AKS

April 5, 2023

Note: all commands in this guide were tested from Windows PowerShell.

Prerequisite

Install the Azure CLI (azure-cli).
Run az login, copy the code, open it in your local browser, and paste the code.
Install the Azure AKS CLI.

# Install Azure AKS CLI
az aks install-cli

Create the AKS cluster, node pool, and VNet manually.
Configure the cluster credentials and kubeconfig.

# Configure Cluster Creds (kube configuration)
az aks get-credentials --resource-group petlover-AKS --name Petlover-Prod

Optional: create a PowerShell alias so kubectl can be called with a shorter command such as k.

[Set Alias for Kubectl](https://www.techtarget.com/searchitoperations/tutorial/Manage-Kubernetes-clusters-with-PowerShell-and-kubectl#:~:text=Kubectl aliasing in PowerShell&text=Aliasing in PowerShell is the,name to reference a command.&text=After setting up this alias,make a call to Kubernetes).

Ingress Nginx Load Balancer Controller

Create a static IP address.

# Get the resource group name of the AKS cluster (resource name -> aks name)
az aks show --resource-group petlover-AKS --name Petlover-Prod --query nodeResourceGroup -o tsv

# record resource group name: MC_petlover-AKS_Petlover-Prod_eastus

# TEMPLATE - Create a public IP address with the static allocation
az network public-ip create --resource-group MC_petlover-AKS_Petlover-Prod_eastus \
                            --name myAKSPublicIPForIngress \
                            --sku Standard \
                            --allocation-method static \
                            --query publicIp.ipAddress \
                            -o tsv

# record public IP address

Install Helm in PowerShell. Helm also needs to be installed on the Jenkins server.

Run PowerShell as administrator, then run choco install kubernetes-helm.

Add the official stable repository.

# Create a namespace for your ingress resources
kubectl create namespace ingress-basic

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

#  Customizing the Chart Before Installing.
helm show values ingress-nginx/ingress-nginx

# Use Helm to deploy an NGINX ingress controller
helm install ingress-nginx ingress-nginx/ingress-nginx \
    --namespace ingress-basic \
    --set controller.replicaCount=2 \
    --set controller.nodeSelector."kubernetes\.io/os"=linux \
    --set defaultBackend.nodeSelector."kubernetes\.io/os"=linux \
    --set controller.service.externalTrafficPolicy=Local \
    --set controller.service.loadBalancerIP="20.124.104.64"

External DNS - By Managed Service Identity (MSI)

Get the tenant ID and subscription ID.

# To get Azure Tenant ID
az account show --query "tenantId"# To get Azure Subscription ID
az account show --query "id"

Create MSI - Managed Service Identity for External DNS to access Azure DNS Zones

Record the user-assigned identity ID.

Create the JSON file.

{
  "tenantId": "b985d900-a4c4-4ea6-9e09-8d1167bac273",
  "subscriptionId": "c4c2e681-0156-457e-b1f2-88020d2efe5c",
  "resourceGroup": "petlover-AKS",
  "useManagedIdentityExtension": true,
  "userAssignedIdentityID": "cc69d3df-0680-4e72-9a58-33bc57b09587"
}

Associate the MSI with the AKS cluster VMSS.

Create the Kubernetes secret and deploy ExternalDNS.

'kubectl create secret generic azure-config-file --from-file=azure.json'

Apply external-dns.yaml.

Ingress - SSL

Label the ingress-basic namespace to disable resource validation

kubectl label namespace ingress-basic [cert-manager.io/disable-validation=true](http://cert-manager.io/disable-validation=true)

Add the Jetstack Helm repository

helm repo add jetstack [https://charts.jetstack.io](https://charts.jetstack.io/)

Update your local Helm chart repository cache

helm repo update

Install the cert-manager Helm chart

helm install \
cert-manager jetstack/cert-manager \
--namespace ingress-basic \
--version v1.8.2 \
--set installCRDs=true

helm install cert-manager jetstack/cert-manager --namespace ingress-basic --version v1.8.2 --set installCRDs=true

ACR Connection - By Service Principal

Create the ACR.
Go to access keys and enable the admin user.
Use this username and password to log in to ACR and push images

# Export Command
export ACR_REGISTRY=acrdemo2ss.azurecr.io
export ACR_NAMESPACE=app2
export ACR_IMAGE_NAME=acr-app2
export ACR_IMAGE_TAG=v1
echo $ACR_REGISTRY, $ACR_NAMESPACE, $ACR_IMAGE_NAME, $ACR_IMAGE_TAG

# Login to ACR
docker login $ACR_REGISTRY

# Tag
docker tag acr-app2:v1  $ACR_REGISTRY/$ACR_NAMESPACE/$ACR_IMAGE_NAME:$ACR_IMAGE_TAG
It replaces as below
docker tag acr-app2:v1 acrdemo2ss.azurecr.io/app2/acr-app2:v1

# List Docker Images to verify
docker images acr-app2:v1
docker images $ACR_REGISTRY/$ACR_NAMESPACE/$ACR_IMAGE_NAME:$ACR_IMAGE_TAG

# Push Docker Images
docker push $ACR_REGISTRY/$ACR_NAMESPACE/$ACR_IMAGE_NAME:$ACR_IMAGE_TAG

docker tag petlover-back:latest petloverprod[.azurecr.io/back/petlover-back:](http://demopublicpetlover.azurecr.io/app1/demo:v1)latest
docker push petloverprod.azurecr.io/back/petlover-back:latest

Create a service principal.

#!/bin/bash
# This script requires Azure CLI version 2.25.0 or later. Check version with `az --version`.

# Modify for your environment.
# ACR_NAME: The name of your Azure Container Registry
# SERVICE_PRINCIPAL_NAME: Must be unique within your AD tenant
ACR_NAME=acrdemo2ss
SERVICE_PRINCIPAL_NAME=acr-sp-demo

# Obtain the full registry ID for subsequent command args
ACR_REGISTRY_ID=$(az acr show --name $ACR_NAME --query id --output tsv)# Create the service principal with rights scoped to the registry.
# Default permissions are for Docker pull access. Modify the '--role'
# argument value as desired:
# acrpull:     pull only
# acrpush:     push and pull
# owner:       push, pull, and assign roles
SP_PASSWD=$(az ad sp create-for-rbac --name $SERVICE_PRINCIPAL_NAME --scopes $ACR_REGISTRY_ID --role acrpull --query password --output tsv)
SP_APP_ID=$(az ad sp list --display-name $SERVICE_PRINCIPAL_NAME --query [].appId --output tsv)# Output the service principal's credentials; use these in your services and
# applications to authenticate to the container registry.
echo "Service principal ID: $SP_APP_ID"echo "Service principal password: $SP_PASSWD"

$ACR_NAME='petloverprod'
$SERVICE_PRINCIPAL_NAME='acr-petlover-demo'
$ACR_REGISTRY_ID=$(az acr show --name $ACR_NAME --query id --output tsv)

$SP_PASSWD=$(az ad sp create-for-rbac --name http://$SERVICE_PRINCIPAL_NAME --scopes $ACR_REGISTRY_ID --role acrpull --query password --output tsv)

$SP_APP_ID=$(az ad app list --display-name http://$SERVICE_PRINCIPAL_NAME --query [].appId --output tsv)

# Note (explanation, no action needed):
az ad sp create-for-rbac --name <service_principal_name> --role Contributor --scopes /subscriptions/<subscription_id>
# Equivalent to:
az ad sp create-for-rbac --name myAKSClusterServicePrincipal
az aks create \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --service-principal <appId> \
    --client-secret <password>
az role assignment create --assignee <appId> --scope <resourceScope> --role Contributor

# Steps:
# 1. Create a principal identity
# 2. Create a resource group and assign the principal identity (normally done via Terraform)
# 3. Assign a role to the resource group by scope

create image pull secret

kubectl create secret docker-registry <named_secret> \
    --namespace default \
    --docker-server=acrdemo.azurecr.io \
    --docker-username=<$SP_APP_ID> \
    --docker-password=<$SP_PASSWD>

kubectl create secret docker-registry my-secret --namespace default --docker-server=$ACR_NAME[.azurecr.io](http://demopublicpetlover.azurecr.io/) --docker-username=$SP_APP_ID --docker-password=$SP_PASSWD

Note: kubectl delete secret my-secret deletes the created secret.

SSH Connection to Remote Server

Establishing a connection:
1. Send your public key to the target node
2. Exchange public keys and confirm mutual trust
3. You can then log in

;