Sometimes modules encapsulate the functionality so well that you don’t really understand what’s happening under the hood anymore. And as you might know, I hate magic.

text

text

apiVersion: v1
kind: Service
metadata:
  name: network-app-svc
  namespace: network-app
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8080
  selector:
    app: network-app

apiVersion: apps/v1
kind: Deployment
metadata:
  name: network-app-deployment
  namespace: network-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: network-app
  template:
    metadata:
      labels:
        app: network-app
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app: network-app
      containers:
        - image: jannemattila/webapp-network-tester:1.0.75
          name: network-app
          resources:
            requests:
              cpu: 100m
              memory: 100Mi
            limits:
              cpu: 150m
              memory: 150Mi
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP

Update the service:

apiVersion: v1
kind: Service
metadata:
  name: network-app-svc
  namespace: network-app
  annotations:
    service.kubernetes.io/topology-mode: Auto
spec:
  type: ClusterIP
  trafficDistribution: PreferClose
  internalTrafficPolicy: Local
  ports:
    - port: 80
      targetPort: 8080
  selector:
    app: network-app

resource_group_name="rg-aci-demo"
location="swedencentral"

az group create -l $location -n $resource_group_name -o table

aci_ip=$(az container create \
  --name "aci-demo" \
  --resource-group $resource_group_name \
  --image "jannemattila/webapp-network-tester:1.0.76" \
  --ports 80 \
  --ip-address Public \
  --cpu 1 \
  --memory 1 \
  --environment-variables "ASPNETCORE_URLS=http://*:80" \
  --restart-policy Always \
  --query ipAddress.ip -o tsv)

curl $aci_ip

az acr update --name "jannemattila" --anonymous-pull-enabled true

• Public ACR to avoid ACI issues
  • https://github.com/Azure/acr/blob/main/docs/custom-domain/README.md
  • az acr update –name --custom-domain

  az acr import –name jannemattila –source docker.io/jannemattila/web-navigator:latest –image web-navigator

text

text

Supported resource types

Activity Log

Add a tag: It comes fast, Web app deployment: might take a while (11:50 -> )

I hope you find this useful!

https://carsonip.me/posts/azure-tcp-idle-timeout-tcp-keepalive-python/

https://github.com/wbuchwalter/azure-content/blob/master/includes/guidance-tcp-session-timeout-include.md

https://support.esri.com/en-us/knowledge-base/change-the-operating-system-s-keepalive-settings-146247-000006285

https://www.reddit.com/r/networking/comments/1f4ystv/if_i_enable_tcp_keepalive_on_a_server_but_not_on/?rdt=41623

$ netsh int tcp show global
Querying active state...

TCP Global Parameters
----------------------------------------------
Receive-Side Scaling State          : enabled
Receive Window Auto-Tuning Level    : normal
Add-On Congestion Control Provider  : default
ECN Capability                      : enabled
RFC 1323 Timestamps                 : allowed
Initial RTO                         : 1000
Receive Segment Coalescing State    : enabled
Non Sack Rtt Resiliency             : disabled
Max SYN Retransmissions             : 4
Fast Open                           : disabled
Fast Open Fallback                  : enabled
HyStart                             : enabled
Proportional Rate Reduction         : enabled
Pacing Profile                      : off

$ netsh int tcp set global tcpkeepalive=enabled

Linux

https://tldp.org/HOWTO/TCP-Keepalive-HOWTO/usingkeepalive.html

$ cat /proc/sys/net/ipv4/tcp_keepalive_time
7200

$ cat /proc/sys/net/ipv4/tcp_keepalive_intvl
75

$ sudo bash -c "echo 60 > /proc/sys/net/ipv4/tcp_keepalive_time"
$ sudo bash -c "echo 60 > /proc/sys/net/ipv4/tcp_keepalive_intvl"

$ cat /etc/sysctl.conf
  net.ipv4.tcp_keepalive_time = 60

$ nc -l 5000

$ sysctl net.ipv4.tcp_keepalive_time net.ipv4.tcp_keepalive_intvl
$ sysctl -w net.ipv4.tcp_keepalive_time=60
$ sudo nano /etc/sysctl.conf

Capture filter

tcp port 5000 and not src host 168.63.129.16 and not dst host 168.63.129.16

However, there is a new property flushConnection in Network Security Group: <!–

• NSG Flush Connection
  • https://learn.microsoft.com/en-us/powershell/module/az.network/new-aznetworksecuritygroup?view=azps-13.3.0
  • https://learn.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups?pivots=deployment-language-bicep
  • https://learn.microsoft.com/en-us/dotnet/api/microsoft.azure.management.network.models.networksecuritygroup.flushconnection?view=azure-dotnet

https://learn.microsoft.com/en-us/dotnet/api/microsoft.azure.management.network.models.virtualnetwork.flowtimeoutinminutes?view=azure-dotnet –>

flushConnection
When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation.

To enable this functionality, you need to set flushConnection to true:

resource nsg 'Microsoft.Network/networkSecurityGroups@2023-11-01' = {
  name: nsgName
  location: location
  properties: {
    flushConnection: true // <- This is the new property
    securityRules: [
      {
        name: 'HttpInbound'
        properties: {
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '80'
          sourceAddressPrefix: '*'
          destinationAddressPrefix: '*'
          access: 'Deny' // Toggle with 'Allow'
          priority: 100
          direction: 'Inbound'
        }
      }
    ]
  }
}

Let’s see how it looks in practice. I’ll repeat the same example as in the previous post but with the new property.

New-AzResourceGroupDeployment: C:\GitHub\JanneMattila\bicep-demos\nsg\deploy.ps1:38:11
Line |
  38 |  $result = New-AzResourceGroupDeployment `
     |            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | 11.00.00 - The deployment 'Local-2024-06-25-10-59-44' failed with error(s). Showing 1 out of 1 error(s). Status Message: Network Security Group Connection Flushing is 
     | not enabled yet for uksouth region. Please set networkSecurityGroup.FlushConnection property to false. (Code: FlushingNetworkSecurityGroupConnectionIsNotEnabled)      
     | CorrelationId: 674b9a1f-7516-44d0-81c2-db7666973e76