AKS Set up

January 10, 2024

Create a new resource group and set up the cluster details:

Set up node pool

Standard DS2 v2 is a good choice for Node size to use network and services.

Node count in production should be 3 or higher.

Set up Authentication

Using a system managed identity alleviates the burden of renewing the service principal credentials to keep the cluster working.

RBAC should be enabled

Networking

Chose Azure CNI (Container Network Interface). Every Pod gets an IP address from the subnet, which gives the Pod full virtual network connectivity.

The Pods can also be directly reached via their private IP addresses from connected networks.

If you have a virtual machine in the same VNet, it can access the Pod using the private IP address.

Create a virtual network

Enable monitoring and add Tags in Production

From Powershell we can get our Cluster credentials.

az account show: will verify that we are logged into the correct account

az configure --defaults group=aks-rg1: set the default resource group

az aks get-credentials --name [name of Kubernetes cluster]: Fetch credentials and merge into our current context, so we can repurpose the credentials for subsequent commands.

kubectl config current-context: Ensure you have the correct current context

Ways to deploy

Declarative is the preferred production environment method

Imperative is the easy way:

Deploy and verify

How to connect to the service?

Create a Service of type LoadBalancer with a public IP which will connect to our application.

Left pane has imperative creation and right pane has watching for service and exposes the public IP to connect to our web application.

Launch the load balancer and app from Powershell

Scale deployment to 3 replicas

Maximum of 110 pods with this agentpool

Kubernetes requires 11 system pods

So the maximum number of pods available for your app is 99.

To get 100 pods, we need to add another worker node to the cluster.

Scaling Nodes manually

Verify

Or by kubectl get notes

With two running nodes, we have now successfully scaled to 100 pods

Updating the application

To upgrade the application to a new version we just need to change the version of the image.

Verify using kubectl describe deployment [application name]

Alternatively, we can update the yaml file which contains the image name.

To do this use: kubectl edit deployment myapp --record=true

Update the yaml file and save.

Rolling back

By adding --record=true to each of these means that we have a deployment history.

Get a full deployment history:

kubectl rollout history deployment/myapp

To undo the latest change: kubectl rollout undo deployment/myapp

To revert to a specific revision: kubectl rollout undo deployment/myapp --to-revision 1

Declarative Approach

Create a yaml file that defines the Kubernetes deployment object.

Deployment yaml example:

We need to expose the deployment as a service in the same yaml file

These are combined into a single file. We can separate the deployment and service object using three dashes: ---

To create the deployment and service we can run the yaml file as follows:

kubectl create -f .\myapp2.yml

To deploy updates to the yaml file, changes to image etc., simply make the changes and use the following:

kubectl apply -f .\myapp2.yml

Using a declarative approach means you can define Kubernetes objects as YAML files, source control them and build your objects as part of the CI/CD pipeline.

To delete the app and service

Host images in ACR

In the Basic SKU the networking is greyed out. Must use the Premium SKU in Production as it provides a private endpoint the Azure container registry.

Use Premium SKU in Production for Encryption so that can be enabled.

Create after creating tags.

Access control

We need to give our AKS agent pool or our Kubernetes worker nodes the permission container images from this registry which is our Azure Container Registry.

Go to Access Control -> Add -> Add Role Assignment