Pages on Digi Hunch

Container Platform

Sun, 22 Oct 2023 14:48:54 -0400

Virtualization enables multi-tenancy, and containerization takes it further. Container allows for running many more service processes. Container introduces another layer of orchestration, calling for a platform of its own, which is capable of managing the lifecycle of thousands of containers. This makes it a bit more work, to releasing and operate containerized applications, due to the container platform layer, sitting between the application and the operating systems.

Kubernetes Cluster

Kubernetes has emerged as the de-facto standard of container platform. Building a Kubernetes cluster with a cloud service provider requires configuring a number of disjointed services to work together. A functional and scalable cluster is the foundation of a robust container platform. Make sure the design of Kubernetes cluster is solid.

Kubernetes Storage

Kubernetes was designed around the idea that Pods are ephemeral and so are their attached storage volumes. Now Kubernetes supports persistent storage but there are many nuances to consider before landing on a CSI-based storage solution.

Kubernetes Networking

Containerization favours microservice architecture. Cluster design needs to decides on a CNI to enable Pod-to-pod communication. Further, a container platform needs to address application networking requirement using network policy, service mesh or similar technologies.

Cloud Native Workload

CNCF promotes its own ecosystem for cloud native workload. Teams who move their applications to Kubernetes platform often have to reconsider the associated toolings. These teams need extensive investigation of available cloud native toolings.

More on Container Platform

Host legacy application in Docker 2 of 2 - My previous notes include some tricks in hosting legacy application in docker. This is a continuation from that work, after 1.5 months... Use Case I decided to use docker to host application for a good reason, and let me start with what this Java-based application does as a single process.…
Host legacy application in Docker 1 of 2 - This is my notes from containerizing a legacy application with Docker compose. We have to run multiple instances of our application because we're unable to secure additional VMs for this single-VM education environment. The application is target of containerization, because it requires mass reconfiguration (around TCP port) to run multiple…

Contact Digi Hunch for Professional Services.

Cloud Platform

Sun, 22 Oct 2023 14:48:43 -0400

Cloud is a delivery model of computing services over remote network. This model is enabled by virtualization technology and features a pay-as-you-go pricing plan for computing services. Public cloud providers are equipped with virtually unlimited capacity and are operating a broad suite of managed services. In the design of a cloud platform, we look at the five pillars in the well-architected framework: operational excellence, security, reliability, performance efficiency, and cost optimization. Through these lens, we mainly look at these areas:

Cloud landing zone

A successful cloud platform enables application teams to focus on business requirement. The backbone of a cloud platform is a landing zone, which typically addresses security, networking and compliance requirement of the organization’s IT footprint in the cloud. Both AWS and Azure have guidelines of multiple options to deploy landing zones.

Storage design

Enterprise applications often have specific requirements on IOPS and throughput. Selecting a storage service in a cloud platform, must also consider the high availability, disaster recovery and cost efficiency.

Networking design

Networking design has profound impact on the security posture and must be well thought out. It sets the foundation of high availability and fault tolerance. Also, how traffic flows in and out the system significantly affect the cost.

Infrastructure as code

There have been three categories of infrastructure as code, those based on markup language (ARM, CloudFormation), those based on general-purpose programming language (Pulumi, AWS CDK), and those based on Domain Specific Language (Terraform, Bicep). They have different levels of flexibility and different skill requirement.

More on cloud platform

IAM Roles for any workload - Background A few month back a client of mine wanted to use GitLab pipeline to deploy infrastructure on AWS with Terraform. The key question is how to authenticate the Terraform process running in the pipeline to AWS with temporary credential. Having worked it out on GitHub, my proposal at time…
AWS Systems Manager is an Omnipotent Hodgepodge - Introduction to Systems Manager AWS Systems Manager addresses a lot of SysOps requirements for configuration management, including server automation. In this domain, there is another AWS service called OpsWorks. However, with OpsWorks Stack, OpsWorks Chef and OpsWorks Puppet all coming EOL in 2024, the entire OpsWorks service is mostly deprecated.…
Istio External Authorization via OIDC - Istio service mesh allows application developers to offload non-core features to infrastructure layer. We explored authentication and authorization with Istio in a basic lab. In this post we continue to explore its capabilities with OIDC integration. This capability is made available thanks to the CUSTOM action in authorization policy, supported…
AKS Lessons Learned 2 of 2 - Even though Azure Kubernetes Service (AKS) is a managed service, building a cluster is not trivial. For help resources, I would start with the webinar "Configure Your AKS cluster with Confidence" from April 2021, which focuses on a set of working best practices (convention over configuration) but obviously not every…
AKS Lessons Learned 1 of 2 - In general, troubleshooting Kubernetes is tricky. That is because one has to get in and out of pods. I took two days to troubleshoot some networking issues with private AKS cluster. For the amount of of tricks I had to employ, I need to take some notes. The issue After…

Contact Digi Hunch for Professional Services.

Services

Sun, 22 Oct 2023 14:48:23 -0400

Hunch Digital Services delivers professional IT services in platform engineering, which focuses on non-feature requirements, typically summarized as the five pillars including security, reliability, performance efficiency, operational excellence and cost optimization. Specifically, we specialize in areas such as cloud platform, container platform, automation and security.

Our service categories include:

Solution Design

Create a design or blueprint that meets your specific business requirement. The purpose is to ensure that the chosen solution aligns with your organization’s goals, objectives, and constraints, and that it is cost-effective, efficient, and sustainable.

Architecture Review

Evaluate a proposed solution design against a set of architectural principles, standards, and best practices to ensure that the system meets its requirements and is scalable, maintainable, and secure. The purpose of architecture review is to ensure that the system design aligns with the organization’s overall business strategy and objectives, and that it can be easily modified or extended to meet changing needs.

System Design Review

Evaluates the current status of an implemented solution. We examine various aspects of the current system, such as technical infrastructure, logs, operation overheads, and interviews with focused groups to gather feedbacks from system users and other stakeholders. We also make recommendations based on architectural principals and best practices.

Proof of Concept

Evaluate the design by produce a prototype in order to understand the functionality, performance or interoperability. PoC activity helps stakeholders make informed decision about whether to proceed with the full implementation of the solution or not.

Implementation

Put recommendations and solution designs into action to ensure that the deployed technology aligns with the design and meets the specific needs of the client.

Workshop and Demo

A series of meetings to immerse the targeted group in a specific technical topic. Workshops familiarize the audiences with the technical topic through presentations, walk-throughs and labs. In addition to training, workshops also help generate insights and ideas, identify potential solutions or approaches, and develop a shared understanding of the complex problem at hand.

Projects

Sun, 05 Dec 2021 22:53:05 -0400

Digi Hunch contributes to open source community focusing on application deployment. Check out my GitHub page. Here are some recent projects:

Orthweb

Orthweb is a cloud-based mini-PACS solution based on Orthanc and AWS. Orthanc is an open-source medical imaging application. Orthweb automates the infrastructure provisioning and configuration management. With the Orthweb artifact, users bring up a fully functional, scalable and secure mini-PACS in 30 minutes.

Korthweb

Korthweb is an initiative to run Orthweb on Kubernetes platform. Korthweb brings up Orthanc service using a number of different approaches, making Orthanc a single-command deployment on existing Kubernetes platform.

Cloud Kube

CloudKube is Infrastructure as Code project for provisioning production grade Kubernetes clusters in common Cloud platforms (Azure and AWS).

Kubelab (Archived)

Kubelab is an Infrastructure as Code project (in AWS CDK v1, now archived) to deploy a Kubernetes cluster with self-managed nodes. It is also a demonstration of using CDK in Python. Kubelab brings up a number of EC2 instances and automatically configures them as a Kubernetes cluster.

ATlab (Archived)

ATLab (Ansible Tower Lab) is an infrastructure-as-code project (in AWS CDK v1, now archived) to deploy an AWX (open-source alternative of Ansible Tower). It is also a demonstration of using CDK in TypeScript. AT Lab brings up an AWX server and automatically configures it.

Security

Sun, 05 Dec 2021 22:33:26 -0400

Security is one of the most important aspects in cloud architecture design and implementation. Security concerns data privacy, an important aspect of platform compliance.

With regard to security, we perform security review with threat model assessment on the infrastructure stack, mostly looking at the following aspects:

Identity and Access Management

Authentication (Identity Management) and Authorization (Access Management) is a foundational design aspects. We need to consider issues such as identity store, integration, SSO, attributes at all layers such as application (business traffic), container platform (e.g. Kubernetes admin traffic), and cloud platform (e.g. cloud admin traffic).

Encryption and Certificate Management

All security standards mandates the encryption of data in transit and at rest. Data in transit are encrypted by standards at different network layers. Transport Layer Security (TLS) is the most important standard in this regard and it operates on X.509 certificates, which is managed by the Public Key Infrastructure (PKI) of the organization.

Compliance

Most of the enterprise cloud deployment should target certain compliance programs as part of the security initiative. Common compliance frameworks and programs include:

DoD SRG (Department of Defense Cloud Computing Security Requirements Guide)
FedRAMP (Federal Risk and Authorization Management Program)
HIPPA (Health Insurance Portability and Accountability Act)
GDPR (General Data Protection Regulation)
PCI-DSS (Payment Card Industry Data Security Standard)
CIS (Center for Internet Security) Benchmarks

The main cloud service providers provides tools to help client assess the compliance status of their cloud deployment.

More on security

IAM Roles for any workload - Background A few month back a client of mine wanted to use GitLab pipeline to deploy infrastructure on AWS with Terraform. The key question is how to authenticate the Terraform process running in the pipeline to AWS with temporary credential. Having worked it out on GitHub, my proposal at time…
Managing EC2 instances across accounts with Ansible - I regard AWS Systems Manager as omnipotent. Nonetheless, there are a few reasons that makes Ansible still a prevalent VM (EC2) management tool over Systems Manager (SSM). First, organizations already vested in their custom Ansible roles and playbooks want to reuse, and expand their assets in Ansible. The benefit is…
WordPress Security Basics - Background In 2019, I moved this site to WordPress hosted on an Amazon Lightsail instance. There were few visits at that time so I lived with the single-server architecture. The website traffic has since been in steady growth but I have been too busy to catch up with the WordPress…
EKS impression - I've worked on a few AKS projects previously. Since I joined AWS I wanted to put aside some time to check out EKS (Elastic Kubernetes Service). Here in this post, I put down my first impression on EKS, and also share my Terraform template in cloudkube project to create an…
Istio Operation Gotchas - In this post I discuss a few aspects when putting istio in operation. Installation Istio installation can be confusing, due to architectural and guideline changes as well as renaming of operator CRDs since its release, and especially since 2020. This left lots of information outdated on the web, adding to…

Contact Digi Hunch for Professional Services.

Contact

Sun, 05 Dec 2021 22:19:07 -0400

Professional IT Service

Hunch Digital Services Inc (Digi Hunch) delivers professional IT services. We have more than a decade’s experience in different aspects of enterprise IT, including application development, customer support, infrastructure, solution architecture and implementation.

Review the service categories and contact for a free estimate.

Contact

The best way to contact Hunch Digital Services for professional service is by email, or via LinkedIn message.

Certifications

Automation

Sun, 05 Dec 2021 22:11:18 -0400

In the 60s, automobiles manufactured in Japan consistently beats their competitors in American market. Many refers to the lean manufacturing methodology in the automation as the secret sauce. The software industries borrowed a lot of similar methodologies from TPS (Toyota Production System) into software development industry, which brought about agile software development.

For software to deliver value, it is not just about developing software in agile methodologies. A full SDLC (software development life cycle) includes build, release and upgrades too, some of which are managed in a different department in the organization. DevOps extends agile methodology across departments. DevOps has now become a buzzword. Some even refers to it as a culture but none of these are possible without automation.

Automation Pipelines

The power horse of the DevOps tooling is automation pipeline (e.g. Jenkins, Azure DevOps, GitHub). These pipelines expedites iterations with frequent feedback about software quality, whether it is common conventional SDLC workflow or more recent infrastructure as code worklfow. For SDLC, the goal is to establish continuous integration (CI) and ultimately continuous deployment (CD).

Serverless Deployment

With serverless deployment, the operation of managing computing resources is abstracted away. Serverless deployment models further simplifies SDLCs and are ideal for some common use cases such as API services, IoT, scheduled and event-driven tasks.

DataOps

Another creative use of automation pipelines is the data pipelines. Data engineering tasks includes ingestion, ETL, integration, and storage and automation pipelines are ideal automation tools for these tasks.

Observability

Observability setup enables instant feedback, an important construct of DevOps. An observability stack consists of metrics collection, log shipping, performance monitoring, request tracing and visualization etc.

More on automation

The Leanest Web and Email Hosting - This site has been quiet for a while. During this time, I migrated the hosting platform again, and refactored email solution. This post, is another note about how I finally came to the most cost-effective web and email solution for a small business, with a solid security posture, and at…
Debating between count and for_each in Terraform - In Terraform, we often have to create an array of resources of the same type but similar attribute values. For code reusability, manageability and for DRY principle, it's better to use loop. Terraform HCL supports loop via the use of meta-argument. Currently, there are two options to drive a loop:…
Test Open ID Connect Flows Locally - Earlier this year, I had to integrate an application with an identity provider. Both claim to be compliant with Open ID Connect. But when they don't get along, I must find out where it breaks to determine which party isn't compliant. Therefore, I had to really get to the transaction-level…
IAM Roles for any workload - Background A few month back a client of mine wanted to use GitLab pipeline to deploy infrastructure on AWS with Terraform. The key question is how to authenticate the Terraform process running in the pipeline to AWS with temporary credential. Having worked it out on GitHub, my proposal at time…
Managing EC2 instances across accounts with Ansible - I regard AWS Systems Manager as omnipotent. Nonetheless, there are a few reasons that makes Ansible still a prevalent VM (EC2) management tool over Systems Manager (SSM). First, organizations already vested in their custom Ansible roles and playbooks want to reuse, and expand their assets in Ansible. The benefit is…

Contact Digi Hunch for Professional Services.

About

Sat, 13 Nov 2010 03:29:50 +0000

On the Journey of an IT Architect, we share the expertise by:

Blogs on this website and medium;
Open source projects on GitHub;
Professional IT consulting service

History of this website:

May 2019: Moved to self-hosted WordPress
May 2020: Moved to current domain name
Dec 2022: Migration for PHP 8 upgrade
Jul 2023: Security Enhancements
Apr 2025: Performance Enhancement

Privacy

Thank you for choosing Hunch Digital Services (Digi Hunch). At Hunch Digital Services, we value your privacy and are committed to protecting your personal information. We collect the following information:

Personal Information: We may collect personal information such as your name, email address, phone number, and other contact details when you create an account or contact us.
Log Data: When you use our services, we may collect information that your browser or device sends to us, including your IP address, browser type, and the pages you visit.
Cookies: We may use cookies and similar tracking technologies to enhance your experience on our website. You can manage cookie preferences through your browser settings.

We take reasonable measures to protect your information from unauthorized access, disclosure, alteration, or destruction. However, no method of data transmission over the internet or electronic storage is completely secure, and we cannot guarantee its absolute security.

You have the right to access, correct, or delete your personal information, subject to legal requirements. You may also unsubscribe from our promotional communications at any time. To exercise these rights or for any other privacy-related inquiries, please contact us at privacy@digihunch.com