Azure Kubernetes Service (AKS)

Microsoft Azure Kubernetes Service (AKS)

You can create a Kubernetes cluster either through the Azure portal website, or using the Azure command line tools.

This page describes the commands required to setup a Kubernetes cluster using the command line. If you prefer to use the Azure portal see the Azure Kubernetes Service quickstart.

  1. Prepare your Azure shell environment. You have two options, one is to use the Azure interactive shell, the other is to install the Azure command-line tools locally. Instructions for each are below.

    • Using the Azure interactive shell. The Azure Portal contains an interactive shell that you can use to communicate with your Kubernetes cluster. To access this shell, go to portal.azure.com and click on the button below.

      ../../_images/cli_start.png

    Note

    • If you get errors like could not retrieve token from local cache, try refreshing your browser window.

    • The first time you do this, you’ll be asked to create a storage account where your shell filesystem will live.

    • Install command-line tools locally. You can access the Azure CLI via a package that you can install locally.

      To do so, first follow the installation instructions in the Azure documentation. Then run the following command to connect your local CLI with your account:

      az login
      Copy to clipboard

      You’ll need to open a browser and follow the instructions in your terminal to log in.

  2. Activate the correct subscription. Azure uses the concept of subscriptions to manage spending. You can get a list of subscriptions your account has access to by running:

    az account list --refresh --output table
    Copy to clipboard

    Pick the subscription you want to use for creating the cluster, and set that as your default. If you only have one subscription you can ignore this step.

    az account set --subscription <YOUR-CHOSEN-SUBSCRIPTION-ID>
    Copy to clipboard

  3. Create a resource group. Azure uses the concept of resource groups to group related resources together. We need to create a resource group in a given data center location. We will create computational resources within this resource group.

    az group create --location westus --resource-group <my-Resource-Group>
    Copy to clipboard

  4. Choose a cluster name.

    In the following steps we’ll run commands that ask you to input a cluster name. We recommend using something descriptive and short. We’ll refer to this as <CLUSTER-NAME> for the remainder of this section.

    The next step will create a few files on your filesystem, so first create a folder in which these files will go. We recommend giving it the same name as your cluster:

    mkdir <CLUSTER-NAME>
cd <CLUSTER-NAME>
    Copy to clipboard

  5. Create an ssh key to secure your cluster.

    ssh-keygen -f ssh-key-<CLUSTER-NAME>
    Copy to clipboard

    It will prompt you to add a password, which you can leave empty if you wish. This will create a public key named ssh-key-<CLUSTER-NAME>.pub and a private key named ssh-key-<CLUSTER-NAME>. Make sure both go into the folder we created earlier, and keep both of them safe!

    This command will also print out something to your terminal screen. You don’t need to do anything with this text.

  6. Create a virtual network and sub-network.

    Kubernetes does not by default come with a controller that enforces networkpolicy resources. networkpolicy resources are important as they define how Kubernetes pods can securely communicate with one another and the outside sources, for example, the internet.

    To enable this in Azure, we must first create a Virtual Network with Azure’s own network policies enabled.

    This section of the documentation is following the Microsoft Azure tutorial on creating an AKS cluster and enabling network policy, which includes information on using Calico network policies.

    az network vnet create \
   --resource-group <RESOURCE-GROUP-NAME> \
   --name <VNET-NAME> \
   --address-prefixes 10.0.0.0/8 \
   --subnet-name <SUBNET-NAME> \
   --subnet-prefix 10.240.0.0/16
    Copy to clipboard

    where:

    • --resource-group is the ResourceGroup you created

    • --name is the name you want to assign to your virtual network, for example, hub-vnet

    • --address-prefixes are the IP address prefixes for your virtual network

    • --subnet-name is your desired name for your subnet, for example, hub-subnet

    • --subnet-prefixes are the IP address prefixes in CIDR format for the subnet

    We will now retrieve the application IDs of the VNet and subnet we just created and save them to bash variables.

    VNET_ID=$(az network vnet show \
   --resource-group <RESOURCE-GROUP-NAME> \
   --name <VNET-NAME> \
   --query id \
   --output tsv)
SUBNET_ID=$(az network vnet subnet show \
   --resource-group <RESOURCE-GROUP-NAME> \
   --vnet-name <VNET-NAME> \
   --name <SUBNET-NAME> \
   --query id \
   --output tsv)
    Copy to clipboard

    We will create an Azure Active Directory (Azure AD) service principal for use with the cluster, and assign the Contributor role for use with the VNet. Make sure SERVICE-PRINCIPAL-NAME is something recognisable, for example, binderhub-sp.

    SP_PASSWD=$(az ad sp create-for-rbac \
   --name <SERVICE-PRINCIPAL-NAME> \
   --role Contributor \
   --scopes $VNET_ID \
   --query password \
   --output tsv)
SP_ID=$(az ad sp show \
   --id http://<SERVICE-PRINCIPAL-NAME> \
   --query appId \
   --output tsv)
    Copy to clipboard

    You will need Owner role on your subscription for this step to succeed.

  7. Create an AKS cluster.

    At this stage, you may wish to think about customising your deployment. This article helps you to deploying a Kubernetes cluster to Azure with autoscaling and multiple nodepools. These instructions can be combined so that all nodepools can autoscale.

    The following command will request a Kubernetes cluster within the resource group that we created earlier.

    az aks create \
   --name <CLUSTER-NAME> \
   --resource-group <RESOURCE-GROUP-NAME> \
   --ssh-key-value ssh-key-<CLUSTER-NAME>.pub \
   --node-count 2 \
   --node-vm-size Standard_D2s_v3 \
   --service-principal $SP_ID \
   --client-secret $SP_PASSWD \
   --dns-service-ip 10.0.0.10 \
   --docker-bridge-address 172.17.0.1/16 \
   --network-plugin azure \
   --network-policy azure \
   --service-cidr 10.0.0.0/16 \
   --vnet-subnet-id $SUBNET_ID \
   --output table
    Copy to clipboard

    Note: Only 2 Node count is for Azure free teir

    where:

    • --name is the name you want to use to refer to your cluster

    • --resource-group is the ResourceGroup you created

    • --ssh-key-value is the ssh public key created

    • --node-count is the number of nodes you want in your Kubernetes cluster

    • --node-vm-size is the size of the nodes you want to use, which varies based on what you are using your cluster for and how much RAM/CPU each of your users need. There is a list of all possible node sizes for you to choose from, but not all might be available in your location. If you get an error whilst creating the cluster you can try changing either the region or the node size.

    • --service-principal is the application ID of the service principal we created

    • --client-secret is the password for the service principal we created

    • --dns-service-ip is an IP address assigned to the Kubernetes DNS service

    • --docker-bridge-address is a specific IP address and netmask for the Docker bridge, using standard CIDR notation

    • --network-plugin is the Kubernetes network plugin to use. In this example, we have used Azure’s own implementation.

    • --network-policy is the Kubernetes network policy to use. In this example, we have used Azure’s own implementation.

    • --service-cidr is a CIDR notation IP range from which to assign service cluster IPs

    • vnet-subnet-id is the application ID of the subnet we created

    • This command will install the default version of Kubernetes. You can pass --kubernetes-version to install a different version.

    This should take a few minutes and provide you with a working Kubernetes cluster!

  8. If you’re using the Azure CLI locally, install kubectl, a tool for accessing the Kubernetes API from the commandline:

    az aks install-cli
    Copy to clipboard

    Note: kubectl is already installed in Azure Cloud Shell.

  9. Get credentials from Azure for kubectl to work:

    az aks get-credentials \
   --name <CLUSTER-NAME> \
   --resource-group <RESOURCE-GROUP-NAME> \
   --output table
    Copy to clipboard

    where:

    • --name is the name you gave your cluster

    • --resource-group is the ResourceGroup you created

    This automatically updates your Kubernetes client configuration file.

  10. Check if your cluster is fully functional

    kubectl get node
    Copy to clipboard

    The response should list three running nodes and their Kubernetes versions! Each node should have the status of Ready, note that this may take a few moments.

Note

If you create the cluster using the Azure Portal you must enable RBAC. RBAC is enabled by default when using the command line tools.


Congrats. Now that you have your Kubernetes cluster running.....!!!!!!!!!!!!!!!!!!!!!!!!!

Comments

Post a Comment

Popular posts from this blog

Create a Public Load balancer

Image
Sign in to Azure Sign in to the Azure portal at   https://portal.azure.com . Create the virtual network: In this section, you'll create a virtual network and subnet. In the search box at the top of the portal, enter  Virtual network . Select  Virtual Networks  in the search results. In  Virtual networks , select  + Create . In  Create virtual network , enter or select this information in the  Basics  tab: TABLE 1 Setting Value Project Details Subscription Select your Azure subscription Resource Group Select  Create new . In  Name  enter  CreatePubLBQS-rg . Select  OK . Instance details Name Enter  myVNet Region Select  (Europe) West Europe Select the  IP Addresses  tab or select the  Next: IP Addresses  button at the bottom of the page. In the  IP Addresses  tab, enter this information: TABLE 2 Setting Value IPv4 address space Enter  10.1.0.0/16 Under  Subnet name , se...
Read more

Generate a self-signed root certificate

Image
Create a self-signed root certificate: Use the New-SelfSignedCertificate cmdlet to create a self-signed root certificate. For additional parameter information, see New-SelfSignedCertificate. From a computer running Windows 10 or Windows Server 2016, open a Windows PowerShell console with admin privileges.  Use the following example to create the self-signed root certificate.  PowerShell Copy $cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature ` -Subject "CN=P2SRootCert" -KeyExportPolicy Exportable ` -HashAlgorithm sha256 -KeyLength 2048 ` -CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign Leave the PowerShell console open if you want to create a client certificate right after creating this root certificate. Generate a client certificate Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certi...
Read more

Configure Point-to-Site Connection

Image
 Configure Point-to-Site Connection Next step of this configuration is to configure the point-to-site connection. In here we will define client ip address pool as well. It is for VPN clients.   Click on newly created VPN gateway connection. Then in new window click on  Point-to-site configuration   After that, click on  Configure Now   In new window type IP address range for VPN address pool. In this demo I will be using  172.16.25.0/24 . For tunnel type use both  SSTP & IKEv2 . Linux and other mobile clients by default use  IKEv2  to connect. Windows also use  IKEv2  first and then try  SSTP . For authentication type use  Azure Certificates .     In same window there is place to define root certificate. Under root certificate name type the cert name and under public certificate data, paste the root certificate data ( you can open cert in notepad to get data).   Then click on  Save  to com...
Read more