Fletcher Kelly

Enhancing Node-Red with GUIDs

Mon, 30 Jun 2025 12:47:26 GMT

Do you have a lot of automation in your house using Node-RED and are you looking for a way to increase the possibility of finding a faulty flow? If yes, follow me as I come up with a solution that might work for you as well.

This is a use case for me. Your mileage may vary. This will take some time.

Anything worth doing is worth doing well.

Background

So let me explain the problem and see if this sounds familiar. I use Node-RED A LOT along with Home Assistant. I made the decision a long time ago that the automations built into Home Assistant and the YAML engine was not for me. Please note that was quite a while, probably 5 or 6 years ago - the automation interface in Home Assistant is so much better now, however I am heavily invested in Node-RED and will not be going back anytime soon.

So what is the problem?

I have a lot of flows and nodes in my environment. I make heavy use of links and try to centralize as much as possible and use links (link in and link out) to ensure that the actions I perform are consistent. When you get to the size of my installation (over a 100 flows), troubleshooting and figuring out erratic or intermittent issues can be challenge. With all the wiring and multiple nodes and linking and multiple condition checking - it can become overwhelming to figure out where the problem starts and ends.

How did I fix this?

I have spent time and this will be an on-going process to add GUIDs (yes, those long 32 digit things that are now everywhere) and simple use of a subflow. The subflow I created is simply used right at the beginning of my flow and its Globally Unique IDentifier now allows me to at least back-track to the start of the problematic flow and if the debug nodes returns more than 1 GUID that is also helpful.

So a simple enough change, but time-consuming to implement.

Click image to view full size.

Here is the export of my subflow - feel free to use it.

[{"id":"f44cf6f9b8f814e3","type":"subflow","name":"Flow Trace Tagger (1)","info":"Adds msg.flow_origin and msg.flow_trace for debugging and traceability.\nSet the environment variable TAG_NAME when using this subflow.","category":"","in":[{"x":60,"y":80,"wires":[{"id":"6c2c2c6e8e2f886c"}]}],"out":[{"x":440,"y":80,"wires":[{"id":"6c2c2c6e8e2f886c","port":0}]}],"env":[{"name":"TAG_NAME","type":"str","value":""}],"color":"#FFD580","status":{"x":340,"y":380,"wires":[{"id":"0df253ebbfe15d99","port":0}]}},{"id":"6c2c2c6e8e2f886c","type":"change","z":"f44cf6f9b8f814e3","name":"Set flow trace tags","rules":[{"t":"set","p":"flow_origin","pt":"msg","to":"$env('TAG_NAME') != '' ? $env('TAG_NAME') : 'Unlabeled Flow'","tot":"jsonata"},{"t":"set","p":"flow_trace","pt":"msg","to":"$now() & ' - ' & ($env('TAG_NAME') != '' ? $env('TAG_NAME') : 'Unlabeled Flow')","tot":"jsonata"}],"x":250,"y":80,"wires":[["363a78cde4fa6638"]]},{"id":"0df253ebbfe15d99","type":"status","z":"f44cf6f9b8f814e3","name":"","scope":null,"x":180,"y":380,"wires":[[]]},{"id":"363a78cde4fa6638","type":"function","z":"f44cf6f9b8f814e3","name":"status","func":"//var date = new Date();\n//var dateTime = date.toLocaleString(); // Format the date and time\n\n// In our `msg.payload` the `title` attribute contains the name of the game.\nvar statusText = msg.flow_trace;\n\n// `node.status` will display the actual status below your function node using\n// the data you provide here.\nnode.status({ fill: \"blue\", shape: \"ring\", text: statusText });\nreturn msg;\n","outputs":1,"timeout":0,"noerr":0,"initialize":"","finalize":"","libs":[],"x":490,"y":200,"wires":[[]]}]

Example flow, this is just a simple example to show how everything stitches together.

Click image to view full size.

Configuration of sub-flow

Click image to view full size.

Debug node

Click image to view full size.

Is it worth it?

Well, that depends on you and how much and effort you want to spend making your automation system resilient, robust and easy to troubleshoot.

For me, absolutely **YES, **however in the last while the Automation capapbilities in Home Assisatant have improved greatly. Maybe I will look into this at some time in the future.

Using the Pinchflat YouTube Downloader

Thu, 21 Nov 2024 16:23:31 GMT

Are you tired of buffering videos and unreliable internet connections when trying to watch your favorite YouTube content? Look no further! In this post, I’ll introduce you to Pinchflat, a powerful tool that allows you to download YouTube videos effortlessly. Inspired by a mention on the Self-Hosted Podcast, I decided to give Pinchflat a try and share my experience with you.

I am an avid listener of the Self-Hosted Podcast, and on a recent episode, they mentioned a new tool called Pinchflat. Naturally, I decided to give it a try. I’ve already starred the repo, which is a great way to support the open-source community.

Installation

There are specific unRAID installation instructions, and thanks to the great community around unRAID, the installation was a breeze.

Using unRAID, I was able to install Pinchflat via the Community App plugin. The tool is fairly intuitive and easy to use. I managed to download a few videos from YouTube without any issues. I’m the type of person who tries first and then reads the manual, so I didn’t read the manual initially. Despite this, I was able to figure out how to use the tool without any problems.

Usage

I follow several people and channels on YouTube and like to download their videos to watch later. This tool makes it easier to download videos and watch them at my convenience.

Currently, I’m consuming a DevOps Master Class by John Savill. Pinchflat was one of the first items I added to my list, and it works as expected. Now, I can watch the videos offline using JellyFin. Please make a point of liking and subscribing to John’s channel; he has some great content. Then, you can make the content available offline 😊.

Conclusion

I am now using Pinchflat to monitor many other YouTube users and channels. For me, this is a great way to have the content downloaded and ready for when I have time to watch it.

Happy downloading!

Time to get my “print” on

Fri, 20 Sep 2024 11:48:40 GMT

Exciting times ahead! As I mentioned in my earlier post, I have been eagerly waiting for my new 3D printer to arrive. After much consideration, I decided to go with the Bambu Lab P1S. For now, I opted not to get the bundled AMS unit. In this post, I’ll share why I chose this version over others and my initial impressions.

P1P: Great price but not enclosed, whilst I do not need the enclosure now, I think that this allows more filament types to be used. Yes, I can enclose the P1P after the fact with an official upgrade. I did some quick maths, and determined at the price I got it for, it simply made sense as the upgrade would cost after the fact.

X1C: I could not justify this price for what I need this for, my use case is printing replacement parts for upgrades, house items and very basic items that I design (I am dipping my toe in Fusion 360, this makes a 3D printer truly useful). I am also using my 3D printer for management items like Multiboard and Gridfinity. It does have a really nice touch screen and yes the frame rate for the camera is MUCH better than the 1fps camera on the P1S.

AMS: A very simple and easy plug and play upgrade, I am going to focus on learning this printer and getting the basics right before I go high-tech with an AMS. In time, YES but not right now.

There are a lot of upgrades and changes you can make or print for the P1S. There is an aftermarket screen – the BIGTREETECH Panda Touch V1.0 – 5 Inch Touch Screen with Multi-Printer, Wireless Control For Bambu Lab X1, P1 and A1 Printers and the camera can be addressed in other. This is where I would like to focus my time, add-ons and changes to the printer WITHOUT worrying about the print quality, time and speed.

And a quick video of the printer in action. Thank you to this for the video shortcode and the resulting video below.

Here is a sample print.

More on this printing journey to come. Until then, happy printing.

Planning for my new 3D printer

Thu, 12 Sep 2024 12:54:34 GMT

So, I have been 3D printing for a little while now. Not as long as many, but a little while. It has been about 4 years now, when I get my first and currently only 3D printer. So where have I come from and what is next on my 3D printing journey?

My journey started with a Creality Ender 3 Pro, I was lucky enough to get a slightly more polished version with the “PRO” version. I am a tinkerer by nature and I learn the most by doing.

My Ender 3 Pro is VERY FAR from stock, it did not remain stock for very long, like I said “I learn by doing“. So what have I done to this printer?

Changed from Creality build to Marlin
Marlin 1.0 -> Marlin 2.0
Added BLTouch
Custom wiring and extensions
External MOSFETs added for bed and nozzle heating
Install Octoprint
Custom printed control box
Marlin 2.0 -> Klipper
Added a camera, multiple actually
Install Mobileraker
Added Runout Sensor – BTT SFS 2.0
Added KlipperScreen with BTT HDMI 5.0
Upgraded to Direct Drive – Orbiter 2.0
Upgraded to Apogee
Move Klipper from RPI3 to an Intel NUC (Yes, it is possible, just needs time, patience and perseverance)

Like I said, done a few things 😊

So, what did this lead to?

I learned a lot about 3D printers and how they work. Broke some parts, replaced many more, clogged nozzles, cleaned nozzles. I have had some amazing prints but I have also spent countless hours debugging, tweaking and searching online.

NOW, I am looking for a workhorse, something that just prints and prints well all the time (ok, most of the time – cannot be all the time – this is simply not possible). I am happy about the learning and the like and that knowledge will still used with the new printer and helping others in the 3D Printing community. It is however time for something new – a workhorse if you will.

Can you guess which printer I have ordered as a replacement?

What is a PV Fireman Switch?

Tue, 03 Sep 2024 16:00:15 GMT

Join me as I dive deeper into my Solar system and learn more about how it works in detail and maintain the system as items age/break (everything breaks eventually), so let’s learn about a PV Fireman switch.

Definition of PV Fireman Switch

“Automatically disconnects the DC supply on a Solar PV system when the AC grid supply is interrupted. When installed at the point of cable entry into the premises, this product creates a safe environment for Firefighters.”

So what does this actually mean and what happens if it stops working as expected?

In essence, you can think of the PV Fireman Switch as a DC Relay, that is in the “Normally Open” (NO) position. By default it makes sure that the circuit is open. So when there is no AC power being provided, the switch is in NO position so the voltage from the PV panels will NOT reach your inverter and possibly back-feed. When AC power is provided to the unit, it will close the circuit – “Normally Closed” – and allow the voltage to flow to the inverter and allow the inverter to perform its tasks as normal.

So, why is this needed with on-grid systems?

It is a safety feature. Imagine this scenario, the entity responsible for maintaining the grid and electricity needs to performs works on the grid, so they stop the supply (Hopefully with warning you 😊). Under normal circumstances there would be no voltage on any on the networks, however with Solar PV, many of us can back-feed into the grid and get credits and this is the where the need for this device comes in. If you did NOT follow standards and this device installed, you would now back-feed into the grid and turn the grid live again and risk injuring maintenance staff.

What happens if it “breaks”?

This device consists of electronics and can only handle so much “abuse” (read power trips and power fluctuations), and can fail. Mine did, so what happens now? In essence, your PV panels become irrelevant and the voltage being generated by them is basically dropped to nominal voltage (0-2 V) and the inverter will run only off of batteries or pull power from the grid.

Can I fix it?

The unit is NOT designed to be repaired, it is NOT field replaceable. It is delivered pre-wired and not meant to have items replaced. This ensures that a standard is used. This is my unit that failed and yes it was replaced.

It must be replaced, it is an easy enough job to perform as long as your system is well labelled (which it should be already). It has a label for PV IN and PV OUT and the connection for the AC supply is well marked. Replace your unit and you are up and running again.

Until next time.

Using the AZ Rest CLI command

Thu, 29 Aug 2024 16:00:56 GMT

What are we doing?

With this post I am going to show you how you can easily do Azure API calls and “skip” a lot of the difficult items. I have been on something interesting tools to help my customers, when I can talk more about it, I will. As part of this tooling exercise, the Azure REST API is used extensively. With “normal” applications like APIDog, ThunderClient and the like, you often need to get a token and then add this to the header as an auth object and this involves configuration on EntraID and the like. This is not necessarily the best approach for what I was looking for. I was looking for a quick testing framework for Azure REST API calls and then look at the output to be further extracted / manipulated with JQ.

These are the principal / considerations

This is NOT designed to replace a full API solution like APIDog or Postman or ThunderClient
Designed for quick queries against the Azure REST API
Uses the currently logged on person credentials to run queries

Ok, so down to business, the tool/command that I am using is “az rest”. Using this tool is quite easy but thanks to some additional insights from a colleague in my team you can make it even easier. So, how do we use the command. Let’s say we wanted to make the following request – Virtual Machines – List.

The command looks like this.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines?api-version=2024-07-01

We need to provide some variable(s) or information as marked by items in braces (“{}”), so we need to provide “subscriptionId” and “resourceGroupName”. I will endeavour to provide as much information as possible, however for safety reason, some items will be obfuscated.

Please remember to login first az login, as the az rest command uses the context of the currently authenticated to Azure user, hence no auth tokens.

Here is a quick shell script to show this and allow you to test.

# Set your variables here
subscriptionId="<your_subscription_id>"
resourceGroupName="<your_resource_group_name>"
 
# Construct the URL
url="https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Compute/virtualMachines?api-version=2024-07-01"
 
# Use az rest command
az rest --method get --url $url

You will get a result similar to the below,

For me and the testing I am doing, this is a great, rapid and repeatable way of testing queries and quickly testing if the URI is valid before spending many hours troubleshooting the “why is this not working” versus “is my URI correct”.

What is also quite handy is the fact that the “https://management.azure.com” aspect can be dropped as this is already assumed, and as such you run a query directly against the ID to get more information or an ID returned from an Azure Resource Graph Query, with the correct API version appended in this example

Without the API Version appended

With the correct API version appended 👍

You can now do the same process with other IDs that are returned.

Azure VMware Solution How Do I 'Monitor my SDDC Deployment'

Tue, 21 Nov 2023 09:54:43 GMT

What are we doing?

As I spend more time with my customers and my teams within my organization, I am learning that there a lot of aspects of Azure VMware Solution that we take for granted and simply skim over as we assume (badly) that everyone knows exactly how to “the basics”. With this series of “How Do I” posts, I am going to try and address some of the more common questions that I get asked and hopefully provide some useful information to help you on your Azure VMware Solution journey. I will endeavour to copy as many topics as I can and I am always open to ideas and suggestions. You can reach out to me on Twitter or post a suggestion for the log on GitHub - please remember these are designed to be short and sweet and not full blown tutorials.

For the start of this “series”, it will most likely cover topics or aspects that affect me day to day with multiple deployments and customers. As time goes on, I will try and expand the topics to cover more and more aspects of Azure VMware Solution.

How do I monitor an Azure VMware Solution deployment?

I often need to to deploy an !avsAzure VMware Solution Software Defined Data Center (SDDC) and then monitor the deployment to ensure that it is successful. I have a PowerShell script that monitors this for me and allows me to continue with other work. It works by getting the deployment status of the SDDC and then checking the status every 5 minutes until the deployment is complete. Once the deployment is complete, it will display a completed message and then you add whatever notification method you want. I save this file as deployment-check.ps1.

I am well aware and hve contributed to the Enterprise-Scale-For-AVS, these are designed to augment this or to be used on their own and are not a replacement for the Enterprise-Scale-For-AVS scripts - if used by your organization.

I do have a bit of a backlog for some of these “how-to’s” so I will try and get them out as quickly as I can. If you have any suggestions or ideas, please let me know.

<#
.SYNOPSIS
This script checks the deployment status of private clouds and monitors the provisioning process.

.DESCRIPTION
The script prompts the user to monitor a deployment or skip the deployment check. If the user chooses to monitor, it retrieves a list of private clouds and allows the user to select a private cloud to check the deployment status. It then continuously checks the provisioning status of the selected private cloud until it is no longer in the "Building" state.

.PARAMETER None

.INPUTS
None

.OUTPUTS
None

.EXAMPLE
.\deployment-check.ps1
Prompts the user to monitor a deployment and select a private cloud to check the deployment status.

.NOTES
Author: Your Name
Date: Current Date
#>

#deployment check
Write-Output "Waiting 60 seconds before checking deployment status"
Start-Sleep -s 60
$YesOrNo = Read-Host "Do you need to monitor a deployment (y/n)"
while("y","n" -notcontains $YesOrNo ) {
 $YesOrNo = Read-Host "Please enter your response (y/n)"
}
if ($YesOrNo -eq "y") {
    Write-Output "Monitoring deployment"
} else {
    Write-Output "Skipping deployment check"
    break
}

$privateClouds = Get-AzVMwarePrivateCloud
[int]$privateCloudCount = $privateClouds.count
Write-output "Found $privateCloudCount private clouds"

$i = 0
foreach ($privateCloud in $privateClouds)
{
  $cloudValue = $i
  $cloudText = [string]$cloudValue + " : " + $privateCloud.Name + " ( " + $privateCloud.ResourceGroupName + " )" + ":" + $privateCloud.Location
  Write-output $cloudText
  $i++
}
Do 
{
  [int]$privateCloudChoice = read-host -prompt "Select a private to check deployment & press enter"
} 
until ($privateCloudChoice -le $privateCloudCount)
$selectedprivateCloud = "You selected " + $privateClouds[$privateCloudChoice].Name
Write-output $selectedprivateCloud

$privateCloudRgName = $privateClouds[$privateCloudChoice].resourcegroupname
$privateCloudLocation = $privateClouds[$privateCloudChoice].location
$cloudName = $privateClouds[$privateCloudChoice].name
$privateCloud = Get-AzVMwarePrivateCloud -ResourceGroupName $privateCloudRgName -Name $cloudName

do {
    $privateCloud = Get-AzVMwarePrivateCloud -ResourceGroupName $privateCloudRgName -Name $cloudName
    $provisioningStatus = $privateCloud.provisioningState
    $timestamp = get-date -Format "dd-MM-yyyy - HH:mm:ss"
    switch ($provisioningStatus) {
        "Building" 
        {
            $statusMessage = "Provisioning status for $cloudName is : " +    $provisioningStatus + " ($timestamp)"
            Write-Output $statusMessage
            Start-Sleep -Seconds 300
       }
        "Succeeded"
        {
            $statusMessage = "Provisioning status for $cloudName is : " + $provisioningStatus + " ($timestamp)"
            Write-Output $statusMessage
            break
       }
        Default
        {
            Start-Sleep -Seconds 300
            $statusMessage = "Provisioning status for $cloudName is : " + $provisioningStatus + " ($timestamp)"
            Write-Output $statusMessage
        }
   }
   } until ($provisioningStatus -ne "Building" )

Azure VMware Solution Starter Links

Thu, 26 Oct 2023 09:23:27 GMT

What are we doing?

Providing people with a list of useful links and blog posts to help you get grounded in Azure VMware Solution. Some of the links are very high-level and others are very detailed. Each link or blog post will address different items at different depths so you can hopefully find the exact link or information that you are looking for to make your journey in Azure VMware Solution a little easier.

Azure VMware Solution Architecture

Topic	Reference
Architectural components	• Introduction - Azure VMware Solution
Network & connectivity architecture(s)	• Enterprise-scale network topology and connectivity for Azure VMware Solution - Cloud Adoption Framework
Service Level Agreement requirements	• Licensing Documents (microsoft.com) - Download the latest version available and search for “Azure VMware Solution”

Azure VMware Solution Design

Topic	Reference
Azure VMware Solution Azure Landing Zone Checklist	• Azure/review-checklists
SDDC & cluster design considerations	• Private clouds and clusters - Azure VMware Solution • Deploy vSAN stretched clusters - Azure VMware Solution
BCDR considerations	• Enterprise-scale BCDR for Azure VMware Solution - Cloud Adoption Framework
Connectivity design considerations	• Enterprise-scale example architectures connectivity to Azure VMware Solution - Cloud Adoption Framework • Network Design Guide for Azure VMware Solution - Microsoft Community Hub
Identity & Access Management considerations	• Enterprise-scale identity and access management - Azure VMware Solution - Cloud Adoption Framework • Configure LDAPS within Azure VMware Solution - Microsoft Community Hub
Storage considerations	•Management and monitoring for Azure VMware Solution - Cloud Adoption Framework • Storage - Azure VMware Solution
Security considerations	• Security recommendations for Azure VMware Solution - Azure VMware Solution • Azure security baseline for Azure VMware Solution • Security, governance, and compliance disciplines for Azure VMware Solution - Cloud Adoption Framework

Azure VMware Solution Management and Operations

Topic	Reference
Hybrid management considerations	• Azure Arc-enabled servers Overview - Azure Arc
Governance considerations	• Azure VMware Solution - Platform management • Security, governance, and compliance disciplines for Azure VMware Solution - Cloud Adoption Framework
Log management considerations	• Configure VMware syslogs for Azure VMware Solution - Azure VMware Solution • Management and monitoring for Azure VMware Solution - Cloud Adoption Framework
Performance monitoring considerations	• Configure alerts and work with metrics in Azure VMware Solution - Azure VMware Solution • Management and monitoring for Azure VMware Solution - Cloud Adoption Framework
Alerting considerations	• Management and monitoring for Azure VMware Solution - Cloud Adoption Framework
Elevated operations (run-commands)	• Concepts - Run Command in Azure VMware Solution (Preview) - Azure VMware Solution
Azure VMware Solution Design Series	• Azure VMware Solution Availability Design Considerations • Azure VMware Solution Recoverability Design Considerations • Azure VMware Solution Performance Design Considerations

Azure VMware Solution Migrate

Assessment

Topic	Reference
Migration Assessment with Azure Migrate	• Create an Azure VMware Solution assessment with Azure Migrate - Azure Migrate
RVTools	• Azure VMware Solution capacity planning - Azure Solution Ideas • RVTools - The Ultimate free VMware Tool you need to have!

Migration Tooling

Topic	Reference
HCX	• Move on-premises VMware infrastructure to Azure VMWare Solution - Cloud Adoption Framework
Zerto	• Zerto on Microsoft Azure - Data Protection & Recovery - Zerto
Veeam	• KB4012: Azure VMware Solution Support - Considerations and Limitations (veeam.com)
Deploying HCX	• Install and activate VMware HCX in Azure VMware Solution - Azure VMware Solution
Configuring HCX	• Configure VMware HCX in Azure VMware Solution - Azure VMware Solution

Topic	Reference
Azure VMware Solution Road map	• Azure updates - Azure VMware Solution

Starting Wth Rest Calls With AzCli With Some Copilot Help

Wed, 11 Oct 2023 12:34:50 GMT

What are we doing?

I am working more and more with the Azure REST APIs now. My previous post using API with Powershell got me thinking about opening the idea to go beyond PowerShell. I am very open with people around my lack of skill with Azure CLI, I do however want to learn some new things.

We also have this great technology called GitHub Copilot and ChatGPT, so I figured let me dig into “AI” as I am a techy at heart and let me improve my skills with Azure CLI.

As a result, the script below actually has two “flavours” or options available in certain places. This is simply because the two different AI’s have different suggestions. I have left both in as I think it is interesting to see the differences and they actually work in slightly different ways. The one approach is to use the context of the currently logged on person and the other uses the “traditional” approach of using an app registration.

Constraints / limitations

Primary focus is on the Azure API.
Using Azure Tokens.
Enterprise Application is already registered. (Not strictly needed for the CLI version that uses the currently logged on person’s context.)
You have securely stored your secret for the above point.
Designed to be modular - so you can run these in snippets/sections.
This is NOT PRODUCTION ready yet.

Lets build this

Reminder, you will need to have an Application ID, Secret value and Tenant ID on hand as these are needed as part of the API call. Here is a guide for registering an Azure AD application for testing purposes. Please note that additional controls are needed for production environments.

For production scenarios, secret management should be used as the variables should NOT be saved in the file, but instead in a Azure Keyvault and then read out as needed in the script/function/…

The process flow for this is as follows.
Perform a rest API Call to get a token -> Save Token in variable -> Use saved variable for subsequent calls.

Get Azure AD Token

In this script I am using prompts and obfuscating in the script with the use of the “-AsSecureString”. This will then save the acquired token in the $token variable.

#option 1

read -p "Enter your Azure tenant ID: " tenantId
read -p "Enter your Azure client ID: " clientId
read -s -p "Enter your client secret: " clientSecret
echo ""

accessToken=$(curl -X POST -d "grant_type=client_credentials&scope=https://management.azure.com/.default&client_id=$clientId&client_secret=$clientSecret" "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" | jq -r '.access_token')

echo "Token is $accessToken"

#option 2

az login --scope https://management.core.windows.net//.default

read -p "Enter your Azure tenant ID: " tenantId
#read -p "Enter your Azure client ID: " clientId
#read -sp "Enter your client secret: " clientSecret

authResult=$(az account get-access-token --tenant=$tenantId --query "accessToken" --output tsv)

if [ -z "$authResult" ]; then
    echo "Token is empty"
else
    # Output the access token
    token=${authResult#*\"access_token\":\"}; token=${token%%\"*}
    echo "Token is $token"
fi

Now we have our token and we can move onto the next phase, for this I am using a simple Rest API call to get my resource groups, but this token can be used for any api in the “https://management.azure.com/” scope, so this would NOT work for an Azure OpenAI Rest API call as the scope is different. A quick search with your choice of search engine will get the correct scope for that. I will create another blog about that soon.

Getting resource groups with an API call

You will see here that the API call needs authorization (US Spelling) and we are using the token from earlier “Authorization” = “Bearer $token”.

read -p "Enter your subscription ID: " subscriptionId
apiVersion="2020-09-01"

# step below can be used to get the access token for the current session
#accessToken=$(az account get-access-token --resource=https://management.azure.com --query accessToken -o tsv)

headers="Authorization: Bearer $accessToken"
uri="https://management.azure.com/subscriptions/$subscriptionId/resourcegroups?api-version=$apiVersion"
queryResult=$(curl -s -H "$headers" -X GET $uri)
echo $queryResult | jq -r '.value[] | {name: .name, location: .location}'

This same principle can be applied to any API call, just change the scope and the API call. I will be adding more to this as I go along, but this is a good start.

Starting Wth API Rest Calls With Powershell

Thu, 17 Aug 2023 08:09:54 GMT

What are we doing?

I am working more and more with the Azure REST APIs now. My first dive into cost management was a big hit, so I am expanding on that. The main consideration around that particular API is that is it open. By this, I mean a simple HTTP request will return results, no authentication or additional headers or the like are needed. So nice and easy. As we dive more into API and REST API’s, this is likely to change. This post, with more planned, is designed to make this easier and break it down into smaller chunks. THese chunks/snippets can be re-used and the principles in the chunks/snippets can be applied to other API’s. These in particular are aimed at Azure API’s.

Constraints / limitations

Primary focus is on the Azure API.
Using Azure Tokens.
Enterprise Application is already registered.
You have securely stored your secret for the above point.
Designed to be modular - so you can run these in snippets/sections.
This is NOT PRODUCTION ready yet.

Lets build this

For production scenarios, secret management should be used as the variables should NOT be saved in the file, but instead in a Azure Keyvault and then read out as needed in the script/function/…

The process flow for this is as follows.
Perform a rest API Call to get a token -> Save Token in variable -> Use saved variable for subsequent calls.

Get Azure AD Token

In this script I am using prompts and obfuscating in the script with the use of the “-AsSecureString”. This will then save the acquired token in the $token variable.

$tenantId = Read-Host "Enter your Azure tenant ID"
$clientID = Read-Host "Enter your Azure client ID"
$clientSecret = Read-host "enter your client secret" -AsSecureString

$normalString = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($clientSecret))

$params = @{
    Uri = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"
    Method = "POST"
    Body = @{
        grant_type = "client_credentials"
        scope = "https://management.azure.com/.default"
        client_id = $clientID
        client_secret = $normalString
    }
}

$authResult = Invoke-RestMethod @params

# Output the access token
$token = $authResult.access_token

Getting resource groups with an API call

You will see here that the API call needs authorization (US Spelling) and we are using the token from earlier “Authorization” = “Bearer $token”.

$subscriptionId = read-host "Enter your subscription ID"
$apiVersion = "2020-09-01"

$headers = @{
    "Authorization" = "Bearer $token"
}

$params = @{
    Uri = "https://management.azure.com/subscriptions/$subscriptionId/resourcegroups?api-version=$apiVersion"
    Method = "GET"
}

$queryResult = Invoke-RestMethod @params -Headers $headers 
$queryResult.value | select-object -Property name,location

This same principle can be applied to any API call, just change the scope and the API call. I will be adding more to this as I go along, but this is a good start.

Can I run this cheaper? Use case for the Azure Cost Management API

Thu, 03 Aug 2023 14:24:21 GMT

What are we doing?

I was given inspiration by a colleague, Ben Hummerstone who used a Azure Python Function, whilst super cool and interesting, I am a PowerShell advocate through and through. So I used PowerShell and wrote a script to show some of the use cases. This is just the tip of the iceberg and the script has been built to show some of the options available.

Constraints / limitations

The primary focus of this script is IaaS.
Could be better implemented as a function. If there is enough of an ask, I might build this into a function.
Built for my sample use cases.
This is a quick and dirty implementation.
This is NOT PRODUCTION ready yet.

Lets build this

Steps

You will need the following

PowerShell
An understanding of the Cost API (Insert link here)
Willingness to learn and experiment
Postman or the Postman VS Code extension is great for testing, however a normal browser will also return the required details.

In essence, there are snippets of code built into one bigger script.

Login and list all subscriptions you have access to then pick one to get the vms against.
Check for vms with the same in different resource groups.
We perform an overall call for data.
Check for pagination - as the results are returned 100 rows at a time.
We filter the data - we remove Spot and Low Priority Items.
We find cheaper options with the above filter applied.
We can check against specific regions, again with the filter from step2 applied. Was interesting to get the formatting correct here. :)

I will do my best to explain the script, I have also added comments. Please use this as a base and modify as needed. This scripts only GETS information, there are NO WRITES/SETS in this script. This is by design, please add this functionality yourself.

The snippet below, is designed to allow you to log into Azure (Azure Commercial by default) and then list all the subscriptions you have access to and present a list and then connect to the selected subscription.

function Select-SubscriptionsAndConnectTo {
    Login-AzAccount
    $subscriptions = Get-AzSubscription | Select-Object Name,SubscriptionId | Sort-Object Name 
    [int]$subscriptionCount = $subscriptions.count
    Write-output "Found" $subscriptionCount "Subscriptions"
    $i = 0
    foreach ($subscription in $subscriptions)
    {
        $subValue = $i
        $subText = [string]$subValue + " : " + $subscription.Name + " ( " + $subscription.SubscriptionId + " ) "
        Write-output $subText
        $i++
    }
    Do 
    {
        [int]$subscriptionChoice = read-host -prompt "Select number & press enter"
    } 
    until ($subscriptionChoice -le $subscriptionCount)

    $selectedSub = "You selected " + $subscriptions[$subscriptionChoice].Name
    Write-output $selectedSub
    Set-AzContext -SubscriptionId $subscriptions[$subscriptionChoice].SubscriptionId
}

Select-SubscriptionsAndConnectTo

Get VMs and check if the same VM name is used in multiple resource groups.

## getting all vms in a subscription
$vms = Get-AzVM
$vms | Select-Object Name,ResourceGroupName,Location,@{l='VMSize';e={$_.HardwareProfile.VmSize}}| Sort-Object Name | Format-Table -AutoSize
## reading in virtual machines
$selectedVmName = read-host "Which VM would you like to check for better pricing?"
$selectedRGName = $vms | Where-Object { $_.Name -eq $selectedVmName } | Select-Object ResourceGroupName

## checking for duplicate names in multiple resource groups
if ($selectedRGName.count -gt 1)
{
    $rgCount = $selectedRGName.count
    Write-Output "Found multiple VMs with the same name in different resource groups"
    $rgNames = $selectedRGName | Select-Object ResourceGroupName
    #write-output $rgNames.resourcegroupname
    $i = 0
    foreach ($rgName in $rgNames)
    {
        $rgValue = $i
        $rgText = [string]$rgValue + " : " + $rgName.ResourceGroupName
        Write-output $rgText
        $i++
    }
    Do 
    {
        [int]$rgChoice = read-host -prompt "Select number & press enter"
    } 
    until ($rgChoice -le $rgCount-1)

    $selectedRGText = "You selected " + $selectedRGName[$rgChoice].ResourceGroupName
    Write-output $selectedRGText
    $selectedRG = $selectedRGName[$rgChoice].ResourceGroupName

    ## selecting the vm from the selected resource group
    $azureVm = get-azvm -ResourceGroupName $selectedRG -Name $selectedVmName
} else {
    ## selecting the vm from the selected resource group
    $azureVm = get-azvm -ResourceGroupName $selectedRGName.ResourceGroupName -Name $selectedVmName
}

Getting information about the selected VM and establishing the current base price.

## building variables for api call
$azureVMSKU = $azureVm.HardwareProfile.VmSize
$azureVmLocation = $azureVm.Location

## api variables
$apiUrl = "https://prices.azure.com/api/retail/prices?"
$armSkuName = $azureVMSKU

## get base information around pricing

$baseFilter = "armSkuName eq '$armSkuName' and priceType eq 'Consumption' and armRegionName eq '$azureVmLocation'"
$baseUrl = $apiUrl + "`$filter=$baseFilter"
Write-Output "Current Url is $baseUrl"
$baseJsonData = Invoke-RestMethod -Uri $baseUrl -Method Get
## selecting most expensive price
$baseVMPrice = ($baseJsonData.Items  | Where-Object { $_.skuName -notlike "*Spot*" -and $_.skuName -notlike "*Low Priority*" } | Sort-Object unitPrice -Descending | Select-Object -Last 1).unitPrice

## formatting for results
$baseVMPrice = "{0:N4}" -f $baseVMPrice
Write-Output "Base price is $baseVMPrice"

Build an array to store the information for later manipulation and sorting. Filter out “Low Priority” and “Spot VMs” and deal with pagination.


## get all pricing data for the selected vm
$filter = "armSkuName eq '$armSkuName' and priceType eq 'Consumption'"
$allItems = @()

# Run Query
$url = $apiUrl + "`$filter=$filter"
Write-Output "Current Url is $url"
$currentJsonData = Invoke-RestMethod -Uri $url -Method Get
$allItems += $currentJsonData.Items

# pagination
$NextPage = $currentJsonData.NextPageLink
while ($NextPage) {
    Write-Verbose "Current Url is $NextPage"
    $currentJsonData = Invoke-RestMethod -Uri $NextPage -Method Get
    $allItems += $currentJsonData.Items
    $NextPage = $currentJsonData.NextPageLink
}

# filter out spot and low priority item from array
$filteredItems = $allItems | Select-Object skuName, meterName, unitOfMeasure, @{l='unitPrice';e={"{0:N4}" -f $_.unitPrice}}, armRegionName | Where-Object { $_.skuName -notlike "*Spot*" -and $_.skuName -notlike "*Low Priority*" }
Write-Output "Total items: $($filteredItems.Count)"
#$filteredItems
$filteredItems | Sort-Object -Property unitPrice | Format-Table -AutoSize
$cheaperOptions = $filteredItems | Where-Object -Property unitPrice -lt $baseVMPrice | Sort-Object -Property unitPrice
Write-Output "Cheaper than $baseVMPrice options: $($cheaperOptions.Count)"
$cheaperOptions | Format-Table -Property skuName, meterName, unitOfMeasure, @{l='unitPrice';e={"{0:N4}" -f $_.unitPrice}}, armRegionName -AutoSize

I have also included an option to check against specific regions if that is something you would like to do. You will get prompted if you want to check against other regions. A Y will continue to ask which regions, this is a comma seperated list, swedencentral,westeurope (as an example). A N will simply stop the script.


## how to check against specific regions
$regionCheck = read-host "Would you like to check against specific regions? (y/n)"
while("y","n" -notcontains $regionCheck) {
    $regionCheck = read-host "Would you like to check against specific regions? (y/n)"
}
if ($regionCheck -eq "y")
{
    $specificRegions = read-host "please enter region names separated by comma"
    $specificRegions = $specificRegions.split(",")

    $regionItems = @()
    $regionQueryBaseUrlFilter = "armSkuName eq '$armSkuName' and priceType eq 'Consumption' "
    
    foreach ($item in $specificRegions)
    {
        $item
        $regionQueryBaseUrlFilter = "armSkuName eq '$armSkuName' and priceType eq 'Consumption' "
        $regionQueryBaseUrlFilter = $regionQueryBaseUrlFilter + "and armRegionName eq '$item' "
        $regionQueryBaseUrlFilter
        $regionQueryUrl = $apiUrl + "`$filter=$regionQueryBaseUrlFilter"
        $otherRegionJsonData = Invoke-RestMethod -Uri $regionQueryUrl -Method Get
        $regionItems += $otherRegionJsonData.Items
        $NextPage = $otherRegionJsonData.NextPageLink
        while ($NextPage) {
            Write-Output "Current Url is $NextPage"
            $otherRegionJsonData = Invoke-RestMethod -Uri $NextPage -Method Get
            $regionItems += $otherRegionJsonData.Items
            $NextPage = $otherRegionJsonData.NextPageLink
        }
    }
    
    Write-Output "Output below"
    $regionItems | Where-Object { $_.skuName -notlike "*Spot*" -and $_.skuName -notlike "*Low Priority*" } | Format-Table -Property skuName, meterName, unitOfMeasure, @{l='unitPrice';e={"{0:N4}" -f $_.unitPrice}}, armRegionName -AutoSize
    }

Full script can be found here

New LDAPS run-command for Azure VMware Solution

Fri, 19 May 2023 08:39:57 GMT

What are we doing?

Showing a newer version of the New-LDAPSIDentitySource Run-Command within Azure VMware Solution

Lets build this

If you have been following along and you have used our previous article(s) - AZURE VMWARE SOLUTION: A COMPREHENSIVE GUIDE TO LDAPS IDENTITY INTEGRATION - PART 1 - you would have realized that this quite a process. We took our many customers feedback to our Product Group (PG) within Microsoft and we have worked with them, to create a new version of the “Run-Command” and this has been released publicly.

You are looking for the “5.3.54” version of the run commands and “New-LDAPSIdentitySource”

You will notice that the “SSLCertificateSasUrl” field is now OPTIONAL. The “i” information bubble will now explain how it works. Basically the service now looks for the Domain Controllers based upon the information you provide and now connects and attempts to download the certificates automatically. Provided you have the pre-requisites in place, Like a Certificate Authority (CA), this works really well and speeds up the process tremendously and removes lot of complexity like dealing with Stroage Accounts, uploading the certificates and creating the required SAS Tokens.

A very welcome change.

Azure VMware Solution: A comprehensive guide to LDAPS identity integration - Part 1

Wed, 25 Jan 2023 08:45:43 GMT

Author(s): Robin Heringa and Fletcher Kelly

Implementing LDAPS identity integration with Azure VMware Solution series - 1 of 4

This is the first part of the blog series on how to implement LDAPS identity integration with Azure VMware Solution. Other parts of this series can be found here:

Azure VMware Solution (AVS) offers a fully managed software defined data center based on VMware vSphere technologies in the shape of an Azure PaaS service. The PaaS nature of Azure VMware Solution results in a service that is functionally equivalent to your well-known on-premises VMware deployment you may have been using for years with some specific “restrictions” as Microsoft provides a service level agreement and therefor Microsoft is responsible for ensuring a robust and resilient platform in deployment and operation. Azure VMware Solution is functionally equivalent to on-premises VMware but due to the PaaS nature of the service there are significant technical differences to properly consider.

Run-Commands for high(er) privileged operations

As a consumer of Azure VMware Solution, you are granted limited administrative privileges that are aligned with the PaaS nature of the service. You are granted access to the CloudAdmin role which holds a subset of the full administrator role. As it is at times needed to allow for “privilege escalation”, Microsoft has enabled you to do so using a feature in the Azure AVS portal blades called “Run-Commands”. Run-Commands allow you to perform a selected number of high privileged actions without requiring the need to submit a service request through Azure Support from the Azure Portal. More details on Run-Commands can be found on Microsoft Learn here.

To integrate your Azure VMware Solution SDDC with a directory services provider, in our case Active Directory, we will use a Run-Command: New-LDAPSIdentitySource.

Our Azure VMware Solution lab environment

To allow us to create this article using “understandable” values for the prerequisites and the parameters required to successfully implement the LDAPS identity integration, we have created a lab environment which is shown in the picture below. Using this picture as a reference we hope to make it easier for anyone to implement LDAPS integration by simply replacing the prerequisite values and parameters (displayed in bold through-out this document) with the values applicable to your environment by simply comparing with our lab and easily translating this to what is applicable for your deployment.

Our lab consists of:

Required resources:
One Azure VMware Solution Private Cloud called	avs-fta-gwc
One Active Directory forest and domain called	avsemea.com
Two Active Directory domain controllers called	avs-gwc-dc001 and avs-gwc-dc002
One Active Directory hosted enterprise root certificate authority called	avsemea-avs-gwc-rootca
One Azure Virtual WAN called	avs-germanywestcentral-vwan1
One jumpbox virtual machine used for management activities called	avs-gwc-jumpbox
One Azure Virtual Network called	avs-gwc-172_16_11_0-24
This vnet holds three separate subnets called	SN-172_16_11_0-26-ADDS, AzureBastionSubnet and SN-172_16_11_128-26

All virtual machines used in the lab are joined to the above mentioned avsemea.com domain Our lab environment also holds some additional resources that are not required for the LDAPS integration but they will be used when creating additional articles on different Azure VMware related topics just like this one.

Optional resources for future use:
Two NSX-T segments inside our AVS SDDC called	NSX-SN-192-168-200-0-24 and NSX-SN-192-168-201-0-24
One virtual machine for forwarding additional metrics from our AVS SDDC to the Azure Metrics infrastructure called	avs-gwc-metrics001
One Azure NetAppFiles account that will be used as extensible storage for our AVS SDDC in a later article called	avs-gwc-anfaccount001

A graphical representation of our lab environment is shown below:

While guiding you through the process of gathering all required details and artifacts and using them to complete the LDAPS integration for AVS, we assume that you have all resources mentioned in the table required resources available and that sufficient access permissions are in place.

snippets.ps1 file (all code commands)
Next>

Azure VMware Solution: A comprehensive guide to LDAPS identity integration - Part 4

Wed, 25 Jan 2023 08:45:43 GMT

Author(s): Robin Heringa and Fletcher Kelly

Implementing LDAPS identity integration with Azure VMware Solution series - 4 of 4

This is the fourth and final part of the blog series on how to implement LDAPS identity integration with Azure VMware Solution. Other parts of this series can be found here:

These steps, for now, are run manually from the Azure Portal. This will be found “Azure VMware Solution” and under Operations, Run command. Then select “New-LDAPSIdentitySource”. An automated way of executing the run-command is in the making. Please check back soon as this article will be updated as soon as this is available. Navigate to Azure Portal and ensure you are on AVS Private Cloud blade

In the AVS Private Cloud blade, click “Run Command”;
Ensure Packages is selected.
Click “New-LDAPSIdentitySource”.
Ensure the correct Run is open before populating the required information.

Populate the information as needed.

The SSLCertificateSasUrl is a single string consisting of the SASTokens separated with a ”,”. For example: {{< highlight go >}} https://avsgwcsa14a2c2da.blob.core.windows.net/ldaps-blog-post/avs-gwc-dc001.cer?sv=2021-10-04&st=2023-01-12T13%3A46%3A45Z&se=2023-01-13T13%3A46%3A45Z&sr=b&sp=rwd&[Removed],https://avsgwcsa14a2c2da.blob.core.windows.net/ldaps-blog-post/avs-gwc-dc002.cer?sv=2021-10-04&st=2023-01-12T13%3A46%3A45Z&se=2023-01-13T13%3A46%3A45Z&sr=b&sp=rwd&[Removed] {{< /highlight >}} and pasted as a single long string.

Example string: {{< highlight shell >}} https://avsgwcsa14a2c2da.blob.core.windows.net/ldaps-blog-post/avs-gwc-dc001.cer?sv=2021-10-04&st=2023-01-12T13%3A46%3A45Z&se=2023-01-13T13%3A46%3A45Z&sr=b&sp=rwd&[Removed],https://avsgwcsa14a2c2da.blob.core.windows.net/ldaps-blog-post/avs-gwc-dc002.cer?sv=2021-10-04&st=2023-01-12T13%3A46%3A45Z&se=2023-01-13T13%3A46%3A45Z&sr=b&sp=rwd&[Removed]{{< /highlight >}}

The other values would need to be updated as per your environment. The BaseDNGroups and BaseDNUsers are the Distinguished Names for the groups and users. These can be found using the ADSIedit tool and navigating to the required groups within Active Directory and noting down these values. More information can be here about Distinguished Names

With the BaseDNGroups and BaseDNUsers, watch the values used as these should be under the same tree. In this example, “OU=Corp,DC=avsemea,DC=com”

Once all information is entered, Run the command. You can check the status of the Run command within the portal. Navigate to Azure Portal and ensure you are on AVS Private Cloud blade

In the AVS Private Cloud blade, click “Run Command”;
Ensure “Run execution status” is selected.
Click the latest run execution that is applicable to your environment. In this case, New-LDAPSIdentitySource-Exec33.
Ensure you click the Execution name (3.) that is the running state.

You can check the status of the job now and you are waiting for all the tasks to be completed and show that your selected group was added to CloudAdmins Once you have clicked the Execution name link

Check the information tab to see the steps being executed by the script;

You can also check the output and ensure that the correct name was added. Once you have clicked the Execution name link

Check the Output tab to see the steps being executed by the script;

You can log on with LDAP based credentials. Using the link found under “VMware credentials”, navigate to vCenter Server Credentials Web client URL Navigate to Azure Portal and ensure you are on AVS Private Cloud blade

In the AVS Private Cloud blade, click “VMware credentials”;
Click the copy icon for the WebClient URL under “vCenter Server credentials”

Navigate to the URL with your browser of choice and use your Directory Services based credentials to ensure that login and authentication is working as expected.

Logon to Azure VMware Solution based components is now possible and should be now be working as expected.

snippets.ps1 file (all code commands)
< Previous

Azure VMware Solution: A comprehensive guide to LDAPS identity integration - Part 2

Wed, 25 Jan 2023 08:45:43 GMT

Author(s): Robin Heringa and Fletcher Kelly

Implementing LDAPS identity integration with Azure VMware Solution series - 2 of 4

This is the second part of the blog series on how to implement LDAPS identity integration with Azure VMware Solution. Other parts of this series can be found here:

Configure DNS forwarding prerequisite

Before we can configure integration with an external identity store (e.g. Active Directory Domain Services) we need to make sure that the AVS platform components have the ability to resolve customer DNS zones hosting the LDAPS domain records. This configuration must be made through the Azure Portal blades for Azure VMware Solution.

Open the Azure VMware Solution DNS configuration pane

The first step in configuring DNS name resolution from the Azure VMware Solution networks (management and workload segments) is to add a DNS zone for Azure VMware. Login to the Azure Portal and select the Azure Active Directory tenant and Azure subscription where you have deployed your Azure VMware Solution Private Cloud.

As depicted in the image above:

Click on “Azure VMware Solution” in the main navigation pane;
Click the Azure VMware Solution Private Cloud you want to configure. In our scenario walk-through we select avs-fta-gwc as per the description of our lab environment used;
In the navigation pane that now opened, scroll down to the section “Workload networking” and select “DNS”. The Azure Portal blade for configuring the Azure VMware Solution DNS configuration will now open.

Configure the required DNS zones details

The Azure VMware Solution DNS configuration pane opens the section where “conditional DNS forwarder” zones are configured.

As shown in the image above:

Click ”+ Add” in the top navigation structure. A new configuration panel will appear on the right side of your browser window;
Under (DNS zone) Type, select the “FQDN zone” option;
Under DNS zone name, enter a descriptive name used within NSX-T to identify the DNS zone. We recommend to use the DNS FQDN of the zone used by your LDAP/S identity infrastructure. In our scenario the DNS zone name we use is avsemea.com;
Under Domain, enter the DNS zone FQDN we will be forwarding traffic for. In our scenario we use avsemea.com here as well;
Under DNS server IP, enter the IP addresses of your DNS servers. It is recommended to use DNS servers that are situated inside of Azure. In our scenario we will use the IP addresses of our two avsemea.com domain controllers: 172.16.11.4 and 172.16.11.5;
Click the “OK” button to create the required DNS FQDN zone in NSX-T.

After a few minutes, the DNS FQDN zone, avsemea.com, will be listed in the DNS blade for your Azure VMware Solution Private Cloud as shown below:

Attach the DNS zone configuration to the NSX-T DNS forwarder service

Now that we created the DNS conditional forwarder zone we need to attach this zone to the NSX-T DNS service running in Azure VMware Solution to enable NSX-T to actually use the DNS conditional forwarder zone for use.

In the Azure VMware Solution DNS blade:

Click “DNS service” at the top of the blade;
Click “Edit” to enable configuration changes to the NSX-T DNS service;
In the “Edit DNS service” screen, open the “FQDN zones” drop down and select the FQDN zone you want to attach to the service. In our scenario we select the avsemea.com zone;
Click “OK” to save the configuration change.

When the change to the NSX-T DNS service is effectuated the avsemea.com DNS zone will now be listed in the DNS service configuration:

After this step the configuration of the Azure VMware Solution DNS service is complete. The next article in this series will describe the detailed steps in configuring LDAPS integration through the Azure portal or automation where possible.

snippets.ps1 file (all code commands)
< Previous Next>

Azure VMware Solution: A comprehensive guide to LDAPS identity integration - Part 3

Wed, 25 Jan 2023 08:45:43 GMT

Author(s): Robin Heringa and Fletcher Kelly

Implementing LDAPS identity integration with Azure VMware Solution series - 3 of 4

This is the third part of the blog series on how to implement LDAPS identity integration with Azure VMware Solution. Other parts of this series can be found here:

Implement LDAPS integration

The following sections will guide you through the required process step-by-step

Check domain controller certificates and LDAPS

It is important to validate that the identity provider (in most cases Active Directory) is configured to support LDAPS based authentication requests before continuing with the LDAPS integration setup.

For each domain controller that is designated for use with Azure VMware Solution, check if the required certificate(s) with the “server authentication” intended purpose are present in the computer certificate store. The “Certificates” snap-in for the Microsoft Management Console (mmc.exe) offers a simple way to do this.

After locally or remotely opening the computer certificate store:

Expand the “Personal” certificate store and click “Certificates”;
Check if the store contains certificates with the “Server Authentication” intended purpose.

Available certificates for avs-gwc-dc001.avsemea.com:

Available certificates for avs-gwc-dc002.avsemea.com:

Next we need to verify whether the Active Directory domain controllers are configured to offer LDAPS services:

Open a “Command prompt” windows;
Run the command “Netstat -a”;
Verify that there is an active listener for TCP port 636.

LDAPS listener for avs-gwc-dc001.avsemea.com:

LDAPS listener for avs-gwc-dc002.avsemea.com:

Extract (correct) domain controller certificates

As a next step the certificates used by the domain controllers for LDAPS services need to be extracted from the domain controllers. This step is always performed by executing the script shown in the image below. The reason for this is to ensure we extract the correct certificate which is “attached” to the LDAPS service. When multiple certificates are available with the “Server Authentication” intended purpose, the domain controller selects one of them to be used for LDAPS.

With the following commands we will connect to the required domain controllers. In our scenario, these are avs-gwc-dc001.avsemea.com and avs-gwc-dc002.avsemea.com and we then use OpenSSL to extract the required certificates. You will need to specify the path of your openssl.exe, currently tested version is 3.0 and was installed with Chocolatey. Our install path is C:\Program Files\OpenSSL-Win64\bin\openssl.exe. You will need to update the export path to suit your needs, we chose to use c:\certTemp

Notes
$openSSLFilePath may need to be changed, was installed using chocolatey in our example.
$remoteComputers would need to be changed to suit your environment.
$exportFolder can be changed to something more suitable for your environment.

## Get certs
$openSSLFilePath = "C:\Program Files\OpenSSL-Win64\bin\openssl.exe"
$remoteComputers = "avs-gwc-dc001.avsemea.com","avs-gwc-dc002.avsemea.com"
$port = "636"
$exportFolder = "c:\temp\"

foreach ($computer in $remoteComputers)
{
    $output =  echo "1" | & $openSSLFilePath "s_client" "-connect" "$computer`:$port" "-showcerts" | out-string
    $Matches = $null
    $cn = $output -match "0 s\:CN = (?<cn>.*?)\r\n"
    $cn = $Matches.cn
    $Matches = $null
    $certs = select-string -inputobject $output -pattern "(?s)(?<cert>-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----)" -allmatches
    $cert = $certs.matches[0]
    $exportPath = $exportFolder+($computer.split(".")[0])+".cer"
    $cert.Value | Out-File $exportPath -Encoding ascii
}

Validate domain controller certificate requirements

The next step is to ensure that the certificate extraction was performed successfully. This will always be a manual step in the process.

As displayed in the image above:

Open Windows Explorer (or use the one opened in the previous step if not closed already 😊) and browse to the location where the certificates were extracted to. In our scenario the folder is c:\certTemp;
Open the certificates by right-clicking and selecting “Open”

For each of the certificates:

Select the “General” tab at the top;
Verify that “Proves your identity to a remote computer” is available as an intended purpose;
Verify that domain controller fully qualified domain name FQDN) is present in the “Issued to” field. In our scenario: avs-gwc-dc001.avsemea.com and avs-gwc-dc002.avsemea.com.
Verify that the certificate is still valid by checking the “Valid from” field.

To complete the certificate verification process, for each certificate:

Click the “Certification Path” tab at the top;
Verify that the full certificate authority chain is available in the “Certification path” field. In our scenario the field contains the name of the root certification authority avsemea-avs-gwc-rootca and the full certificate name for the respective domain controller the certificate is issued to. In our scenario avs-gwc-dc001.avsemea.com and avs-gwc-dc002.avsemea.com.

Create Azure Storage account

The following content is divided into two sub-sections. One section will describe how the required procedure is performed manually through the Azure Portal and the other section describes a way to perform the required steps through automation.

Manual deployment

As part of this manual process a storage account will be created that is used to store the domain controller certificates for later use by the “New-LDAPSIdentitySource” run-command.

In the Azure Portal:

Click on “Storage accounts” in the left navigation panel;
Click ”+ Create” at the top to create a new storage account. The “Create a storage account” blade will now be displayed.

On the “basics” tab:

In the “Subscription” drop-down menu make sure you select the subscription where Azure VMware Solution has been deployed into. In our scenario this is the Azure CXP FTA Internal – AZFTA subscription;
Select the resource group you want to create the storage account into. In our case avs-germanywestcentral-operational_rg.
In the “Storage account name” box, enter a globally unique name for the storage account. We recommend to use a descriptive name postfixed with a GUID. In our scenario we used avsgwcsa14a2c2db;
In the “Region” drop-down menu be sure to select the same region as where Azure VMware Solution is deployed. In our scenario Germany West Central.
As this storage account has no need for changing any of the default settings, click “Review” at the bottom of the screen.

On the review screen:

Double-check the values for “Subscription”, “Resource Group”, “Location” and “Storage account name”;
Click “Create”. After a few minutes the creation of the storage account should be completed:

Automated deployment

With these commands, we will check for the Azure Module, install them if missing and then continue the script. We will create the required storage account, or use an existing storage account. The $storageAccountName and $resourceGroupLocation variables can be updated or replaced as needed to meet your needs. These scripts are designed to be run in sections one after each other to ensure the variable names are correctly referenced.

Notes
$resourceGroupLocation will need to be updated to your desired location.
$storageRgName will need to be updated.
$storageAccountName will need to be updated.

## Do you have the Azure Module installed?
if (Get-Module -ListAvailable -Name Az.Storage)
    { write-output "Module exists" }        
else 
    {
    write-output "Module does not exist"
    write-output "installing Module"
    Install-Module -name Az.Storage -Scope CurrentUser -Force -AllowClobber
    }

## create storage account

$resourceGroupLocation = "germanywestcentral"
$storageRgName = "avs-$resourceGroupLocation-operational_rg"
## Storage account variables
$guid = New-Guid
$storageAccountName = "avsgwcsa"
$storageAccountNameSuffix = $guid.ToString().Split("-")[0]
$storageAccountName = (($storageAccountName.replace("-",""))+$storageAccountNameSuffix )
## Define tags to be used if needed
## tags can be modified to suit your needs, another example below.
#$tags = @{"Environment"="Development";"Owner"="FTA";"CostCenter"="123456"}
$tags = @{"deploymentMethod"="PowerShell"; "Technology"="AVS"}
## create storage account
$saCheck = Get-AzStorageAccount -ResourceGroupName $storageRgName -Name $storageAccountName -ErrorAction SilentlyContinue
if ($null -eq $saCheck)
{
    New-AzStorageAccount -ResourceGroupName $storageRgName -Name $storageAccountName -Location $resourceGroupLocation -SkuName Standard_LRS -Kind StorageV2 -EnableHttpsTrafficOnly $true -Tags $tags
    Write-Output "Storage account created: $storageAccountName"
} else {
    write-output "Storage Account already exists"
}

Create Storage Blob container

The next step is to create a blob container to help structure/organize the resources required for the LDAPS identity integration. The following content is divided into two sub-sections. One section will describe how the required procedure is performed manually through the Azure Portal and the other section describes a way to perform the required steps through automation.

Manual deployment

In the Azure Portal:

In the left navigation pane, click “Storage accounts”;
In the list of storage accounts, select the storage account created in the previous step. In our scenario avsgwcsa14a2c2db;
Select “Containers” under the “Data storage” category;
Click ”+ Container” to create a new container in the storage account.

In the “New container” dialog:

In the “Name” field, type a descriptive name for the new container. In our scenario ldaps-blog-post.
Click “Create” The new container should now be created and displayed in the “Containers” view for the storage account:

Automated deployment

With these commands, we will create the container to upload the earlier exported certificates to, this will be important for the creation of the SAS Tokens for the AVS LDAPS Run Command.

Notes
$containerName will need to be updated

## create container
$containerName = "ldaps-blog-post"
$containerCheck = Get-AzStorageContainer -name $containerName -Context (Get-AzStorageAccount -ResourceGroupName $storageRgName -Name $storageAccountName).Context -ErrorAction SilentlyContinue
if ($null -eq $containerCheck)
{
    New-AzStorageContainer -name $containerName -Context (Get-AzStorageAccount -ResourceGroupName $storageRgName -Name $storageAccountName).Context
    Write-Output "Storage container created: $containerName"
} else {
    write-output "Container already exists"
}

Upload domain controller certificates

The next step is to upload the domain controller certificates from the temporary folder where they were extracted to into the newly created ldaps-blog-post container in the avsgwcsa14a2c2db storage account we created. The following content is also divided into two sub-sections. One section will describe how the required procedure is performed manually through the Azure Portal and the other section describes a way to perform the required steps through automation.

Manual deployment

As the first step, it is needed to “enter” the ldaps-blog-post container in the storage account:

In the Azure Portal, navigate to the avsgwcsa14a2c2db storage account created earlier and select “Containers”;
Click the ldaps-blog-post container.

We will now upload the certificates into the container:

In the ldaps-blog-post container, select “Overview”;
In the top navigation, click “⬆️ Upload”;
In the “Upload blob” panel, click the folder icon to select the certificates from your local hard drive.

Navigate to the folder where the certificates have been extracted to (in our scenario c:\certTemp) and:

Select all the certificates;
Click “Open”.

The “Open” screen will close and return to the Azure Portal “Upload blob” panel again, click “Upload” at the bottom of the screen:

The certificates will now be uploaded into the blob container. The process is complete when green checkmarks are shown for each certificate uploaded:

Automated deployment

With these commands, we will upload the actual certificates into the previously created container. In this example we are using “ldaps-blog-post”

## upload certs to container
$certs = Get-ChildItem -Path $exportFolder -Filter *.cer
$storageContext = (Get-AzStorageAccount -Name $storageAccountName -ResourceGroupName $storageRgName).Context
foreach ($item in $certs)
{
    $localFilePath = $item.FullName
    $azureFileName = $localFilePath.Split('\')[$localFilePath.Split('\').count-1]
    Get-AzStorageAccount -Name $storageAccountName -ResourceGroupName $storageRgName | Get-AzStorageContainer -Name $containerName | Set-AzStorageBlobContent -File $localFilePath -Blob $azureFileName
}

Generate SAS tokens for domain controller certificates

As part of this step we will generate “shared access tokens” for all the certificates uploaded into the blob container so they can be accessed through the run-command for implementing the LDAPS integration for vCenter. One section describes how the required procedure is performed manually through the Azure Portal and the other section describes a way to perform the required steps through automation.

Manual deployment

The manual deployment continues within the same blade in the Azure Portal where the previous step left off. For each of the uploaded certificates, generate a “SAS token”:

For each certificate separately:

Select the checkbox in front of the container;
Click the ellipsis at the end of the line;
Select “Generate SAS”.

In the following screen:

Make sure to select a proper validity period for the SAS token. By default the SAS token will be valid for 8 hours which should be sufficient when performing the configuration in a continuous effort;
Click “Generate SAS token and URL”. After clicking “Generate SAS token and URL” an additional section will be displayed at the bottom of the screen:

Be sure to copy the “Blob SAS URL” generated for each separate certificate into a text-file temporarily as they will need to be concatenated into a single string separated by a comma for use during the execution of the run-command as explained in step “Execute Run-Command”.

Automated deployment

With these commands, we will generate the SAS Token needed for the next steps, please note down BOTH tokens. In this script, the tokens are valid for 24 hours and can be modified to suit your needs.

Notes
$containerName will need to be updated

## create SAS token
$containerName = "ldaps-blog-post"
$blobs = Get-AzStorageBlob -Container $containerName -Context $storageContext | Where-Object {$_.name -match ".cer"}
foreach ($blob in $blobs)
{
    $StartTime = Get-Date
    $EndTime = $startTime.AddHours(24.0)
    $sasToken = New-AzStorageBlobSASToken -Container $containerName -Blob $blob.name -Permission rwd -StartTime $StartTime -ExpiryTime $EndTime -Context $storageContext -FullUri
    #$sasToken
    write-host "SASToken created: $sasToken"
}

snippets.ps1 file (all code commands)
< Previous Next>

How to configure LDAPS with AVS

Mon, 09 Jan 2023 08:39:32 GMT

In this post, we are going to be configuring LDAPS (LDAP Over SSL) for Azure Vmware Solution (AVS).

Pre-requisites

Jump Box
RSAT Tools
PowerShell installed

The expected outcome

Variables we used and information you need
1. Log into Azure
2. Export required certificates
3. Create a storage account
4. Create a container
5. Upload certificates to container
6. Create the SAS Tokens
Execute the AVS Run Command

The plan is to automate as much of this process as possible. We will use PowerShell to complete steps 1-6 as above. For now, step 7 needs to be manual, we are working on automating this as well.

Variables we used and information you need

We use the following.
DNS Name = avsemea.com
Netbios Name = AVSEMEA
You will see that we use the Fully Qualified domain names later with the computer names we reference later. We use FQDN as much as possible and try to hard code as little making these snippets more portable into your environment(s).

We are using a jump-box, which is domain joined, deployed into Azure and protected with Azure Bastion. THe snippets below are run on this jump-box, which has RSAT installed.

1. Log into Azure

Update the variables as needed, in this case, $azSubscriptionID

Notes
$azSubscriptionID would need to be updated with your Subscription ID.

$azSubscriptionID = ""
Login-AzAccount
Set-AzContext -Subscription $azSubscriptionID

2. Export required certificates

You will need to have OpenSSL installed. You can do this manually, or use a package manager like winget or chocolatey

## Get certs
$openSSLFilePath = "C:\Program Files\OpenSSL-Win64\bin\openssl.exe"
$remoteComputers = "avs-gwc-dc001.avsemea.com","avs-gwc-dc002.avsemea.com"
$port = "636"
$exportFolder = "c:\temp\"

foreach ($computer in $remoteComputers)
{
    $output =  echo "1" | & $openSSLFilePath "s_client" "-connect" "$computer`:$port" "-showcerts" | out-string
    $Matches = $null
    $cn = $output -match "0 s\:CN = (?<cn>.*?)\r\n"
    $cn = $Matches.cn
    $Matches = $null
    $certs = select-string -inputobject $output -pattern "(?s)(?<cert>-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----)" -allmatches
    $cert = $certs.matches[0]
    $exportPath = $exportFolder+($computer.split(".")[0])+".cer"
    $cert.Value | Out-File $exportPath -Encoding ascii
}

You can see the exported files in the picture below.

3. Create a storage account

Notes
$resourceGroupLocation will need to be updated to your desired location.
$storageRgName will need to be updated.
$storageAccountName will need to be updated.

## create storage account

$resourceGroupLocation = "germanywestcentral"
$storageRgName = "avs-$resourceGroupLocation-operational_rg"
## Storage account variables
$guid = New-Guid
$storageAccountName = "avsgwcsa"
$storageAccountNameSuffix = $guid.ToString().Split("-")[0]
$storageAccountName = (($storageAccountName.replace("-",""))+$storageAccountNameSuffix )
## Define tags to be used if needed
## tags can be modified to suit your needs, another example below.
#$tags = @{"Environment"="Development";"Owner"="FTA";"CostCenter"="123456"}
$tags = @{"deploymentMethod"="PowerShell"; "Technology"="AVS"}
## create storage account
$saCheck = Get-AzStorageAccount -ResourceGroupName $storageRgName -Name $storageAccountName -ErrorAction SilentlyContinue
if ($null -eq $saCheck)
{
    New-AzStorageAccount -ResourceGroupName $storageRgName -Name $storageAccountName -Location $resourceGroupLocation -SkuName Standard_LRS -Kind StorageV2 -EnableHttpsTrafficOnly $true -Tags $tags
    Write-Output "Storage account created: $storageAccountName"
} else {
    write-output "Storage Account already exists"
}

4. Create a container

Notes
$containerName will need to be updated

## create container
$containerName = "ldaps"
$containerCheck = Get-AzStorageContainer -name $containerName -Context (Get-AzStorageAccount -ResourceGroupName $storageRgName -Name $storageAccountName).Context -ErrorAction SilentlyContinue
if ($null -eq $containerCheck)
{
    New-AzStorageContainer -name $containerName -Context (Get-AzStorageAccount -ResourceGroupName $storageRgName -Name $storageAccountName).Context
    Write-Output "Storage container created: $containerName"
} else {
    write-output "Container already exists"
}

5. Upload certificates to container

## upload certs to container
$certs = Get-ChildItem -Path $exportFolder -Filter *.cer
$storageContext = (Get-AzStorageAccount -Name $storageAccountName -ResourceGroupName $storageRgName).Context
foreach ($item in $certs)
{
    $localFilePath = $item.FullName
    $azureFileName = $localFilePath.Split('\')[$localFilePath.Split('\').count-1]
    Get-AzStorageAccount -Name $storageAccountName -ResourceGroupName $storageRgName | Get-AzStorageContainer -Name $containerName | Set-AzStorageBlobContent -File $localFilePath -Blob $azureFileName
}

6. Create the SAS Tokens

Notes
$containerName will need to be updated

## create SAS token
$containerName = "ldaps"
$blobs = Get-AzStorageBlob -Container $containerName -Context $storageContext | Where-Object {$_.name -match ".cer"}
foreach ($blob in $blobs)
{
    $StartTime = Get-Date
    $EndTime = $startTime.AddHours(24.0)
    $sasToken = New-AzStorageBlobSASToken -Container $containerName -Blob $blob.name -Permission rwd -StartTime $StartTime -ExpiryTime $EndTime -Context $storageContext -FullUri
    #$sasToken
    write-host "SASToken created: $sasToken"
}

SASToken created: https://avsgwcsa14a2c2da.blob.core.windows.net/ldaps-blog-post/avs-gwc-dc001.cer?sv=2021-10-04&st=2023-01-12T13%3A46%3A45Z&se=2023-01-13T13%3A46%3A45Z&sr=b&sp=rwd&[Removed]
SASToken created: https://avsgwcsa14a2c2da.blob.core.windows.net/ldaps-blog-post/avs-gwc-dc002.cer?sv=2021-10-04&st=2023-01-12T13%3A46%3A45Z&se=2023-01-13T13%3A46%3A45Z&sr=b&sp=rwd&[Removed]

Execute the AVS Run Command

These steps, for now, are run manually from the Azure Portal. This will be found “Azure VMware Solution” and under Operations, Run command. Then select “New-LDAPSIdentitySource”

Populate the information as needed.
Note: the SSLCertificateSasUrl is a single string consisting of the SASTokens separated with a “,”. For example, https://avsgwcsa14a2c2da.blob.core.windows.net/ldaps-blog-post/avs-gwc-dc001.cer?sv=2021-10-04&st=2023-01-12T13%3A46%3A45Z&se=2023-01-13T13%3A46%3A45Z&sr=b&sp=rwd&[Removed], https://avsgwcsa14a2c2da.blob.core.windows.net/ldaps-blog-post/avs-gwc-dc002.cer?sv=2021-10-04&st=2023-01-12T13%3A46%3A45Z&se=2023-01-13T13%3A46%3A45Z&sr=b&sp=rwd&[Removed] and pasted as a single long string. The other values would need to be updated as per your environment.
Note: With the BaseDNGroups and BaseDNUsers, watch the values used as these should be under the same tree, in this example, “OU=Corp,DC=avsemea,DC=com”

Once all information is entered, Run the command.

You can check the status of the Run command within the portal, under Operations, Run command, then select Run execution status and then select the correct job.

You can check the status of the job now and you are waiting for all the tasks to be completed and show that your selected group was added to CloudAdmins

You can also check the output and ensure that the correct name was added.

You can logon with LDAP based credentials.

Home Assistant Routing

Mon, 17 Oct 2022 10:44:14 GMT

Why do I need to change my routing?

I am a tinkerer by nature and I often need to move my Home Assistant instances around and by this, I mean create new instances and DEV versions. As complication of this, sometimes my UNIFI controller in not available and as such the following components are not available to me.

DHCP
VLans
Full DNS
Routing between Vlans

As a geek, I do not allow this to deter me.

The fix

The fix is quite easy if you understand your networking and you have access to the Home Assistant Terminal. This can also be achieved with a physical connection (keyboard and mouse) or an SSH session to the Home assistant Instance.I have a few vlans and ranges in my network and I need access to the following ranges. I have subnetted for smaller ranges.

192.168.37.0/25 (CIDR 1)
192.168.32.0/26 (CIDR 2)
192.168.1.254 (Router)
Network card name (Supervisor enp0s25)

You will need to know the IP address of your router

nmcli connection show nmcli connection modify "Supervisor enp0s25" +ipv4.routes "192.168.37.0/25 192.168.1.254" nmcli connection modify "Supervisor enp0s25" +ipv4.routes "192.168.32.0/26 192.168.1.254"

This will take care of the Linux piece from Home Assistant. I have a Windows machine and my machine needs access to the same resources. I chose not to add these as persistent routes as usually the outage is limited and my Unifi and full functionality is usually restored quite quickly.

route ADD 192.168.37.0 mask 255.255.255.128 192.168.1.254 route ADD 192.168.32.0 mask 255.255.55.0

Until next time.

Using Azure Resource Graph and Tags to lock items in Azure

Mon, 03 Oct 2022 12:59:06 GMT

What are we doing?

We are going to use Azure Resource Graph to find items with a specific tag, in this case {“toBeLocked”=“Yes”} and then place a resource lock on them.

Constraints / limitations

Use Azure Resource Graph to perform the search. Very fast and gives you a new way to interface with Azure Resources.
As part of this post, I am giving samples below to create items, you could use these for testing. Please test and make sure with production environment.
You are using an account that can create locks and potentially remove if needed during the testing.

Lets build this

Steps

Create sample items
Build Azure Resource Graph Queries
Getting items from the query programmatically
Adding locks
Result

Create sample items to lock

## create resource group
$rgName = "toberesourcelocked"
$rgLocation = "northeurope"
$rg = new-azresourcegroup -name $rgname -location $rgLocation

## create items
$guid = New-Guid
$saName = "sa"
$saSuffix = $guid.ToString().Split("-")[0]+$guid.ToString().Split("-")[1]
$saName = (($saName.replace("-",""))+$saSuffix)
New-AzStorageAccount -ResourceGroupName $rgName -Name $saName -Location $rgLocation -AccountType Standard_LRS

## create tag(s)
$tags = @{"toBeLocked"="Yes"}

## get items in Resource Group and tag them
$items = Get-AzResource -ResourceGroupName $rgName
foreach ($item in $items)
{
    Update-AzTag -ResourceId $item.ResourceId -Tag $tags -Operation Replace
} 
## update resource group with tag(s)
Update-AzTag -ResourceId $rg.ResourceId -Tag $tags -Operation Replace

Build Azure Resource Graph Queries

Including Resource Groups

resourcecontainers
| where type == "microsoft.resources/subscriptions/resourcegroups"
| mv-expand bagexpansion=array tags
| where isnotempty(tags)
| where tags[0] =~ 'toBeLocked' and tags[1] =~ 'Yes'
| project  name,type,location,subscriptionId,tags
| union (resources 
| mv-expand bagexpansion=array tags
| where isnotempty(tags)
| where tags[0] =~ 'toBeLocked' and tags[1] =~ 'Yes'
| project name,type,location,subscriptionId,tags,id)

Excluding Resource Groups

Resources
| mv-expand bagexpansion=array tags
| where isnotempty(tags)
| where tags[0] =~ 'toBeLocked' and tags[1] =~ 'Yes'

Resource Groups Only

ResourceContainers
| where type =~ 'microsoft.resources/subscriptions/resourcegroups'
| where tags['toBeLocked'] =~ 'Yes'

Getting items from the query programmatically

We now have the required queries and you can pick whichever one above suits your needs, I am going to be using Including Resource Groups. Now we need a way to act against these resources. I am personally quite a fan of PowerShell so I will provide this sample. You can use this as a base for my example below. When running the query in PowerShell, I find splatting is easiest for Azure Resource Graph queries

# Install the Resource Graph module from PowerShell Gallery
Install-Module -Name Az.ResourceGraph

# Get a list of commands for the imported Az.ResourceGraph module
Get-Command -Module 'Az.ResourceGraph' -CommandType 'Cmdlet'

# Run Azure Resource Graph query
$query = @"
resourcecontainers
| where type == "microsoft.resources/subscriptions/resourcegroups"
| mv-expand bagexpansion=array tags
| where isnotempty(tags)
| where tags[0] =~ 'toBeLocked' and tags[1] =~ 'Yes'
| project  name,type,location,subscriptionId,tags
| union (resources 
| mv-expand bagexpansion=array tags
| where isnotempty(tags)
| where tags[0] =~ 'toBeLocked' and tags[1] =~ 'Yes'
| project name,type,location,subscriptionId,tags,id)
"@
$queryItems = Search-AzGraph -Query $query

Adding locks

So now we have the items that have been tagged, now we can go through the process of adding a Resource Lock. The New-AzResourceLock will be used for this task.

$lockLevel = "CanNotDelete" ## can be changed to "ReadOnly" as well
$lockNotes = "Lock for demo blog purposes"
$lockName = "Demo Lock"
foreach ($queryItem in $queryItems)
{
    $name = $queryItem.Name
    $type = $queryItem.Type
    write-host "Locking $name ($type)"
    if ($type -eq "microsoft.resources/subscriptions/resourcegroups"){
        New-AzResourceLock -LockName $lockName -LockLevel $lockLevel -LockNotes $lockNotes -ResourceGroupName $name
    } else {
        $resourceGroupName = ($queryItem.id).split("/")[4]
        New-AzResourceLock -LockLevel $lockLevel -LockNotes $lockNotes -LockName $lockName -ResourceName $queryItem.Name -ResourceType $queryItem.Type -ResourceGroupName $resourceGroupName
    }
}

Results

Results can be seen below. Our Locks are now in place. Since my account is an owner, I can delete the lock(s), non-owner(s) would NOT be able to delete locks.

This code and concept can be easily updated or modified to meet different your specific requirements.

Using Arc to SSH into Linux and Windows

Tue, 27 Sep 2022 07:03:53 GMT

What are we doing?

We are going to use Azure Arc to SSH into a Linux (ubuntu 20.04) and a Windows Server (Server 2019) machine and run commands.

Constraints / limitations

Use only Azure ARC.
Use only public endpoints (I have not yet tested this with Private Endpoints) and my VPN is not currently connected to Azure.

Considerations

As of the time of this blog post (27-Sep-2022), the Azure Arc SSH functionality is in preview.

Lets build this

So, we are going to use SSH to connect to both Linux and Windows. Yes, you can connect to Windows via SSH and yes it works, we will get this working in this post.

Steps

Install Azure Arc Agent on VMs
Ensure that it is connected to Azure Correctly
Configurations changes for SSH to work
Connect via SSH

I am going to assume that steps 1 and 2 are completed already, if not. See here. The focus on this post is to connect to your environment using the azcmagent and then connecting to the virtual machine via the portal.

Linux VM

You will see that this is a linux vm and SSH working here is no surprise. For this post, I am using password authentication type. This is not ideal for production. Now you can click, “Connect in browser”. This will launch an Azure Cloud Shell

GOTCHA

You may hit your first error here.

The error may seem a little strange, it seems it is using port 66535 to dp a port lookup - like a proxy lookup - see here as an example of this. It is still wanting to connect to port 22, the normal ssh port. So how do we fix this?

Configuring the Azure connected machine agent is documented here and the command we need is this.

azcmagent config set incomingconnections.ports 22

Run this command on your linux machine (sudo will be needed) and then we can connect

Windows VM

The steps for connection from the portal and the required Azure connected machine agent commands are the same. However we do need to get SSH working on the Windows Server, this is actually quite easy and simply needs some copy and paste, see here. Once you have done that, your connection will work.

So there you have it, an SSH connection from the Azure portal to a Windows AND Linux Arc-enabled machine.

Check Powershell Console Type

Wed, 14 Sep 2022 10:14:30 GMT

I have been working with some Microsoft Hybrid technologies. My specific example here is around Azure Arc-enabled VMware vSphere aspects. When running the scripts provided here there is a key aspect.

Do NOT run this in the PowerShell ISE.

Even with this strong recommendation, it is often accidentally used as it is really easy to perform this action with a right click option and this got me to thinking about how can I check this via code?

So I did some thinking and found a way to check which console type you are running. Below is sample code but will exit the script if the Console Type is ISE.

How do we check this and prevent this?

$consoleType = get-host
if ($consoleType.Name -match 'ise')
{
    $message = "You should NOT use the ISE window, please reload in PowerShell window"
    Write-Output $message
    $message = "This process will terminate shortly"
    Write-Output $message
    Start-Sleep -Seconds 10
    break
} else {
    $message = "good to go"
    Write-Output $message
}

Very simple fix but can save hours of troubleshooting.

You may even notice the change to write-output from write-host as part of Cross platform support

Using SSH Keys with Bicep based Linux VM templates

Mon, 20 Jun 2022 07:54:21 GMT

I this post, I use bicep files for the deployment of Linux VMs AND I add some magic with PowerSehll to allow for the creation or using of existing SSH keys with these VMs.

I am a HUGE fan of SSH keys with Linux VMs for obvious reasons. I could just not find a script or scenario that covered this topic in a way that I actually like. I like to show more details and explain.

In this scenario, we use PowerShell to create the SSH keys and then use the value to the SSH key to deploy the Linux VM or use an existing SSH key adn then use that kay as part of the deployment. All automated, you just need to update some variables and let the script run. Who does not love automated examples ? :smile:

SSH Keys give us a secure and reliable way to connect to Linux VMs without the use of usernames and passwords. Naturally the keys would need to be protected. Maybe in another post I will create a keyVault to show this process.

Note: Please use 1A OR 1B
A. Create new keys
b. Use existing Keys

1A. Create the SSH Keys (if using the option to create keys) file

Please remember to update the variables as needed.
Variables to update

$vmName
If you want to change the path of the created keys - $keyLocation

## Pre-req

## Create required ssh-keys
## Requires ssh-keygen to be installed

$vmName = ""
$keyLocation  = $env:USERPROFILE + "\.ssh\"
$privateKeyName = $vmName + "-key"
$publicKeyName = $vmName + "-key.pub"
$privateKeyPath = $keyLocation + $privateKeyName
$publicKeyPath  = $keyLocation + $publicKeyName

ssh-keygen -m PEM -t rsa -b 2048 -C $vmName -f $privateKeyPath

##Deploy
$sshKey = Get-Content $publicKeyPath
$secureSSHKey = ConvertTo-SecureString $sshKey -AsPlainText -Force

1B. Us existing SSH Keys (if using the option to create keys) file

## Get key data
$publicKeyPath = ""
$sshKey = Get-Content $publicKeyPath
$secureSSHKey = ConvertTo-SecureString $sshKey -AsPlainText -Force

$privateKeyPath = ""

2. Deploy the Bicep Template file

Please remember to update the variables as needed.
Variables to update

$resourceGroupName
$resourceGroupLocation
$userName

## Deploy to Azure
$resourceGroupName = ""
$resourceGroupLocation = ""
$userName = ""
New-AzResourceGroup -Name $resourceGroupName -Location $resourceGroupLocation
New-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName -TemplateFile ./main.bicep -adminUsername $userName -adminPasswordOrKey $secureSSHKey

$hostName = (Get-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName).outputs.hostname.value

## Adding slight delay
Start-Sleep 5

## Connect to the vm
ssh -i $privateKeyPath $userName@$hostName

Now you can automatically connect to your newly deployed VM with an SSH Key. How great is that?

Using Openssh and creating SSH Keys with Powershell

Mon, 25 Apr 2022 13:27:03 GMT

In this post I show you my process for creating SSH Keys for Linux Machines.

I use a fair amount of Linux in my work career (creating VMs and the like within Azure). Linux VMs are great for testing with, they use SSH and are configured and ready for testing VERY quickly in Azure. I also use a fair amount of Linux in personal life, with Home assistant and Plex.

I know many people use username and password with Linux environments and there is nothing wrong with this, I simply think that keys are better :smile: . I believe this for a few reasons.

Allows for better control over access to a machine - no key, no access.
Allows for a better logon experience, seems more “seamless”
Key information can be stored in a secure location for repeated use
1. For personal use, I store the key information in 1Password
2. For work use, I store the key information in Azure Kayvault
Can be easily scripted to create new keys as needed

With the last point, I am a big PowerShell user and I have created a simple script that work in PowerShell and PowerShell Core.

You will need openssh for this to work. The command below will help with this 👍.

choco install openssh

Now for the PowerShell code, update the variables as needed. This creates the keys for us.

$username = ""
$keyLocation = ''
$keyName = $username
$keyPath = $keyLocation + $keyName
ssh-keygen -m PEM -t rsa -b 4096 -f $keyPath -C $username

Now to get the content of the public key, for use with Azure VMs or any type of IaC, I use Bicep

You can read the content out to something simple like NotePad (Honestly a tool I use DAILY).

$pubKeyPath = $keyPath + '.pub'
$pubKey = get-content -Path $pubKeyPath
$pubKey

Example output from $pubkey below, this is what you need to copy and paste within the Azure Portal when creating a Linux VM.

If you want to use this key with an existing, you can. :smile: . We can perform a task similar to ssh-copy-id. Update the $destinationIp as needed.

$destinationIp = ""
type $pubKeyPath | ssh $username@$destinationIp "cat >> .ssh/authorized_keys"

Using Azure Virtual WAN to connect to Azure VMware Solution

Mon, 28 Mar 2022 06:27:16 GMT

How do I connect my on-premises environment to AVS in a quick and simple way?

There are a few patterns available for connecting Azure VMware Solution to your on-premises network. There is specific guidance for PRODUCTION deployments here here. The option we are talking about here is for a different use case.

Specific use case: A PoC (Proof of Concept) type environment or smaller environments for testing with a plan to grow after the fact.

Azure Virtual WAN is one of the easy ways to get this accomplished. Below, we are going to work through an example.

What are we going to deploy?

We are going to use Azure Virtual WAN to allow for a connection from on-premises to Azure VMware Solution.

I have this as modular as possible with booleans in Bicep to make this is as customizable as possible for you.

A VPN Gateway will be deployed.

@description('Specifies whether or not to deploy the site to site connection.')
param deployS2SConnection bool = true

An ExpressRoute Gateway will be deployed.

@description('Specifies whether or not to deploy ExR connection.')
param deployExRConnection bool = true

💪 Bicep code can be found here.

What to expect when deploying?

You will get an ExpressRoute gateway. I set this as a “true” boolean value to cater for this.
The deployment will happen over 2 resource groups - if deploying the “vnetconnection” option.
It will look like nothing is happening in the Virtual WAN resource group. Show hidden items here.
The deployment, if choosing anything Gateway related (VPN Gateway or ExpressRoute gateway) will take some time - up to 35 minutes.
The deployment will deploy a VPN Gateway (on-premises to Azure)
The deployment will deploy a ExR Gateway (Azure to AVS)

This deployment is based upon this Configure a site-to-site VPN in vWAN for Azure VMware Solution. Whilst I like this article, it is not 100% complete. For the Azure VMware Solution (AVS) to work fully, an ExpressRoute Gateway for Azure Virtual WAN is needed. I prefer an IaC approach as the Azure Portal UI can change and I like repeatable processes.

This solution then allow you connect your on-premises environment to connect to Azure VMware Solution. This is probably one of the easiest ways to connect to Azure VMware Solution

Azure Virtual WAN can be further extended to ALSO include Point-to-Site connections - This is a good starting point for building the certificates (self-signed) for the Point-To-Site connections, if you choose to deploy this.

DISCLAIMER: These files are NOT production ready, they used to explain concepts and better prepare you for production.

Azure VMware Solution: To 'Internet Enabled' or not?

Thu, 17 Mar 2022 16:06:00 GMT

Guest Post Author: Robin Heringa

What else do I need to know when using Azure VMware Solution (AVS)?

As you all (probably) know by now Azure VMware Solution is a managed service offered by Microsoft providing a managed VMware vSphere environment to customers. With this offering customers no longer need to worry about hardware maintenance, hardware refresh and software maintenance for the core VMware components (ESXi, vCenter and NSX-T).

By default, after initial deployment of Azure VMware Solution, virtual machines do not have the ability to egress to the Internet. One of the options to enable Internet access is to “flip” the “Internet Enabled” toggle in the connectivity pane of the management blades in the Azure Portal:

Looks easy, but what does it do?

Internet Enabled option in Azure VMware Solution.

Microsoft runs an Internet break-out capability for Azure VMware Solution which is shared across the customers using Azure VMware Solution. When enabling this capability, a default networking route (0.0.0.0/0) is injected into to Azure VMware Solution Private Cloud which points “unknown destinations” to the shared break-out infrastructure.

While this capability offers a secure connectivity option to the Internet, it does not offer capabilities for traffic inspection and filtering and thus doesn’t allow for monitoring what traffic is leaving the environment.

While “Internet Enabled” offers a great way to quickly enable virtual machines on Azure VMware Solution to connect to the Internet, it is maybe not the best option to use for production deployments.

What should I do for production workloads?

For (large) production deployments, it is recommended to use Border Gateway Protocol (BGP) to inject a default route (0.0.0.0/0) which defines a customer controlled internet egress point (aka. firewall) as the next hop address. This approach will allow for inspection and filtering to be performed on traffic leaving and entering Azure VMware Solution hosted workloads.

There are various options to implement such an infrastructure. For more information on using Azure Virtual WAN for this scenario, see Enable public internet for Azure VMware Solution workloads.

Next to this, it is of course also possible to either “inject” the default route from the customer on-premises infrastructure (in which case on-premises and Azure will probably share the same Internet break-out point) or it is possible to implement network virtual appliances (NVA) from our networking partners (Fortigate, Palo Alto, Baracuda and many others) to inject an Azure specific default route and attract the traffic destined for the internet. We will go deeper into using third party solutions in later articles.

I want to use Azure VMware Solution, what should I know about networking?

Wed, 09 Mar 2022 16:06:00 GMT

What else do I need to know when using Azure VMware Solution (AVS)?

Networking Edition

I have been working with many customers over the last little while that are looking at Azure VMware Solution (AVS).

Often the idea and use case for the customer is correct. There are a few great reasons to use AVS. If you fit within the use cases, you are in for a real treat.

Deciding whether or not you are a fit is part of the equation, there is more to this scenario. Let’s dive in a bit more.

You are using the Azure platform but on dedicated hardware.
You will probably want to extend the connection from AVS to your existing data centre. This will introduce Global Reach if connecting back to on-premises with an ExpressRoute.
You will most likely use HCX as part of your migration.

So what does all of the above mean?

Networking can start to get a little interesting as there would now be many routing paths over a combination of Layer 2 and Layer 3 connections.

Asymmetric routing can become a real issue.
“Accidental” latency can be very easily introduced.
Traffic flow may not flow as expected.
A PoC (proof of concept) is very important with this technology.
Migration planning with network segments in mind is key.
Migration should be as “short-term” as possible, the longer the migration takes, the more networking challenges and complexities will arise.

Guidance for networking can be found here

Smarter Washing Machine Notifications

Thu, 03 Mar 2022 10:50:03 GMT

In this post, I show you how I use a Z-Wave Plug (Fibaro) to get more monitoring around power consumption and then use this to drive notifications.

Where we live now, our washing machine is a “utility room” and we keep the door closed from a noise point of view. With this setup it is possible to miss when the washing is complete and the washing makes no noise to indicate that the washing is compete and this can lead to issues. Have you ever smelled washing that was forgotten? 😖

So how did I do this?

Ingredients

In my case, I used z-wave as this is what I had, other technology can be used.

Z-Wave or other Power Monitoring Capable plug
Z-Wave Stick (Z‐Stick Gen5 USB Controller), if you are using a Sonoff device that connects to WiFi, a similar result can be achieved.
Node-RED
Home Assistant
Home Assistant companion app
Washing Machine use counter (optional)
Washing Machine running time (optional)

Process

I setup the Z-Wave Plug and started to plot the power usage over a few cycles to get a better understanding of how i could monitoring this. The challenge with the current washing machine is that there are “quiet periods” in the usage whether the usage drops really low. I originally tried to use node-red-contrib-power-monitor which I have used successfully in the past, however I could find the correct “on” and “off” count value. This emphasizes the importance of TESTING. Make no error, I will use node-red-contrib-power-monitor for other projects.

So how did I solve this?

I noticed that there was a distinct power usage of “0.4W” when the cycle was complete so I decided to use 2 Trigger State nodes in Node-RED.

For when the usage goes above 2.1W, based upon my earlier testing this was a guaranteed start point to start the washing cycle.
For when the usage drops to 0.4w, this signals that the load is complete and notifications can be fired.

So, we have a way to determine when the wash cycle started and take the appropriate actions. I get the current washing state in home assistant and change it to running.

[
  {
    "id": "c7ac9c26b4b3750d",
    "type": "tab",
    "label": "Flow 5",
    "disabled": false,
    "info": "",
    "env": []
  },
  {
    "id": "fcb212f752a272ef",
    "type": "trigger-state",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing started",
    "server": "770b1d5b.f27204",
    "version": 2,
    "exposeToHomeAssistant": false,
    "haConfig": [
      { "property": "name", "value": "" },
      { "property": "icon", "value": "" }
    ],
    "entityid": "sensor.fibaro_wall_plug_electric_consumption_w",
    "entityidfiltertype": "exact",
    "debugenabled": false,
    "constraints": [
      {
        "targetType": "this_entity",
        "targetValue": "",
        "propertyType": "current_state",
        "propertyValue": "new_state.state",
        "comparatorType": ">=",
        "comparatorValueDatatype": "num",
        "comparatorValue": "2.1"
      }
    ],
    "inputs": 0,
    "outputs": 2,
    "customoutputs": [],
    "outputinitially": false,
    "state_type": "str",
    "enableInput": false,
    "x": 120,
    "y": 260,
    "wires": [["cefc03e9cf83886c"], []]
  },
  {
    "id": "cefc03e9cf83886c",
    "type": "api-current-state",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing machine status dropdown state",
    "server": "770b1d5b.f27204",
    "version": 3,
    "outputs": 2,
    "halt_if": "Completed",
    "halt_if_type": "str",
    "halt_if_compare": "is",
    "entity_id": "input_select.washing_machine_status",
    "state_type": "str",
    "blockInputOverrides": false,
    "outputProperties": [
      {
        "property": "payload",
        "propertyType": "msg",
        "value": "",
        "valueType": "entityState"
      },
      {
        "property": "data",
        "propertyType": "msg",
        "value": "",
        "valueType": "entity"
      }
    ],
    "for": 0,
    "forType": "num",
    "forUnits": "minutes",
    "override_topic": false,
    "state_location": "payload",
    "override_payload": "msg",
    "entity_location": "data",
    "override_data": "msg",
    "x": 420,
    "y": 260,
    "wires": [["681510ab0e10afd0"], []]
  },
  {
    "id": "681510ab0e10afd0",
    "type": "api-call-service",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing input to \"in progress\"",
    "server": "770b1d5b.f27204",
    "version": 5,
    "debugenabled": false,
    "domain": "input_select",
    "service": "select_option",
    "areaId": [],
    "deviceId": [],
    "entityId": ["input_select.washing_machine_status"],
    "data": "{\"option\": \"Running\"}",
    "dataType": "json",
    "mergeContext": "",
    "mustacheAltTags": true,
    "outputProperties": [
      {
        "property": "payload",
        "propertyType": "msg",
        "value": "",
        "valueType": "data"
      }
    ],
    "queue": "none",
    "x": 770,
    "y": 260,
    "wires": [[]]
  },
  {
    "id": "770b1d5b.f27204",
    "type": "server",
    "name": "Home Assistant - Node-red User",
    "version": 2,
    "addon": false,
    "rejectUnauthorizedCerts": true,
    "ha_boolean": "y|yes|true|on|home|open",
    "connectionDelay": true,
    "cacheJson": true,
    "heartbeat": true,
    "heartbeatInterval": "30"
  }
]

So, we also have a way to determine when the wash cycle completes and take the appropriate actions. I get the current washing state in home assistant and change it to completed, I increment a washing counter and send notifications.

[
  {
    "id": "c7ac9c26b4b3750d",
    "type": "tab",
    "label": "Flow 5",
    "disabled": false,
    "info": "",
    "env": []
  },
  {
    "id": "5511b05f64f5f5b1",
    "type": "trigger-state",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing Complete",
    "server": "770b1d5b.f27204",
    "version": 2,
    "exposeToHomeAssistant": false,
    "haConfig": [
      { "property": "name", "value": "" },
      { "property": "icon", "value": "" }
    ],
    "entityid": "sensor.fibaro_wall_plug_electric_consumption_w",
    "entityidfiltertype": "exact",
    "debugenabled": false,
    "constraints": [
      {
        "targetType": "this_entity",
        "targetValue": "",
        "propertyType": "current_state",
        "propertyValue": "new_state.state",
        "comparatorType": "<=",
        "comparatorValueDatatype": "num",
        "comparatorValue": "2.0"
      },
      {
        "targetType": "this_entity",
        "targetValue": "",
        "propertyType": "current_state",
        "propertyValue": "new_state.state",
        "comparatorType": ">=",
        "comparatorValueDatatype": "num",
        "comparatorValue": "1.6"
      }
    ],
    "inputs": 0,
    "outputs": 2,
    "customoutputs": [],
    "outputinitially": false,
    "state_type": "str",
    "enableInput": false,
    "x": 110,
    "y": 220,
    "wires": [["f313351b2dce9a05", "125dfa81092d0b75", "d2f6fdb914f820b7"], []]
  },
  {
    "id": "f313351b2dce9a05",
    "type": "api-current-state",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing Machine status dropdown state",
    "server": "770b1d5b.f27204",
    "version": 3,
    "outputs": 2,
    "halt_if": "Running",
    "halt_if_type": "str",
    "halt_if_compare": "is",
    "entity_id": "input_select.washing_machine_status",
    "state_type": "str",
    "blockInputOverrides": false,
    "outputProperties": [
      {
        "property": "payload",
        "propertyType": "msg",
        "value": "",
        "valueType": "entityState"
      },
      {
        "property": "data",
        "propertyType": "msg",
        "value": "",
        "valueType": "entity"
      }
    ],
    "for": 0,
    "forType": "num",
    "forUnits": "minutes",
    "override_topic": false,
    "state_location": "payload",
    "override_payload": "msg",
    "entity_location": "data",
    "override_data": "msg",
    "x": 440,
    "y": 220,
    "wires": [["c68cb6e8d6955af9"], []]
  },
  {
    "id": "125dfa81092d0b75",
    "type": "api-call-service",
    "z": "c7ac9c26b4b3750d",
    "name": "+1 to washing count for the day",
    "server": "770b1d5b.f27204",
    "version": 5,
    "debugenabled": false,
    "domain": "counter",
    "service": "increment",
    "areaId": [],
    "deviceId": [],
    "entityId": ["counter.washing_machine_use_count"],
    "data": "",
    "dataType": "jsonata",
    "mergeContext": "",
    "mustacheAltTags": false,
    "outputProperties": [],
    "queue": "none",
    "x": 410,
    "y": 280,
    "wires": [[]]
  },
  {
    "id": "d2f6fdb914f820b7",
    "type": "link out",
    "z": "c7ac9c26b4b3750d",
    "name": "Notification",
    "mode": "link",
    "links": ["5bef9c598f188374", "fc3b25d4ede64aa2"],
    "x": 350,
    "y": 340,
    "wires": [],
    "icon": "node-red/bridge.svg",
    "l": true
  },
  {
    "id": "c68cb6e8d6955af9",
    "type": "api-call-service",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing input to \"Completed\"",
    "server": "770b1d5b.f27204",
    "version": 5,
    "debugenabled": false,
    "domain": "input_select",
    "service": "select_option",
    "areaId": [],
    "deviceId": [],
    "entityId": ["input_select.washing_machine_status"],
    "data": "{\"option\": \"Completed\"}",
    "dataType": "json",
    "mergeContext": "",
    "mustacheAltTags": true,
    "outputProperties": [
      {
        "property": "payload",
        "propertyType": "msg",
        "value": "",
        "valueType": "data"
      }
    ],
    "queue": "none",
    "x": 790,
    "y": 220,
    "wires": [[]]
  },
  {
    "id": "770b1d5b.f27204",
    "type": "server",
    "name": "Home Assistant - Node-red User",
    "version": 2,
    "addon": false,
    "rejectUnauthorizedCerts": true,
    "ha_boolean": "y|yes|true|on|home|open",
    "connectionDelay": true,
    "cacheJson": true,
    "heartbeat": true,
    "heartbeatInterval": "30"
  }
]

I also keep a track of the running time and the washing machine status (Running or Completed) in Home Assistant.

[
  {
    "id": "c7ac9c26b4b3750d",
    "type": "tab",
    "label": "Flow 5",
    "disabled": false,
    "info": "",
    "env": []
  },
  {
    "id": "e0bdee88550c7508",
    "type": "switch",
    "z": "c7ac9c26b4b3750d",
    "name": "Running or completed",
    "property": "payload",
    "propertyType": "msg",
    "rules": [
      { "t": "eq", "v": "Running", "vt": "str" },
      { "t": "eq", "v": "Completed", "vt": "str" }
    ],
    "checkall": "true",
    "repair": false,
    "outputs": 2,
    "x": 500,
    "y": 260,
    "wires": [["47ac4140392aca83"], ["1d8755cc067d138e", "3bfc582ffa71c935"]]
  },
  {
    "id": "8a46dbae7a037860",
    "type": "api-current-state",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing machine stauts dropdown state",
    "server": "770b1d5b.f27204",
    "version": 3,
    "outputs": 1,
    "halt_if": "",
    "halt_if_type": "str",
    "halt_if_compare": "is",
    "entity_id": "input_select.washing_machine_status",
    "state_type": "str",
    "blockInputOverrides": false,
    "outputProperties": [
      {
        "property": "payload",
        "propertyType": "msg",
        "value": "",
        "valueType": "entityState"
      },
      {
        "property": "data",
        "propertyType": "msg",
        "value": "",
        "valueType": "entity"
      }
    ],
    "for": 0,
    "forType": "num",
    "forUnits": "minutes",
    "x": 380,
    "y": 380,
    "wires": [["e0bdee88550c7508"]]
  },
  {
    "id": "14b07d39cf05c174",
    "type": "server-state-changed",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing machine status changed?",
    "server": "770b1d5b.f27204",
    "version": 4,
    "exposeToHomeAssistant": false,
    "haConfig": [
      { "property": "name", "value": "" },
      { "property": "icon", "value": "" }
    ],
    "entityidfilter": "input_select.washing_machine_status",
    "entityidfiltertype": "exact",
    "outputinitially": false,
    "state_type": "str",
    "haltifstate": "",
    "halt_if_type": "str",
    "halt_if_compare": "is",
    "outputs": 1,
    "output_only_on_state_change": true,
    "for": 0,
    "forType": "num",
    "forUnits": "minutes",
    "ignorePrevStateNull": true,
    "ignorePrevStateUnknown": false,
    "ignorePrevStateUnavailable": false,
    "ignoreCurrentStateUnknown": false,
    "ignoreCurrentStateUnavailable": false,
    "outputProperties": [
      {
        "property": "payload",
        "propertyType": "msg",
        "value": "",
        "valueType": "entityState"
      },
      {
        "property": "data",
        "propertyType": "msg",
        "value": "",
        "valueType": "eventData"
      },
      {
        "property": "topic",
        "propertyType": "msg",
        "value": "",
        "valueType": "triggerId"
      }
    ],
    "x": 180,
    "y": 200,
    "wires": [["e0bdee88550c7508"]]
  },
  {
    "id": "5402cfbb2fbac174",
    "type": "poll-state",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing machine status",
    "server": "770b1d5b.f27204",
    "version": 2,
    "exposeToHomeAssistant": false,
    "haConfig": [
      { "property": "name", "value": "" },
      { "property": "icon", "value": "" }
    ],
    "updateinterval": "60",
    "updateIntervalType": "num",
    "updateIntervalUnits": "seconds",
    "outputinitially": false,
    "outputonchanged": false,
    "entity_id": "input_select.washing_machine_status",
    "state_type": "str",
    "halt_if": "",
    "halt_if_type": "str",
    "halt_if_compare": "is",
    "outputs": 1,
    "x": 150,
    "y": 260,
    "wires": [["e0bdee88550c7508"]]
  },
  {
    "id": "47ac4140392aca83",
    "type": "function",
    "z": "c7ac9c26b4b3750d",
    "name": "Milliseconds to Minutes",
    "func": "time = msg.data.timeSinceChangedMs;\nrunningTime = (time / 1000 / 60);\nmsg.runningTime = parseFloat(runningTime).toFixed(1);\nremainingtime = 110 - runningTime;\nmsg.remainingTime = parseFloat(remainingtime).toFixed(1);\nreturn msg;",
    "outputs": 1,
    "noerr": 0,
    "initialize": "",
    "finalize": "",
    "libs": [],
    "x": 770,
    "y": 180,
    "wires": [["7f3b7cbded7ce6be", "c693594518abd80a"]]
  },
  {
    "id": "1d8755cc067d138e",
    "type": "change",
    "z": "c7ac9c26b4b3750d",
    "name": "Not running number",
    "rules": [
      { "t": "set", "p": "runningTime", "pt": "msg", "to": "NaN", "tot": "str" }
    ],
    "action": "",
    "property": "",
    "from": "",
    "to": "",
    "reg": false,
    "x": 760,
    "y": 300,
    "wires": [["7f3b7cbded7ce6be"]]
  },
  {
    "id": "3bfc582ffa71c935",
    "type": "function",
    "z": "c7ac9c26b4b3750d",
    "name": "Milliseconds to Minutes",
    "func": "msg.runningTime = 0;\nreturn msg;",
    "outputs": 1,
    "noerr": 0,
    "initialize": "",
    "finalize": "",
    "libs": [],
    "x": 770,
    "y": 360,
    "wires": [["c693594518abd80a"]]
  },
  {
    "id": "3ecffe436de5790c",
    "type": "inject",
    "z": "c7ac9c26b4b3750d",
    "name": "",
    "props": [{ "p": "payload" }, { "p": "topic", "vt": "str" }],
    "repeat": "",
    "crontab": "",
    "once": false,
    "onceDelay": 0.1,
    "topic": "",
    "payload": "",
    "payloadType": "date",
    "x": 120,
    "y": 380,
    "wires": [["8a46dbae7a037860"]]
  },
  {
    "id": "7f3b7cbded7ce6be",
    "type": "ui_gauge",
    "z": "c7ac9c26b4b3750d",
    "name": "Washing Machine Running Time: ",
    "group": "7e2e840297e6ff32",
    "order": 4,
    "width": "3",
    "height": "4",
    "gtype": "wave",
    "title": "Running Time: ",
    "label": "min",
    "format": "{{msg.runningTime}}",
    "min": 0,
    "max": "80",
    "colors": ["#00b500", "#e6e600", "#ca3838"],
    "seg1": "",
    "seg2": "",
    "className": "",
    "x": 1140,
    "y": 300,
    "wires": []
  },
  {
    "id": "c693594518abd80a",
    "type": "api-call-service",
    "z": "c7ac9c26b4b3750d",
    "name": "Update running time",
    "server": "770b1d5b.f27204",
    "version": 5,
    "debugenabled": false,
    "domain": "input_number",
    "service": "set_value",
    "areaId": [],
    "deviceId": [],
    "entityId": ["input_number.washing_machine_running_time"],
    "data": "{\"value\":\"{{runningTime}}\"}",
    "dataType": "json",
    "mergeContext": "",
    "mustacheAltTags": false,
    "outputProperties": [],
    "queue": "none",
    "x": 1100,
    "y": 240,
    "wires": [[]]
  },
  {
    "id": "b51f0aee106afbd0",
    "type": "comment",
    "z": "c7ac9c26b4b3750d",
    "name": "Multiple triggers",
    "info": "Multiple triggers to ensure as much accuracy as possible.",
    "x": 120,
    "y": 160,
    "wires": []
  },
  {
    "id": "7e26df45e8227dfe",
    "type": "comment",
    "z": "c7ac9c26b4b3750d",
    "name": "Manual trigger",
    "info": "",
    "x": 110,
    "y": 340,
    "wires": []
  },
  {
    "id": "770b1d5b.f27204",
    "type": "server",
    "name": "Home Assistant - Node-red User",
    "version": 2,
    "addon": false,
    "rejectUnauthorizedCerts": true,
    "ha_boolean": "y|yes|true|on|home|open",
    "connectionDelay": true,
    "cacheJson": true,
    "heartbeat": true,
    "heartbeatInterval": "30"
  },
  {
    "id": "7e2e840297e6ff32",
    "type": "ui_group",
    "name": "Utility Room",
    "tab": "e35fd0e6d6776633",
    "order": 1,
    "disp": true,
    "width": "6",
    "collapse": false,
    "className": ""
  },
  {
    "id": "e35fd0e6d6776633",
    "type": "ui_tab",
    "name": "House",
    "icon": "home",
    "order": 34,
    "disabled": false,
    "hidden": false
  }
]

For the notifications, I also use Node-RED and the “notify service” that is from Home Assistant. I have tried to make the flow as modular as possible and I use changes nodes to control the message and which device is notified.

[
  {
    "id": "1a53b6dd316fd626",
    "type": "tab",
    "label": "Flow 8",
    "disabled": false,
    "info": "",
    "env": []
  },
  {
    "id": "b3e4a5624ac9d518",
    "type": "link in",
    "z": "1a53b6dd316fd626",
    "name": "Washing Machine Notifications",
    "links": [
      "ca506a1b0dfe8ba1",
      "e63c199b1210c601",
      "2acc791d40d9f113",
      "b713589b6fc1fa2a",
      "5daafecdbf09105b",
      "d2f6fdb914f820b7"
    ],
    "x": 85,
    "y": 180,
    "wires": [["142cfc8c024d98d0"]]
  },
  {
    "id": "142cfc8c024d98d0",
    "type": "change",
    "z": "1a53b6dd316fd626",
    "name": "Washing Machine Notification",
    "rules": [
      { "t": "set", "p": "domain", "pt": "msg", "to": "notify", "tot": "str" },
      {
        "t": "set",
        "p": "service",
        "pt": "msg",
        "to": "mobile_app_fkapp",
        "tot": "str"
      },
      {
        "t": "set",
        "p": "message",
        "pt": "msg",
        "to": "ACTION - Time to take out washing",
        "tot": "str"
      }
    ],
    "action": "",
    "property": "",
    "from": "",
    "to": "",
    "reg": false,
    "x": 310,
    "y": 240,
    "wires": [["7e2b772ba33565d7"]]
  },
  {
    "id": "7e2b772ba33565d7",
    "type": "api-call-service",
    "z": "1a53b6dd316fd626",
    "name": "Washing out - Action And Text",
    "server": "770b1d5b.f27204",
    "version": 5,
    "debugenabled": false,
    "domain": "{{domain}}",
    "service": "{{service}}",
    "areaId": [],
    "deviceId": [],
    "entityId": [],
    "data": "{\"message\":\"{{message}}\",\"data\":{\"actions\":[{\"action\":\"{{action1Action}}\",\"title\":\"{{action1Title}}\"}]}}",
    "dataType": "json",
    "mergeContext": "",
    "mustacheAltTags": false,
    "outputProperties": [
      {
        "property": "payload",
        "propertyType": "msg",
        "value": "",
        "valueType": "data"
      }
    ],
    "queue": "none",
    "x": 630,
    "y": 240,
    "wires": [[]]
  },
  {
    "id": "770b1d5b.f27204",
    "type": "server",
    "name": "Home Assistant - Node-red User",
    "version": 2,
    "addon": false,
    "rejectUnauthorizedCerts": true,
    "ha_boolean": "y|yes|true|on|home|open",
    "connectionDelay": true,
    "cacheJson": true,
    "heartbeat": true,
    "heartbeatInterval": "30"
  }
]

Until next time, have fun automating your home. 🏡

Sonoff 4ch Pro R2 with ESPHome

Mon, 17 Jan 2022 12:26:36 GMT

In this post, I am going to talk about the process of converting the Sonoff 4CH Pro R2 to ESPHome and how to now connect it to Home Assistant

Tools needed

FTDI Converter
Dupont cables
USB Cable
Sonoff 4ch Pro R2
ESPHome YAML code
ESPHome Flasher
Home Assistant

FTDI Converter

Needed to transfer the compiled .bin to the Sonoff 4Ch Pro, only needed with initial flash from factory firmware to 3rd party firmware.

Dupoint cables

Creates the connection from the FTDI converter to the actual device.

USB Cable

Connects the FTDI converter to the computer

Cable connections

Computer → USB Cable → FTDI Converter → Dupont cables → Sonoff 4ch Pro R2

Sonoff 4Ch Pro R2

This is the device we are going to convert to ESPHome firmware

ESPHome Yaml

Remember to use secrets (! secret)
You can find the file here

# Basic Config
esphome:
  name: sonoff_4chpror2
  platform: ESP8266
  board: esp01_1m

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password

api:

# Example configuration entry
web_server:
  port: 80

logger:

ota:

binary_sensor:
  - platform: gpio
    on_press:
      then:
        - switch.toggle: button_1
    pin:
      number: GPIO0
      mode: INPUT_PULLUP
      inverted: True
    name: "Sonoff 4CH Button 1"
  - platform: gpio
    on_press:
      then:
        - switch.toggle: button_2
    pin:
      number: GPIO9
      mode: INPUT_PULLUP
      inverted: True
    name: "Sonoff 4CH Button 2"
  - platform: gpio
    on_press:
      then:
        - switch.toggle: button_3
    pin:
      number: GPIO10
      mode: INPUT_PULLUP
      inverted: True
    name: "Sonoff 4CH Button 3"
  - platform: gpio
    on_press:
      then:
        - switch.toggle: button_4
    pin:
      number: GPIO14
      mode: INPUT_PULLUP
      inverted: True
    name: "Sonoff 4CH Button 4"
  - platform: status
    name: "Sonoff 4CH Status"

switch:
  - platform: gpio
    id: button_1
    name: "Sonoff 4CH Relay 1"
    pin: GPIO12
  - platform: gpio
    id: button_2
    name: "Sonoff 4CH Relay 2"
    pin: GPIO5
  - platform: gpio
    id: button_3
    name: "Sonoff 4CH Relay 3"
    pin: GPIO4
  - platform: gpio
    id: button_4
    name: "Sonoff 4CH Relay 4"
    pin: GPIO15

output:
  - platform: esp8266_pwm
    id: blue_led
    pin: GPIO13
    inverted: True

light:
  - platform: monochromatic
    id: status_led
    name: "Sonoff 4CH Blue LED"
    output: blue_led

ESPHome Flasher

Currently found here

Home Asisstant

Great guide here to install the integration.

Added the flashed ESPHome device to Home Assistant using the ESPHome integration

Azure Resource Graph - More queries for Networking and Management Groups

Thu, 09 Dec 2021 08:00:00 GMT

Just some more queries I have developed.

Networking

Don’t create unnecessarily large virtual networks (for example, /16) to ensure that IP address space isn’t wasted.

resources
| where type == "microsoft.network/virtualnetworks"
| extend addressSpace = todynamic(properties.addressSpace)
| extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes)
| mvexpand addressSpace
| mvexpand addressPrefix
| extend addressMask = split(addressPrefix,'/')[1]
| where addressMask <= 16

Smallest recommended size for a GatewaySubnet is /27

When you are planning your gateway subnet size, refer to the documentation for the configuration that you are planning to create. For example, the ExpressRoute/VPN Gateway coexist configuration requires a larger gateway subnet than most other configurations. Additionally, you may want to make sure your gateway subnet contains enough IP addresses to accommodate possible future additional configurations. While you can create a gateway subnet as small as /29, we recommend that you create a gateway subnet of /27 or larger (/27, /26 etc.) if you have the available address space to do so. This will accommodate most configurations. Microsoft Docs

resources
| where type == "microsoft.network/virtualnetworks"
| extend subnets = todynamic(properties.subnets)
| mvexpand subnets
| project VNetname=name,SubnetName=subnets.name, resourceGroup, location, CIDR=subnets.properties.addressPrefix, id
| where SubnetName == 'GatewaySubnet'
| extend subnetMask = split(CIDR,'/')[1]
| where subnetMask >= 27

Use IP addresses from the address allocation for private internets (RFC 1918).Plan for IP addressing

resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | where cidr matches regex @'^(?:10|127|172\\.(?:1[6-9]|2[0-9]|3[01])|192\\.168)\\..*'

resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | where not (cidr matches regex @'^(?:10|127|172\\.(?:1[6-9]|2[0-9]|3[01])|192\\.168)\\..*')

Don’t create unnecessarily large virtual networks (for example, /16) to ensure that IP address space isn’t wasted. Plan for IP addressing

resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | where addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix

resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | where addressMask <= 16 | project name, id, subscriptionId, resourceGroup, addressPrefix

Management Groups

Keep the management group hierarchy reasonably flat, with no more than three to four levels ideally. This restriction reduces management overhead and complexity. Define a management group hierarchy

resourcecontainers
| where type == "microsoft.resources/subscriptions"
| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain
| where array_length(mgmtChain) ==1
|mvexpand mgmt=mgmtChain
|project id, subName = name, subscriptionId, managedBy, managementGroupName = mgmt.displayName

resourcecontainers
| where type == "microsoft.resources/subscriptions"
| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain
| where array_length(mgmtChain) >=4
|mvexpand mgmt=mgmtChain

Follow me for more.
Twitter
LinkedIn

Azure Resource Group Enterprise Scale Landing Zone queries

Wed, 25 Aug 2021 03:58:18 GMT

Azure Resource Graph Examples

This is just a quick post. I am slowly working on building a collection of Resource Graph Queries - they can be found here and will grow over time. It just takes some time to build these.

They will be broken down into a folder structure based upon the Critical Design Areas of Enterprise Scale Landing Zone

Hope this helps and keep an eye out for more.

Follow me for more.
Twitter LinkedIn

Bicep Troubleshooting

Fri, 02 Jul 2021 03:40:16 GMT

Some basic “troubleshooting” with Azure Bicep

So, let me start with this. The team and the community behind Azure Bicep are amazing. There are some great examples here. I often use these as a base and the rip apart or add to meet my needs, you do NOT need to start from ground zero. :smile:

When you are deploying bicep templates you command will look something like this.

$bicepFile = ".\main.bicep"
New-AzResourceGroupDeployment -ResourceGroupName <resourceGroupName> -TemplateFile <bicepFilePath> -name <deploymentname>

I love to use repeatable code, so mine has more variables and would look like this.

## Place Resource Group Name here
$rgName = "testingRG"
## add tags if you want to add metadata
$tags = @{"deploymentMethod"="bicep"; "Can Be Deleted"="yes"}
## location to be deployed into
$rgLocation = "westeurope"

#use this command when you need to create a new resource group for your deployment
$rg = New-AzResourceGroup -Name $rgName -Location $rgLocation 
New-AzTag -ResourceId $rg.ResourceId -Tag $tags

## bicep Deployment
## Bicep File name
$bicepFile = ".\main.bicep"
$deploymentName = ($bicepFile).Substring(2) + "-" +(get-date -Format ddMMyyyy-hhmmss) + "-deployment"
New-AzResourceGroupDeployment -ResourceGroupName $rgName -TemplateFile $bicepFile -name $deploymentName

When trying to deploy you might get an error like this.

And that is very cryptic and NOT easy to understand. The easiest fix here is to go back to basics. :smile:

az bicep build --file .\main.bicep

This will then throw the actual bicep error, and then you can fix your file and deploy again.

Hope this helps you.

Cli List Locations and Peers

Wed, 05 May 2021 05:03:02 GMT

How to use the Azure CLI to list Azure Locations and their peers

So this will be a “quick post” that shows some great functionality within the Azure CLI with az account list-locations. With this command you can expect some output like below, you actually get a lot of content back.

{
    "displayName": "Brazil Southeast",
    "id": "/subscriptions/949ef534-07f5-4138-8b79-aae16a71310c/locations/brazilsoutheast",
    "metadata": {
      "geographyGroup": "South America",
      "latitude": "-22.90278",
      "longitude": "-43.2075",
      "pairedRegion": [
        {
          "id": "/subscriptions/949ef534-07f5-4138-8b79-aae16a71310c/locations/brazilsouth",
          "name": "brazilsouth",
          "subscriptionId": null
        }
      ],
      "physicalLocation": "Rio",
      "regionCategory": "Other",
      "regionType": "Physical"
    },
    "name": "brazilsoutheast",
    "regionalDisplayName": "(South America) Brazil Southeast",
    "subscriptionId": null
}

If you look at some of the examples, you will also see some “logical” locations, example below, there is a way of adding a query to remove these to display only “physical” locations.

{
  "displayName": "United States",
  "id": "/subscriptions/949ef534-07f5-4138-8b79-aae16a71310c/cations/unitedstates",
  "metadata": {
    "geographyGroup": null,
    "latitude": null,
    "longitude": null,
    "pairedRegion": null,
    "physicalLocation": null,
    "regionCategory": "Other",
    "regionType": "Logical"
  },
  "name": "unitedstates",
  "regionalDisplayName": "United States",
  "subscriptionId": null
}

I use a simple query to remove all locations without latitide and in my case simply return the Region Name 😄

az account list-locations --query "[?not_null(metadata.latitude)] .{RegionName:name}" --output json

{
  "RegionName": "brazilsoutheast"
}

So, now to get the paired region, again if we look at the JSON output, there is ALWAYS only 1 result within the array for Paired Region; as per this only 1 paired region 😄. We will use this to our advantage

az account list-locations --query "[?not_null(metadata.latitude)] .{RegionName:name, PairedRegion:metadata.pairedRegion[0].name}" --output json

{
  "PairedRegion": "brazilsouth",
  "RegionName": "brazilsoutheast"
}

Azure Rest Api Postman Basics

Wed, 14 Apr 2021 07:02:18 GMT

Absolute basics with Azure and PostMan

Getting started

Many of the articles I have found online with regards to the Azure REST API assume a fair level of familiarity with Azure which can be a good and bad thing. You see the Azure Portal makes interacting with the Azure REST API very easy as a lot of the “prerequisite” work is done in the portal as part of the process. For this blog post we will work on something quite basic, “Create a Virtual Machine”.

Jon Gallant has some great content around this and I did use some content from here, thank you Jon Gallant.

Within the Azure Portal this is very easy and only requires a few clicks, however under the hood, in order for the Azure REST API to work, there is a lot more going on. Lets dive in :smile:

API Order

Have a Resource Group available or create one.
Have a Virtual Network (VNET) available or create one.
Create a Virtual Network Interface Card (NIC) or create one.
Create a Virtual Machine.

There is a lot of association and the like that goes on in the background.

Resource Group created.
NIC associated to VNET.
NIC associated to VM.
VM created in Resource Group.

Using the API

So, what I have done, is simply create a collection within Postman that uses both collection variables and “Pre-request” scripts to make this collection “portable”.

Postman Collection

I use a set of collection variables to help with the initial API Call. With each of the call you will the variables enclosed with ”{}” and path variables prefixed with ”:” With most of the Postman queries, the “Pre-request Script” is also used, this is used to set “extra” pieces of information, for example, specifying a location for the Resource Group.

So, go forth and play. My Postman Collection can be found here

Expiring Keys and Secrets within Azure Key Vault

Mon, 18 Jan 2021 05:06:03 GMT

I was working with a customer the other day and a fairly simple ask came up, I however could not find an immediate answer within the portal.

How do I check for expiring keys within the Azure KeyVault?

Now being a PowerShell person, I never gave this much thought as for most tasks or actions I perform on the Azure Platform is done through PowerShell, AP, or CLI. So easy enough, however, not everyone knows how to do this in PowerShell. So, I created a simple script.

My requirements

You can specify the days to check as your expiry window.
You can also check for non-expiring keys.
Can be run within the Cloud Shell

For me, it is equally important to check for expiring keys, for key rotation there is a process to do this. Just as important, if not MORE IMPORTANT is non-expiring keys (think “password never expires on a Domain Admin account”).

I was simply after a quick and easy click and run script. THe script is hosted on my repo and the specific script can be found here

$vaultName = ""
$kvRG = ""
$kv = Get-AzKeyVault -ResourceGroupName $kvRG -VaultName $vaultName
$secrets = Get-AzKeyVaultSecret -VaultName $kv.VaultName

$nonExpiringSecrets = $secrets | Where-Object {$_.Expires -eq $null}
$expiringSecrets = $secrets | Where-Object {$_.Expires -ne $null}

$daysToCheck = 90
$expireDate = (Get-Date).AddDays($daysToCheck)

foreach ($expiringSecret in $expiringSecrets)
{
    if ($expiringSecret.Expires -lt $expireDate)
    {
        Write-Host ($expiringSecret).name "is in the expiry window of $daysToCheck days"
    }
}
foreach ($nonExpiringSecret in $nonExpiringSecrets)
{
    Write-host ($nonExpiringSecret).name " is set to NEVER expire"
}

As you can see simply replace the variables that you need to, namely $vaultName (name of the Azure Keyvault) and $kvRG (name of the Resource Group housing the Azure Keyvault)

Azure Ghost Cms and Cdn

Mon, 11 Jan 2021 05:00:18 GMT

I moved my blog onto HUGO. Not everyone would want to do this necessarily, there is a bit of a learning curve, part of the reason I DID IT :). However there are other platforms you can use and still add more functionality if you want.

You can use Ghost and add an Azure CDN. This is what this blog post will cover.

There are some very clever people out there that have made this very easy for you. From my research you have 2 main options.

A “simple Web App”
More complex deployment with Containers and a CDN - now this sounds interesting.

For this post I naturally focused on option 2 :). A BIG shoutout goes to Andrew Matveychuk. I am all about “Standing on the shoulders of giants”. I used his repo and then forked it into mine. He has a nice blogpost on his journey. I simply unpacked this a little further and went into some more details and highlight some of the potential gotchas and setting up things in more detail with specific focus on the Azure Portal.

Deployment

The deployment is nice and easy thanks to a one-click deploy - thanks again Andrew Matveychuk.

It “deploys” pretty quickly but, of course, this is just the start of the work.

During deployment

During the deployment of the application you will see the Web App change.

Almost

Success!!!
You will see something SIMILAR to this.

Gotcha with Container Deployment

The solution takes a while to deploy - this seems to be due to some changes made recently by Docker. Do NOT be hasty like I was, this can cause issues and create the need for a re-deploy. Instead lets use the logs to see what is going on :)
Now let’s find the log I was talking about. We are waiting for this entry

So, now to add move value, we can add an Azure CDN (in this case, this has already been done) and look at configuring your own custom name for this.

A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs’ store cached content on edge servers in point-of-presence (POP) locations that are close to end users, to minimize latency.

So we can add a custom domain to a CDN to make this more pretty and give your site a more more friendly name - you can move away from the https://xyz.azurewebsites.net, I definitely think a custom domain is far cleaner and “more professional”. So let’s dive in and get this done. :)

So, there a few steps to get this done. This is well documented here, however I will provide more context and give some sample screenshots.

We have some DNS Settings to configure as per the above article. Below, I have added some sample for the CDN demo I configure for this blog.

Create the required verification entries in your DNS Zone. I use ClouDNS but the process is the same, just how you create the required entries will vary with each provider. This process should not take too long, but now we want a certificate and the joys of TLS
Start the verification process
Domain Verification
Create a certificate
And completed

Now here is the end result - note the HTTPS 👍

My New Blog Home with Azure Static Web App

Tue, 05 Jan 2021 13:57:04 GMT

So, I have spent the last few days / weeks deciding the best way to host a blog. Now I have a decidedly “split personality”. By this I mean I like to segregate my work and personal hobbies. This can be quite beneficial as this allows me to test a few things.

A few key decisions

Must be version controlled - good practice and forces me to get more familiar with git.
Must be reliable and redundant, or at least enough to re-deploy if needed - see point 1 :) .
Must be as cheap as possible to run and be fairly quick.
Must be a learning experience.

Points 1 and 2 makes git a natural choice. Point 3 makes Azure or GitHub Pages a natural choice. For point 4, With this being my “work persona” I chose Azure Static Web App. I have used GitHub Pages for my “personal persona”.

So now with the basics out of the way, I needed to chose a static content generator. Based on discussions with a few people and again wanting to learn something, hugo was chosen and then there is a great guide here as a starting point.

The blog you are reading now is hosted with the above criteria and of course a custom domain name.

More to come soon.

Shelly Lamps

Tue, 05 Jan 2021 11:35:15 GMT

Use Case

I had been using a WiFi bulb with the lamps to control the lighting, this was working very well. The lights would come at set times and this was great. I even have automation around presence detection and the lights would NOT come on if the house was NOT oocupied. However, them it comes to actual sleep, my wife was unable to switch off the lamp with causing the WiFi bulb to be dropped from the network and then breaking the automation. This was NO good.

Solution 1

I also use ZWave around the house and decided to use a WallMote with Node-Red to map buttons to control the above lights, this solution was better but still lacked the local control. My wife was happier but not yet happy.

Solution 2

So I just recently finished building my Shelly1 based lamps. I simply added the Shelly into the wiring of the lamp. I use the term “simply” loosely. This was an actually a bit of a process as the lamp needed to modified in order for this to work. I added an electrical junction box to the bottom of the lamp and then added the required wiring into the box and added a nice simple external switch.

I followed this video - shelly 1 how to wire it

Takeaway

Always be focused on what you are trying to achieve, home automation should enhance your life, not add challenges.

Importance of Networking Azure

Wed, 07 Aug 2019 14:33:36 GMT

As a start to this blog post, I think it is important to understand how I see my role as a CSA (Cloud Solution Architect) with my customer. I am primarily a trusted advisor and my customers respect what I have to say, I question and challenge my customers in a constructive way to approach the challenge or problem statement in a different way. I have an amazing role of using Azure as my LEGO playpen and then building a custom solution (LEGO model) to help my customers.

So, of late I have been having a lot of networking discussions with my customers. Now these discussions have been ranging from a new customer to a very advanced customer that has been using Azure for quite some time. These have also ranged from new connection options to extend their on-premises connectivity into Azure, which we call “Hybrid Connectivity”, as well as networking considerations once in the cloud with Azure Native connectivity such AKS (Azure Kubernetes Service) and ACI (Azure Container Instances) to simply name the current most top of mind topics.

So, having these discussions is not an uncommon practice and these are the types of discussions that should be happening, there is nothing wrong with this. All that is happening more and more often is that these discussions are happening in isolation as opposed to the customer working on having a holistic approach to this discussion and working on a full cloud networking solution.

You cannot necessarily think of networking in silos anymore. Yes, networking can be silo’ed and many people do this. However with the “new world” of cloud and the networking associated to this concept, networking is now a critical point on your cloud journey. There are multiple options available here as a start. THe main role of a Cloud SOlutions Architect or more importantly a trusted advisor, is to understand the requirements of your customer and work with the required teams, usually networking, InfoSec, business owner and Application owner to determine the correct networking option for the cusotmer. This would be a mix of solutions and architectures.

This is a great start to understanding which technologies can or could be used to serve a particular need and then this can be built up to a solution that is extendable and usable by your customer.

Csa Tools of the Trade

Tue, 09 Jul 2019 14:46:43 GMT

So a question I often get asked is “what tools or products do you use?”. So I decided to do a post around the tools and technologies that I personally use on a daily basis. So to start this is what people see on my screen on a daily basis.

This is my most common tool, Visual Studio Code, the version shown above is actually the Insiders Build. The primary reason for this tool is that is a “container” for other tools and functionality. The extra functionality is enabled with extensions, my most used extensions are as follows:

Docker, love my containers.
GitLens, used for my source control, all my code is located here for my Azure related code
Azure Account (VSCode Extension) , this allows me to run the Azure Cloud Shell from within VSCode, this includes both PowerShell and BASH.
Kubernetes, can’t really have Docker without this nowadays :)

Now, aside from Visual Studio Code, I also use the following:

Windows Terminal (Preview), I use this extensively for testing of code and running Docker
WSL2 (Windows Subsystem for Linux 2), I am running the Preview version of this as it is not yet GA, but so far so good.

I use many other applications, however this is my collection of “go-to” tools. This should be in your “cloud arsenal”

Network Security Group Change Alerting

Wed, 20 Feb 2019 06:21:49 GMT

So, I was with a customer and they are asking for a fairly standard alert.

“Please alert me when an NSG is added or modified”. Seems simply enough, however this is not as simply as you think. So I used my favourite search and found the following, “How to receive an email on Azure Network Security Group Rule changes“, this is great content and after testing, it works exactly as expected. I just found one little concern with this approach; this is simply finding the required ID for the action group. I have now investigated and found some code to make this a little easier.

AZ CLI

az monitor action-group list

PowerShell

Get-AzActionGroup

Hope this helps people in the field to find the Resource Group ID more easily.

Fletcher Kelly

Enhancing Node-Red with GUIDs

Background

So what is the problem?

How did I fix this?

Is it worth it?

Using the Pinchflat YouTube Downloader

Installation

Usage

Conclusion

Time to get my “print” on

Planning for my new 3D printer

So, what did this lead to?

What is a PV Fireman Switch?

So, why is this needed with on-grid systems?

What happens if it “breaks”?

Using the AZ Rest CLI command

Azure VMware Solution How Do I 'Monitor my SDDC Deployment'

What are we doing?

How do I monitor an Azure VMware Solution deployment?

Azure VMware Solution Starter Links

What are we doing?

Azure VMware Solution Architecture

Azure VMware Solution Design

Azure VMware Solution Management and Operations

Azure VMware Solution Migrate

Assessment

Migration Tooling

Other tools and links

Starting Wth Rest Calls With AzCli With Some Copilot Help

What are we doing?

Constraints / limitations

Lets build this

Get Azure AD Token

Getting resource groups with an API call

Starting Wth API Rest Calls With Powershell

What are we doing?

Constraints / limitations

Lets build this

Get Azure AD Token

Getting resource groups with an API call

Can I run this cheaper? Use case for the Azure Cost Management API

What are we doing?

Constraints / limitations

Lets build this

Steps

New LDAPS run-command for Azure VMware Solution

What are we doing?

Lets build this

Azure VMware Solution: A comprehensive guide to LDAPS identity integration - Part 1

Implementing LDAPS identity integration with Azure VMware Solution series - 1 of 4

Run-Commands for high(er) privileged operations

Our Azure VMware Solution lab environment

Azure VMware Solution: A comprehensive guide to LDAPS identity integration - Part 4

Implementing LDAPS identity integration with Azure VMware Solution series - 4 of 4

Azure VMware Solution: A comprehensive guide to LDAPS identity integration - Part 2

Implementing LDAPS identity integration with Azure VMware Solution series - 2 of 4

Configure DNS forwarding prerequisite

Open the Azure VMware Solution DNS configuration pane

Configure the required DNS zones details

Attach the DNS zone configuration to the NSX-T DNS forwarder service

Azure VMware Solution: A comprehensive guide to LDAPS identity integration - Part 3

Implementing LDAPS identity integration with Azure VMware Solution series - 3 of 4

Implement LDAPS integration

Check domain controller certificates and LDAPS

Extract (correct) domain controller certificates

Validate domain controller certificate requirements

Create Azure Storage account

Manual deployment

Automated deployment

Create Storage Blob container

Manual deployment

Automated deployment

Upload domain controller certificates

Manual deployment

Automated deployment

Generate SAS tokens for domain controller certificates

Manual deployment

Automated deployment

How to configure LDAPS with AVS