Ex Support Engineer - Azure Kubernetes Service (AKS)
Me: What are you laughing at? It exists.
Class monitor: Exist? You just made it up.
(The teacher said nothing and asked me to sit down.)
---
This is unfair. The teacher, who is supposed to have the knowledge, does not do anything.
Has this changed today?
In the middle of the night, I woke up. I recalled something that happened when I was in middle school. #Education
(Context: The Present Perfect Continuous Tense is not taught in middle school.)
(Example: I have been waiting for the bus for a long time.)
Teacher: Hi, mates, what kind of tenses do you know?
Classmate A: Present Continuous.
Classmate B: Past Tense.
Me: Present Perfect Continuous Tense.
(Silence, then everyone laughs.)
(The teacher also remains silent.)
Half a year, and the PR is being closed due to the page is moved.
What a ridiculous end.
Seriously, what my network provider looks like.
It is so easy to spoof.
Not doing for anything for 1 month, and I get some experience of having life.
Finally have time to plan for the future, look back on the past, feel happy or sad, and think about what to do next.
I moved out of my old house, and have a talk with my cat.
I slept in bed all day and also took time to play games.
I re-configured the network for the house, and prepare food for the day and night.
What a life.
Doing the VNet peering, and the result is very great indeed.
When using Azure portal Preview, you cannot set up cross-tenant VNet Link because "preview.portal.azure.com" is not configured as redirect URI.
👉 New post: Access cross-tenant resources via workload identity on Azure Kubernetes Service 🚀
In some cases, you might need to access resources in an external provider's tenant from AKS, as your team and the external team do not work for the same organization. A cross-tenant authentication and authorization process is required.
This is also an article written to solve the problems existing in the practices in the official documentation.
🔗 Link: https://blog.joeyc.dev/posts/aks-access-cross-tenant-wi/
Thanks for blessing from Azure Vietnam AKS (Container) team.
Hope everyone will be "forever young".
I mentioned that I won't say anything in 2 months, but well. Today is special.
Chinese Azure CSS team gets dismissed today, due to EO 14117.
I got my compensation today.
Time to start a new life.
Goodbye, Azure.
For a long time, I have wanted to find a higher paying job.
But now I think it is not a good option unless the new job can also give me the time and resources to learn new things from time to time.
Let me decide later, or wait for something to change.
Thinking of why I am making mistake.
Another misleading document:
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq#can-i-use-a-managed-identity-to-access-a-resource-in-a-different-directorytenant (pic 1)
https://learn.microsoft.com/en-us/answers/questions/1477993/how-to-give-cross-tenant-access-to-azure-user-assi (pic 2)
(...and many)
Sigh.
I failed for two reasons:
1. I was too confident and didn’t check if I did something wrong in the last step.
2. I still trusted the documentation too much.
It is developing on its own and I should relearn it from time to time.
I made a mistake.
So I decided to stay silent for a month, calm down and reflect on myself.
I feel sorry for my mistake.
I never expected this, honestly.
Their outsourcing team cannot even set the DNS record properly. It was disheartening to realize that all my initial complex hypotheses were missing the point when the real issue was this simple but critical network misconfiguration.
We still engage together in a remote session after 3 days.
Then, the root cause is found, unexpectedly: the old Container Registry was working because someone had manually added it to the Windows host file. Meantime, the new Container Registry failed because it had no entry in the host file.
One old story about how it was working under a dysfunctional team.
It all started with a gov project that had been outsourced to a vendor team. When I took over the case, their old Container Registry worked fine, but new one was not functioning on their on-premise devices.
My initial thought was that there might be a problem with the private link or endpoint in the hub VNet. I tried to locate it, but only to hit a dead end as I couldn't find the hub VNet.
