k8s/AzureAKS

Links https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-cli
SP - Service principal - used by the k8s cluster
- NOTE: $/!\$ only valid for 1 year - rotate credentials
  - Saved on azure node(vm) at /etc/kubernetes/azure.json
  - If created with az aks create, saved on laptop at ~/.azure/aksServicePrincipal.json
  - got to delete SP, on cluster deletion, not done for you. query for your clusters servicePrincipalProfile.clientId and then delete it using the az ad sp delete
- Give it roles/access e.g.
  - Access to Azure Container registry to pull images
  - Access storage in different RG
  - Access IP in different RG

Create AKS

RG_NAME=myResourceGroup-NP
CLUSTER_NAME=myAKSCluster
LOCATION=canadaeast

Create the AKS cluster and specify *azure* for the network plugin and network policy.

```azurecli
az aks create \
    --resource-group $RG_NAME \
    --name $CLUSTER_NAME \
    --node-count 1 \
    --network-plugin azure \
    --network-policy azure

AKS RBAC

Assign role to AD group

AKS_ID=$(az aks show \
    --resource-group myRGroup \
    --name myAKSCluster \
    --query id -o tsv)

APPDEV_ID=$(az ad group create \
    --display-name appdev \
    --mail-nickname appdev \
    --query objectId -o tsv)

az role assignment create \
  --assignee $APPDEV_ID \
  --role "Azure Kubernetes Service Cluster User Role" \
  --scope $AKS_ID

AKS Autoscaler and NodePools

Use priorities to pick preferd pool order, From https://github.com/Azure/AKS/issues/2359

az aks update --subscription xxx --resource-group xxx --name xxx --cluster-autoscaler-profile expander=priority