Skip to content

Instantly share code, notes, and snippets.

@rezamt
rezamt / 01-Vault-crossplane.yaml
Created October 6, 2025 02:14
Vault Crossplane Provider Configuration
# Attention: Vault version > 2 requires corssplane v2
---
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
name: upbound-provider-vault
namespace: crossplane-system
spec:
package: xpkg.upbound.io/upbound/provider-vault:v2
@rezamt
rezamt / README.md
Last active August 26, 2025 12:17
Bamboo Remote Agent
@rezamt
rezamt / 00_crossplane-provider-config-kubernetes.yaml
Last active September 2, 2025 04:19
Corssplane Upbound
# Check ./provider-in-cluster.yaml to see how to grant permissions to the Provider
apiVersion: kubernetes.crossplane.io/v1alpha1
kind: ProviderConfig
metadata:
name: up-provider-kubernetes-config
spec:
credentials:
source: InjectedIdentity
---
applyTo: "**/{prod*,stg*,dev*}.yaml"
---
# Command: Check Prmissions
Check the Current File's Entra ID Permissions and compae them with `Reference Permissions Table` below in this file.
# Permissions Report
$username = "DOMAIN\ServiceAccount"
$password = "YourPassword"
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($username, $securePassword)
# Now use the credential
Start-Process powershell.exe -Credential $credential -ArgumentList "-File C:\path\to\script.ps1"
@rezamt
rezamt / Federated sign-in risk scenarios.md
Last active June 26, 2025 01:57
Microsoft Entra Workbook

Federated sign-in risk scenarios

1. Sign-in risk redirected to external identity
SigninLogs
| where RiskLevelDuringSignIn in ("high", "medium") and ResultType == 50074
| where RiskState !in ("dismissed", "remediated")
| where AuthenticationRequirementPolicies has "riskBasedPolicy"
| where Status has "Redirected to external provider for MFA"
| distinct UserPrincipalName=tolower(UserPrincipalName)
@rezamt
rezamt / signin-analysis.kql
Created June 23, 2025 01:43
EntraID Workbook
let data = SigninLogs
| where AppDisplayName in ('*') or '*' in ('*')
| where UserDisplayName in ('*') or '*' in ('*')
| extend errorCode = Status.errorCode
| extend SigninStatus = case(errorCode == 0, "Success", errorCode == 50058, "Pending action (Interrupts)", errorCode == 50140, "Pending action (Interrupts)", errorCode == 51006, "Pending action (Interrupts)", errorCode == 50059, "Pending action (Interrupts)", errorCode == 65001, "Pending action (Interrupts)", errorCode == 52004, "Pending action (Interrupts)", errorCode == 50055, "Pending action (Interrupts)", errorCode == 50144, "Pending action (Interrupts)", errorCode == 50072, "Pending action (Interrupts)", errorCode == 50074, "Pending action (Interrupts)", errorCode == 16000, "Pending action (Interrupts)", errorCode == 16001, "Pending action (Interrupts)", errorCode == 16003, "Pending action (Interrupts)", errorCode == 50127, "Pending action (Interrupts)", errorCode == 50125, "Pending action (Interrupts)", errorCode == 50129, "Pending a