Відео

Thank you! Really glad you liked it 🙂

Thanks so much for the feedback, really glad to hear it was helpful!

Interesting. I’m not 100% following sorry, can you provide some more info? Alternatively, logging an issue on the Bicep GitHub might be the go, you can easily attach screenshots / output / examples, and there are people much more clever than I there 😀

Hey there! While I’m sure I could, there are lots of good resources out there on this topic already! One place I would recommend starting is below learntocloud.guide

Thanks so much! Sorry about the delayed reply, been a bit busy! There’s definitely a lot of topics in the pipeline, but very little time to achieve them 😅

Thanks very much - I really appreciate the feedback. Glad you enjoyed the video!

Thanks for watching, I’m glad you found it helpful!

Thanks for watching! I’m not sure if it can be integrated directly with Digicert sorry. From memory there are supported CAs on the main readme in the project on GitHub, and it might be worth raising an issue on the project if you have a feature request.

Hey! That's the service principal that was set up to authenticate to Azure using the azure/login@v1 action int he workflow (lines 27-32 in the GitHub workflow in the repository). When the workflow runs, it logs into Azure using this principal, and that's the same one I'm defining to give access to the key vault in the Bicep template. Hope that makes sense?

@@MattAllford Hey! Yep, that makes sense, but I am wondering how is the runner allowed to log in using the principal? And where does it come from, did you just create it yourselves?

@@emilkordahl4113 So in this scenario, I created a Microsoft Entra Application with a service principal, and then gave this the required access it needs in Azure. From there, you store the information about the service principal in a GitHub secret, and then reference those secrets with the azure/login@v1 action. Part of this also requires you to configure the app registration to allow tokens from GitHub to leverage the app registration / service principal. John Savill has a great overview of OIDC authentication from GitHub to Azure (which is what I'm using) over here - ua-cam.com/video/XkhkkLBkAT4/v-deo.html

@@MattAllford Ah great, thanks for the quick response!

Thank you! Good call, there’s been a few updates to the tool now as well which might be worth showing.

Thanks so much for taking the time to leave a comment! Really glad it was helpful!

Thanks for watching, glad it was helpful! I use a physical Wacom device with a pen, and for this one I was just using Microsoft whiteboard. As you can tell I’m not very experienced with it yet and still figuring that bit out 🤣 When I was drawing boxes / arrows on the screen, that was using “ZoomIt” from Microsoft, part of the sysinternals suite of software. There are a number of 3rd party apps that can achieve this on screen annotation too. www.wacom.com/en-au/products/pen-tablets/one-by-wacom

Thanks for the feedback! And yeah, what you’ve described is just one of the trade off decisions that you need to make as part of the architecture and design on your application(s). One thing to consider would be to use this key vault only for certificate storage, and then the risk of allowing public access from a network perspective is probably a little less risky, compared to if you were storing other secrets and information. On top of that, it’s just about the layers of security you’re able to implement, and deciding what level is a suitable configuration between usability, cost, and security. With all of that said, and I know it is still in preview, but have you seen the Flex Consumption option? It’s a little more expensive I think than standard consumption, but it supports VNET integration - learn.microsoft.com/en-us/azure/azure-functions/flex-consumption-plan

@@MattAllford Good shout; I'd not come across that, but it looks ideal. Sadly my infra's deployed using IaC (Terraform), and whilst the FC1 SKU (flex consumption) was added last week, it looks like support for the (mandatory for FC1) `FunctionAppConfig` property of the function app isn't yet there. For now I'll try deploying a Basic plan, then will switch over to the cheaper flexible plan once it becomes available. Really appreciate your input; thanks again.

Awesome to hear, glad it helped you get up and running with the wildcard!

Hey Paul! Yeah, I realised after I filmed this that things were slightly different in an Enterprise, and I added a few sections in, but I can't recall how many. For your first question, yes, you still get the Database ID, but instead you pass in your enterprise slug, the specific docs are here: docs.github.com/en/enterprise-cloud@latest/admin/configuration/configuring-private-networking-for-hosted-compute-products/configuring-private-networking-for-github-hosted-runners-in-your-enterprise#1-obtain-the-databaseid-for-your-enterprise For question 2, given the setup in an Enterprise is done at the Enterprise level, you can then leverage it from multiple organisations. So you could probably go either way you want, where you setup specific runners and runner groups at the enterprise level, for each organisation, or you could just set up one at the enterprise level to use across multiple orgs. Hope that helps!

Thanks for the feedback! Good question - I’m honestly not sure. I don’t think that functionality was there when this video was released, but it may be today. Alternatively leveraging LLMs to create the files is a great use of that technology.

@@MattAllford thanks will try

Glad it helped! Thanks for watching!

You're most welcome, glad it is helpful!

Thanks for watching, happy to hear it was helpful! Point noted - might make for a good follow up section. Not sure if you came across it, but there's a bit of info in the docs about using the API if that's of interest: github.com/shibayan/keyvault-acmebot/wiki/

Thanks for watching, and sorry for the delay in response. You are correct! As long as the VNET where the GitHub runner NIC is located has routing and firewall access to the target resources, it will be good to go. It will abide by any network policies and configurations such as DNS that you have applied to the network it joins 👍

Awesome, love to hear that!

Hi there! Thanks for watching. There is some information in the WIKI page of the tool for Route 53 linked below. Otherwise this might be a good use case to get a LLM to help with the specific steps you’re looking for? github.com/shibayan/keyvault-acmebot/wiki/DNS-Provider-Configuration#amazon-route-53 Hope that helps.

Thank you mate, glad you liked it 🙂

I haven’t come across that myself, sorry. There seems to be a bit of information about that error and JMX files. Have you gotten far with general troubleshooting or even with a LLM like ChatGPT?

I also got MalformedURLExpception. I used your sample directly and used it from git. It appears as if somehow environment variables are not picking up. Checked UDVs it is correct. Any settings in Azure to somehow let it pick?

Glad it was helpful!

Thank you for watching and taking the time to comment - I really appreciate the feedback!

100% agree! I’m sure they’ll see a big uptake in this integration, and can then hopefully bring it to other cloud platforms too.

Thanks for watching! I’m glad it was helpful.

Hi there. Apologies, I missed this comment. I’m not sure what is going on, sorry. Are you able to engage Azure support to help troubleshoot?

Thanks for the support! Yes, absolutely aiming to keep the content for the course rolling out. Unfortunately the last 6 months threw a few hurdles my way and cause a delay in production. Planning is well underway for the next section!

Thank you, glad you enjoyed it!

Woo! That's a fantastic solution, great work, and I'm glad this helped you achieve a hands off, low cost automated solution :) Thanks for sharing the update, I love hearing when people put this sort of thing in to practice!

Hello @Saqibss how did you link azure dns to the functionapp, what did you add in the app settings of the function app, its not working for me

@@flapa2010 see the documentation for ACMEBOT and azure dns. Open the Access Control (IAM) of the target DNS zone or resource group containing the DNS zone, and assign the role of DNS Zone Contributor to the deployed function application.

@@flapa2010 check the documentation you need to add the Subscription ID that the DNS zone resides in under "Acmebot:AzureDns:SubscriptionId" and then ensure the function app has the DNS contributor permission on the DNS zone (under IAM).

Thanks for the feedback, I’m glad it was helpful!

I’m not sure about the specifics of that one, sorry.

Hey! Yep, the solution will automatically renew certificates 30 days before their expiry - github.com/shibayan/keyvault-acmebot/wiki/Frequently-Asked-Questions#automatic-renew-an-existing-certificate Hope this helps!

Hey Simon. Are you referring to the protection of the API key being used to access your DNS provider? The best course is to store the API key as a secret in Key Vault, and then reference that secret from the function app. For example, the app setting "Acmebot:Cloudflare:ApiToken" on the function app could be set to reference the key vault secret containing the API Key, rather than pasting it directly in to the value (like I did in the video). Does that help?

My pleasure! Thank you for watching!

Hey Patrick. Thanks for the comment and the feedback. I really appreciate you took the time to let me know - as a content creator that really helps a lot! Glad the video was useful for you 🙂

I love to hear that! Thank you for watching and I’m glad it helped.

Hi there. Sorry about the delay in response, I missed this comment. The $3 renewal is not relevant with this solution - that’s applicable when Key Vault itself is processing the renewal. This solution performs the renewal outside of key vault, and is just using key vault to store the certificate. Hope that helps!

Awesome! Glad it was helpful!

Thank you for watching! I’m glad it helped.

Thanks Wasim, appreciate the watch and the feedback! At the end of the day, the content I create here is something I do to share knowledge and try to deep dive in to various topics. If the next generation or the algorithm aren’t happy with that, then that’s ok 🙂 I try to create content I’d enjoy consuming. There’s definitely a backlog of content to create (over 40 topics / ideas), but as you noted there are often more important things that demand my time.

@MattAllford thanks for your quick reply. I agree and disagree with you at the same time; I realize that when you do something like UA-cam, you usually want to talk about subjects your way, leaving behind the constraints we often have in our work environments; however, as an opportunistic I am, I believe that you have all the qualities that can make you huge in the field on UA-cam or any other platform. I really hope to see more of your content soon.

Glad it was helpful!

Thanks for watching! Sorry to hear the docs are falling short. Do you have an active subscription with a support agreement? It could be worth opening a service request via the Azure Portal. Otherwise, I believe the team moved from GitHub issues over to the VS developer community for load testing ideas, feedback, and issues. URL is below, I hope this helps! developercommunity.visualstudio.com/loadtesting

Hi there, sorry I did not see this comment earlier. I’m not immediately aware of the ability to add multiple DNS zones to a single function app, but I can see why that’s a valid request. I’d suggest logging an issue on the GitHub page to see if that functionality is available today, and if not then make it a feature request!