Posts

Context While investigating the latency of an API, I noticed that different Azure services were reporting different execution times for the same request. The caller reported a total duration of 851ms, APIM reported 845ms, and Application Insights showed that APIM waited 837.6ms for the Logic App to respond. However, the Logic App runtime view appeared to show only about 400ms of execution time. The request flows through APIM to a Logic App (Consumption), which performs some in-memory processing before invoking an HTTP endpoint as part of the workflow. ...

Part 5 established the tunnel and ended with a question - why does one of the traffic flows fail? Setting up a Site-to-Site VPN is one thing; understanding exactly how a packet traverses from an Azure VNet down to a local KVM bridge is another. This part takes a deeper look at the underlying networking layers, looking specifically at how XFRM policies, routing decisions, and iptables chains interact to manage hybrid traffic flow. ...

In the previous part, we established an on-premises identity foundation. The on-premises setup consists of a virtual network with Windows and Linux VMs joined to an on-premises Active Directory domain hosted on two domain controllers. In this part, we will create a VPN Gateway in Azure and a StrongSwan IPsec gateway on-premises and establish the Site-to-Site VPN tunnel — the foundation of our hybrid lab. Implementing a Site-to-Site (S2S) tunnel is simple — so rather than walking through the steps procedurally, I want to focus on what each component is actually doing. ...

Introduction I have been using the DefaultAzureCredential class for a long time without understanding how it works. So, I jotted down my notes and learnings in this write-up for future me — and maybe you will find it useful too. TokenCredential TokenCredential is the abstract base class representing a source of authentication tokens for Azure services. Many classes derive from TokenCredential but the most interesting ones are DefaultAzureCredential and ChainedTokenCredential. ...

I’ve long enjoyed Medium’s typography and uncluttered writing experience. I wanted to bring that same feel to my local writing workflow in VS Code, where I keep my articles in Markdown alongside the rest of my content. Keeping articles in Git makes them easier to version, manage, and publish, so moving my content to an Azure Static Website was straightforward. The harder part was adapting to writing in an interface other than the Medium editor that I had grown so used to. ...

Does APIM support zero downtime deployment? — To answer this question, multiple factors need to be ascertained, like, What is the SKU? Have you opted for Availability zones? etc. In fact, the question needs to be qualified further. What do you mean by zero downtime deployment? In the case of APIM, there are infrastructure changes and then there are gateway configuration changes like API specifications and policies. So, the answer depends on — SKU, AZ, “what” kind of changes ...

Recently, while setting up a Function App to use User Assigned Managed Identity (UAMI) to authenticate to its AzureWebJobsStorage I encountered SyncTriggerfailure. I checked whether the UAMI had necessary RBAC roles to work on AzureWebJobsStorage — it had. So, I wasn’t sure what the issue was. Analyzing further, I realized I had skipped a few mandatory variable settings to enable UAMI based authentication to AzureWebJobsStorage (setting the environment variable AzureWebJobsStorage__accountName alone does not suffice) ...

In the previouscreated a primary and secondary domain controller and tested the domain join from Windows client VM. In this part, we will domain-join a Linux VM to the domain controllers we created. The main purpose is to introduce a non-Windows system into the domain to test Kerberos authentication against Active Directory. We will — Provision a new Linux VM Assign the DC IP Install Linux Kerberos client tool Join the domain Validation ...

Previously, we created a domain controller (DC), joined a test virtual machine to the newly created domain and verified the authentication of a test user from client VM. In this part, we will build redundancy into our environment by introducing a second domain controller. Active Directory (AD) is designed for multi-master replication, meaning multiple domain controllers hold a copy of the directory database. Adding a second DC provides: High Availability — authentication continues if one DC fails Load Distribution — clients can authenticate against different DCs Replication Redundancy — AD database changes replicate automatically In this part, we will: ...

In the first part, we laid the foundation for the hybrid cloud environment. Now we have a virtual network with VM running Windows Server 2022 Evaluation. In this part, we will focus on adding the Identity plane to the hybrid cloud environment by introducing a domain controller and creating an Active Directory structure. We will create a client VM, domain join it and make sure a domain user is able to login ...