to form the pipeline, we need something to start with the
// first function in the array and that something is the id function.
const idNumber: IdType<number> = x => x; // id function for number type

let acc = idNumber;

for (const fn of fns) {
    acc = plumber(acc, fn);
}

assert.equal(acc(1), 24); // acc is the final pipe function

// pipe([f1, f2, f3])(x) = f3(f2((f1(x))))
const pipe = <A>(fns: Array<IdType<A>>) => foldl((fn, acc) => x => acc(fn(x)), (x: A) => x, fns);

const half = (x: number) => x / 2;
const third = (x: number) => x / 3;
const tenTimes = (x: number) => x * 10;

const pipeline = pipe([half, third, tenTimes]);
// this is equivalent to tenTimes(third(half(24))) === 40
assert.equal(pipeline(24), tenTimes(third(half(24))));

/* compose: compose([f1, f2, f3])(x) = f1(f2((f3(x)))) */
const compose = <A>(fns: Array<IdType<A>>) => foldr((fn, acc) => x => fn(acc(x)), (x: A) => x, fns);

const plusOne: IdType<number> = x => x + 1;
// or add type to the parameter to conform to IdType<number>
const fiveTimes = (x: number) => x * 5;

const composition = compose([plusOne, fiveTimes]);
// this is equivalent to plusOne(fiveTimes(10)) === 51
assert.equal(composition(10), plusOne(fiveTimes(10)));

That's it for today. Happy coding 💻!

Allons-y !

Omkar Patil — Thu, 23 Sep 2021 00:22:01 +0000

I fancy myself as a bit of a polyglot when it comes to programming languages. I have used a few over the years. More recently, I have been playing with Go and I like what I see. The design decisions resonate with me - smaller surface area, structs with functions and interfaces, concurrency, cross-compilation, robust standard library and many such. Pretty soon, it will have generics too. While the benefits of generics could be a debatable topic, I think it certainly helps in one area - standard, robust implementation of most commonly used collections. Look the vast (and more often than not, sprawling 😃) Java collections API and you'll get my point.

When it comes to practising, I don't get a chance to use it in my day job. There is only so much you can do by reading books, blogs etc. and playing with small code snippets. I was thinking about how to get more familiar with the language and had an epiphany 😇 - why not walk through a production-grade Go codebase to understand the nitty-gritty of the practical usage and learn about common idioms.

That's where NATS.io comes in. In its own words:

#NATSio is a secure connective technology for modern distributed systems at the edge and in the cloud. #CNCF

I had been using it more and more recently and find it a great little, very fast message broker. It's written in Go and as such, a perfect candidate for broadening my Go and distributed systems knowledge.

Plan

Let's get the lay of the land 🧐.

~/work/ws/github/nats-server on  project via 🐹 v1.17.1 took 35s
❯ scc . --by-file --ci --exclude-dir vendor -i go --not-match test.go --sort name --no-cocomo --no-complexity
-------------------------------------------------------------------------------
Language Files Lines Blanks Comments Code
-------------------------------------------------------------------------------
Go 69 78689 7860 10873 59956
-------------------------------------------------------------------------------
conf/fuzz.go 24 3 13 8
conf/lex.go 1214 94 159 961
conf/parse.go 437 49 61 327
internal/ldap/dn.go 305 14 15 276
logger/log.go 321 32 31 258
logger/syslog.go 132 19 28 85
logger/syslog_windows.go 112 18 23 71
main.go 122 12 19 91
server/accounts.go 4220 373 505 3342
server/auth.go 1135 80 169 886
server/ciphersuites.go 103 7 16 80
server/client.go 5233 541 960 3732
server/const.go 211 54 90 67
server/consumer.go 3147 330 405 2412
server/dirstore.go 706 50 54 602
server/disk_avail.go 38 4 16 18
server/disk_avail_openbsd.go 37 4 15 18
server/disk_avail_windows.go 21 3 14 4
server/errors.go 326 70 100 156
server/errors_gen.go 240 37 2 201
server/events.go 2189 185 288 1716
server/filestore.go 5498 631 680 4187
server/fuzz.go 47 7 13 27
server/gateway.go 3169 239 701 2229
server/jetstream.go 2172 231 220 1721
server/jetstream_api.go 3585 470 356 2759
server/jetstream_cluster.go 5033 537 450 4046
server/jetstream_errors.go 102 18 5 79
~jetstream_errors_generated.go 1706 324 226 1156
server/jetstream_events.go 257 38 48 171
server/jwt.go 224 11 26 187
server/leafnode.go 2555 244 492 1819
server/log.go 244 36 45 163
server/memstore.go 855 101 87 667
server/monitor.go 2664 219 254 2191
server/monitor_sort_opts.go 150 33 32 85
server/mqtt.go 4013 337 743 2933
server/nkey.go 46 6 18 22
server/ocsp.go 805 97 85 623
server/opts.go 4662 263 394 4005
server/parser.go 1270 30 63 1177
server/pse/pse_darwin.go 86 11 27 48
server/pse/pse_freebsd.go 85 8 61 16
~rver/pse/pse_freebsd_amd64.go 91 13 42 36
server/pse/pse_linux.go 127 20 25 82
server/pse/pse_openbsd.go 36 3 15 18
server/pse/pse_rumprun.go 25 4 14 7
server/pse/pse_solaris.go 23 3 13 7
server/pse/pse_windows.go 280 35 52 193
server/raft.go 3303 350 298 2655
server/reload.go 1822 192 305 1325
server/ring.go 77 9 23 45
server/route.go 2031 213 380 1438
server/sendq.go 128 14 14 100
server/server.go 3500 385 610 2505
server/service.go 28 4 16 8
server/service_windows.go 130 17 31 82
server/signal.go 177 14 28 135
server/signal_windows.go 105 14 16 75
server/store.go 441 43 56 342
server/stream.go 3566 379 378 2809
server/sublist.go 1534 136 206 1192
server/sysmem/mem_bsd.go 20 3 13 4
server/sysmem/mem_darwin.go 20 3 13 4
server/sysmem/mem_linux.go 27 4 13 10
server/sysmem/mem_windows.go 46 5 14 27
server/sysmem/sysctl.go 31 4 14 13
server/util.go 223 23 60 140
server/websocket.go 1397 100 215 1082
-------------------------------------------------------------------------------
Total 69 78689 7860 10873 59956
-------------------------------------------------------------------------------
Processed 2195116 bytes, 2.195 megabytes (SI)
-------------------------------------------------------------------------------

So, 69 source files and 59956 lines of code, that's it 😃!

Well, it won't be optimal going over each and every line. I'll divide it into major areas and will go over relevant source code in subsequent posts.

That's enough of an introduction 😃. I'm pretty excited about this. Stay tuned for more!

Kubernetes services and Azure load balancers

Omkar Patil — Sun, 05 Sep 2021 15:51:06 +0000

Azure Kubernetes Service (AKS) makes use of many core Azure resources to provide the necessary functionality. In this post, we'll take a look at how Kubernetes LoadBalancer services and Ingress are mapped to an Azure Load Balancer.

Cluster creation

During the AKS cluster creation process, a public load balancer is created in the infrastructure resource group of the cluster.

You can see the load balancer and its public IP address in the resources list of the infrastructure resource group.

If we look at the IP address details, we can see it is being used to provide outbound connectivity from the cluster.

Kubernetes LoadBalancer services

Now let's create a simple Kubernetes LoadBalancer service.

apiVersion: v1
kind: Service
metadata:
  name: public-svc
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: public-app

The service gets a new public IP address.

And the new address is associated with the existing load balancer.

A look at the rule associated with this address tells us that it manages the inbound traffic to the service.

Ingress controllers

Now let's see how an Ingress controller is associated with a load balancer.

I created a separate public IP address (20.81.68.54) in the infrastructure resource group to be used for the Ingress controller.

Let's deploy a NginX Ingress controller using Helm.

helm install nginx-ingress ingress-nginx/ingress-nginx \
  --create-namespace \
  --namespace ingress-ns \
  --set controller.replicaCount=2 \
  --set controller.ingressClass=nginx \
  --set controller.nodeSelector."beta\.kubernetes\.io/os"=linux \
  --set defaultBackend.nodeSelector."beta\.kubernetes\.io/os"=linux \
  --set controller.admissionWebhooks.patch.nodeSelector."beta\.kubernetes\.io/os"=linux \
  --set controller.service.loadBalancerIP="20.81.68.54"

We can verify the public IP address has been associated with the Ingress controller.

Now if we check the load balancer again, we can see it manages the traffic for the Ingress IP address too.

The rules associated with this IP address show that it manages the inbound http and https traffic to the ingress controller.

Using internal load balancer

So far, we have been making services available publicly. To restrict access to services to the same virtual network as the AKS cluster, we can make use of an internal load balancer.

Let's create a new Ingress controller which will use an internal load balancer.

helm install nginx-ingress ingress-nginx/ingress-nginx \
  --create-namespace \
  --namespace ingress-ns-internal \
  --set controller.replicaCount=2 \
  --set controller.ingressClass=nginx-internal \
  --set controller.nodeSelector."beta\.kubernetes\.io/os"=linux \
  --set defaultBackend.nodeSelector."beta\.kubernetes\.io/os"=linux \
  --set controller.admissionWebhooks.patch.nodeSelector."beta\.kubernetes\.io/os"=linux \
  --set-string controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-internal"="true"

The annotation service.beta.kubernetes.io/azure-load-balancer-internal"="true" will result in creation of an internal load balancer in the infrastructure resource group of the cluster.

The internal load balancer gets a dynamic IP from the cluster subnet.

Conclusion

We get one public Azure load balancer for an AKS cluster and all the traffic on the public IP addresses associated with the Kubernetes LoadBalancer services and Ingress controllers is managed by it.

We can additionally create an internal load balancer to restrict traffic to the same virtual network as the AKS cluster.

Exploring linux underpinnings of containers

Omkar Patil — Tue, 31 Aug 2021 22:02:25 +0000

Some time ago, I played around linux primitives that power containers and documented my learnings on Github. Hope it proves useful to someone trying to do the same.

shikshan / containers

Exploring the linux underpinnings of docker and containers

How containers work

Exploring the linux underpinnings of docker and containers.

References

All credit goes to the authors of the following wonderful blog posts.

Setup

The project contains a Vagrantfile that runs a Fedora 31 VM.

Setup the VM using: ./setup.sh.

The project root directory on the host is mapped to /vagrant in the guest. All the action below takes place in the /vagrant directory in the guest. Change into /vagrant directory in the VM before carrying out steps below:

$ vagrant ssh
Last login: Sun Nov 24 19:06:40 2019 from 10.0.2.2
[vagrant@localhost ~]$ cd /vagrant
[vagrant@localhost vagrant]$

Container file systems

Container images are just tarballs (or a tarball of tarballs where each layer in an image is a tarball).

Creating a container file system

The easiest way to get a container file system is to export it from any existing docker container on…

View on GitHub

Two node Kafka development cluster using docker

Omkar Patil — Tue, 31 Aug 2021 01:30:10 +0000

Here is a docker-compose yaml file to start a two Kafka cluster and kafdrop ui for a quick local development setup.

# STARTING UP: docker-compose up --remove-orphans -d
# STOP: docker-compose down
# CHECK LOGS: docker-compose logs -f -t
version: '3'

networks:
  kafka-net:
    driver: bridge

services:
  zookeeper:
    image: bitnami/zookeeper
    networks:
      - kafka-net
    ports:
      - '2181:2181'
    environment:
      - ALLOW_ANONYMOUS_LOGIN=yes
    # volumes:
    # - ./data/zookeeper/data:/data
    # - ./data/zookeeper/datalog:/datalog
  kafka1:
    image: bitnami/kafka
    networks:
      - kafka-net
    ports:
      - '9091:9091'
    environment:
      - KAFKA_CFG_BROKER_ID=1
      - KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
      - ALLOW_PLAINTEXT_LISTENER=yes
      - KAFKA_CFG_LISTENERS=INTERNAL://:19091,EXTERNAL://:9091
      - KAFKA_CFG_ADVERTISED_LISTENERS=INTERNAL://kafka1:19091,EXTERNAL://localhost:9091
      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=INTERNAL:PLAINTEXT,EXTERNAL:PLAINTEXT
      - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=INTERNAL
      - KAFKA_CFG_AUTO_CREATE_TOPICS_ENABLE=true
    # volumes:
    # - ./data/kafka1/data:/var/lib/kafka/data
    depends_on:
      - zookeeper
    restart: always
  kafka2:
    image: bitnami/kafka
    networks:
      - kafka-net
    ports:
      - '9092:9092'
    environment:
      - KAFKA_CFG_BROKER_ID=2
      - KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
      - ALLOW_PLAINTEXT_LISTENER=yes
      - KAFKA_CFG_LISTENERS=INTERNAL://:19092,EXTERNAL://:9092
      - KAFKA_CFG_ADVERTISED_LISTENERS=INTERNAL://kafka2:19092,EXTERNAL://localhost:9092
      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=INTERNAL:PLAINTEXT,EXTERNAL:PLAINTEXT
      - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=INTERNAL
      - KAFKA_CFG_AUTO_CREATE_TOPICS_ENABLE=true
    # volumes:
    # - ./data/kafka2/data:/var/lib/kafka/data
    depends_on:
      - zookeeper
    restart: always
  kafdrop:
    image: obsidiandynamics/kafdrop
    networks:
      - kafka-net
    restart: 'no'
    ports:
      - '9000:9000'
    environment:
      - KAFKA_BROKERCONNECT=kafka1:19091,kafka2:19092
    depends_on:
      - kafka1
      - kafka2

Setting up a Kubernetes cluster in Azure

Omkar Patil — Fri, 27 Aug 2021 23:47:20 +0000

All the major cloud providers provide managed Kubernetes services these days that are an apt choice for production environments. I was curious about the mechanics of cluster setup and therefore created a tiny two node cluster in Azure using Kubeadm tool just for learning purpose. While the authoritative source of information is of course Kubernetes documentation, here are some quick notes.

Creating VMs in Azure

It's a good idea to create all Azure resources under one Resource Group. You can then delete all of those in one go once you are done by deleting the RG.
Creating a SSH key in Azure and using it to log into different VMs makes life so much easier. Here is how you can do it. Create it with a name of your choice (azureuser in this post) as shown in the screenshot below:

After creation, Azure will prompt for saving the generated private key file. Download it and keep it at a known location on your machine, e.g. ~/.ssh/azureuser.pem. Change the permissions - chmod 400 azureuser.pem.
Create a virtual network with required address range, for example: 10.100.0.0/24 (10.100.0.0 - 10.100.0.255). IPv4 CIDR Calculator is a handy tool to calculate CIDR IP range.
Adjust the default subnet IP range under the virtual network to 10.100.0.0/25 (10.100.0.0 - 10.100.0.127). We'll use this subnet for the Kubernetes cluster.
Create a Network Security Group and associate it with the default subnet. The inbound and outbound rules provided out-of-the-box are good enough.
I always use bastion service to avoid exposing VMs to internet. You can either associate an existing bastion or create a new one while creating a VNET. In Azure portal, a new bastion can be created while creating a VNET from the Security tab as shown in the screenshot below:
- Give the bastion a name of your choice.
- Use 10.100.0.128/27 (10.100.0.128 - 10.100.0.159) as AzureBastionSubnet address space. Azure requires the exact name AzureBastionSubnet for the subnet to be used for the bastion.
- Select Create New for the Public IP address field and give a name to it.
Create two virtual machines: one to be used as Kubernetes master node and the other as a worker node.
- Use the latest Ubuntu Server LTS image.
- Standard_B2ms size with 2 vcpus, 8 GiB memory and 30 GiB disks will suffice for our learner's cluster.
- Use SSH public key authentication option with azureuser as username and use the SSH key created earlier as value for Use existing key stored in Azure option.
- Select None for Public inbound ports.
- Use the virtual network and default subnet created earlier in the networking options. Set Public IP to None. Select None for NIC network security group.
Start the VMs and connect using Bastion option. Use azureuser as username, SSH Private Key from Local File as Authentication Type and select the previously saved pem file through Local File option.

Setting up Kubernetes cluster

Installations

Install the required software on both master and worker node VMs.

Install container runtime. We'll use CRI-O.

cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

# Setup required sysctl params, these persist across reboots.
cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF

# Apply sysctl params without reboot
sudo sysctl --system

# Install CRI-O
OS=xUbuntu_20.04
VERSION=1.22
cat <<EOF | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/ /
EOF
cat <<EOF | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.list
deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$VERSION/$OS/ /
EOF

curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/Release.key | sudo apt-key --keyring /etc/apt/trusted.gpg.d/libcontainers.gpg add -
curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/Release.key | sudo apt-key --keyring /etc/apt/trusted.gpg.d/libcontainers.gpg add -

sudo apt-get update
sudo apt-get install cri-o cri-o-runc

# Start CRI-O
sudo systemctl daemon-reload
sudo systemctl enable crio --now

Install Kubernetes packages.

sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl
# Download the Google Cloud public signing key
sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg

# Add the Kubernetes apt repository
echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

sudo apt-get update
# install kubeadm, kubelet, and kubectl
sudo apt-get install -y kubelet kubeadm kubectl
# Pin the installed packages at their installed versions
sudo apt-mark hold kubelet kubeadm kubectl

Create a cluster

Run the following steps on master node VM.

# Make sure that your Pod network does not overlap with any of the host networks
sudo kubeadm init --pod-network-cidr 192.168.0.0/16

# Copy the join command printed in the output. We'll need it later on worker.

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

# Use Calico networking plugin
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

Confirm the master node is running: kubectl get node.

Run the following commands on worker node VM.

# Run the join command coped from master
sudo kubeadm join 10.100.0.4:6443 --token w5ukck.qhuw0s86gd7dsxv5 --discovery-token-ca-cert-hash sha256:31401ee3712a958829d846cf9d1417325f9c1508a8113549ef1a41a7ce2eee7d

If you forget to copy the join command, it can be regenerated on the master node using: kubeadm token create --print-join-command.

Verify that the worker has joined the cluster by running kubectl get nodes again on master.

To stop the cluster, stop the worker node first followed by master node and other way round while starting up.

That's all for today. Happy coding! À bientôt 🙋‍♂️!

Protocol translation in NestJS microservices

Omkar Patil — Thu, 19 Aug 2021 20:31:06 +0000

Making async microservices talk to clients that use "standard" web-friendly API protocols (think mobile and web applications) requires protocol translation. Here is a very simple idea, inspired by nats proxy project, on how to achieve it in NestJS with NATS microservice transport.

The complete source code for this article is available on Github. The README provides the setup and usage instructions as well as main files to look at. It's a Nx Monorepo that contains the following two applications:

Gateway : This application exposes REST interface to clients, receives HTTP requests, dynamically forms the NATS subject name to send message to based on incoming request verb and path, sends the message to the subject, waits for NATS response from microservice and once received, sends out HTTP response back to client.
Microservice : This application listens on NATS subject and responds with a string message when invoked.

The overall interaction looks like this:

That's it for today. Happy coding! À bientôt 🙋‍♂️!