k8s/AzureAKS

• Links https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-cli

• SP - Service principal - used by the k8s cluster

  • NOTE: only valid for 1 year - rotate credentials

    • Saved on azure node(vm) at /etc/kubernetes/azure.json
    • If created with az aks create, saved on laptop at ~/.azure/aksServicePrincipal.json
    • got to delete SP, on cluster deletion, not done for you. query for your clusters servicePrincipalProfile.clientId and then delete it using the az ad sp delete
  • Give it roles/access e.g.
    • Access to Azure Container registry to pull images
    • Access storage in different RG
    • Access IP in different RG

Create EKS

• Go

  RG_NAME=myResourceGroup-NP
  CLUSTER_NAME=myAKSCluster
  LOCATION=canadaeast
  
  Create the AKS cluster and specify *azure* for the network plugin and network policy.
  
  ```azurecli
  az aks create \
      --resource-group $RG_NAME \
      --name $CLUSTER_NAME \
      --node-count 1 \
      --network-plugin azure \
      --network-policy azure

AKS RBAC

• Assign role to AD group

  AKS_ID=$(az aks show \
      --resource-group myRGroup \
      --name myAKSCluster \
      --query id -o tsv)
  
  APPDEV_ID=$(az ad group create \
      --display-name appdev \
      --mail-nickname appdev \
      --query objectId -o tsv)
  
  az role assignment create \
    --assignee $APPDEV_ID \
    --role "Azure Kubernetes Service Cluster User Role" \
    --scope $AKS_ID