Projects on GeekyRyan

DnsPinger: A Small .NET Tool for Diagnosing DNS Issues in Kubernetes

Mon, 17 Aug 2026 09:00:00 +0000

DNS problems in Kubernetes are some of the most frustrating issues to chase down. They’re often intermittent, they can differ by node, by node pool, by which resolver actually answered the query, and the standard toolbox (nslookup/dig run once by hand) doesn’t tell you much about a problem that only shows up 1% of the time or only on certain nodes. I got tired of manually reproducing DNS flakiness during incidents, so I wrote DnsPinger — a small, purpose-built .NET console application that continuously exercises DNS resolution from inside the cluster and reports what it finds.

Migrating AKS Workloads to Azure Workload Identity

Tue, 13 Jun 2023 09:00:00 +0000

For a long time, the standard way for a pod in AKS to authenticate to Azure resources (Key Vault, databases, service bus, etc.) was some flavor of managed identity binding via a sidecar (AAD Pod Identity), or worse, credentials baked into a secret. Azure Workload Identity is the modern replacement: it federates a Kubernetes service account with an Azure AD identity using OIDC, with no secrets to manage or rotate.

Locking Down AKS Access with Azure RBAC and Privileged Identity Management

Mon, 01 May 2023 09:00:00 +0000

Kubernetes’ built-in RBAC is powerful, but managing it purely inside the cluster (via kubeconfigs and static role bindings) doesn’t integrate well with how most organizations manage identity and access at the directory level. Azure RBAC integration for AKS lets you manage cluster access using Azure AD groups and role assignments, which is a much better fit for how access reviews and least-privilege policies actually get enforced.

This project deployed Azure RBAC to our AKS clusters so that cluster access is controlled the same way as the rest of our Azure resources, and paired it with Privileged Identity Management (PIM) so that elevated cluster permissions are just-in-time and time-bound rather than standing access.

Diagnosing and Safely Re-enabling AKS Automatic Node Image Updates

Tue, 21 Mar 2023 09:00:00 +0000

AKS has a feature that automatically applies the latest node image to your node pools on a schedule. It’s a great way to stay current on OS-level patches without manual intervention - until it causes a service degradation in prod.

After an automatic node image rollout caused instability in one of our environments, we disabled the feature while we investigated with Microsoft support. No definitive root cause was found, but the support engagement did produce some useful recommendations around additional node-level logging to capture if the issue recurred.

Rolling Out New AKS Clusters to Retire Duplicate Infrastructure

Tue, 21 Mar 2023 09:00:00 +0000

Over time, infrastructure accumulates cruft - clusters stood up for a specific purpose that never got cleaned up, duplicate environments left over from a migration, that sort of thing. This project stood up a new generation of AKS clusters specifically so we could decommission an older, duplicate set of infrastructure that was quietly costing money every month.

The approach was straightforward: build the new clusters alongside the old ones, migrate workloads over, validate, and then tear down the legacy infrastructure. Running both environments in parallel for a short overlap period had a real (if temporary) cost - a few thousand dollars over a couple of months - but it bought us a safe cutover with a rollback path, which was worth it compared to the ongoing cost of carrying duplicate infrastructure indefinitely.

Upgrading AKS Clusters to a Supported Kubernetes Version

Wed, 23 Feb 2022 09:00:00 +0000

One of the recurring themes of running Kubernetes in production is that clusters age out of support fairly quickly. Azure Kubernetes Service (AKS), at the time of this writing, only supports a rolling window of Kubernetes minor versions, so falling behind means losing patch support and eventually being forced into an emergency upgrade.

This project was a routine but important control-plane and node-pool upgrade across our AKS clusters to bring them onto a supported Kubernetes version (1.21.x at the time). The work itself followed a pattern we’ve refined over several of these upgrades: