Learn KOP - Provision AKS Cluster - Rafay Product Documentation

Part 1: Provision

This is Part 1 of a multi-part, self-paced quick start exercise that will focus on provisioning an AKS cluster in Azure using the web console, RCTL CLI, or Terraform.

What Will You Do

In part 1, you will:

Watch a video of this exercise.

Provision AKS Cluster: Getting Started with Rafay Terraform Provider for AKS

Step 1: Create Project

In this step, we will create a new project which will serve as a logically isolated "operating environment" (sub tenant).

Note: Creating a project requires " Org Admin" privileges.

Step 2: Create Cloud Credential

Cloud credentials provide the controller with privileges to programmatically interact with your Azure account so that it can manage the lifecycle of infrastructure associated with AKS clusters.

Step 3: Configure & Provision Cluster

In this step, you will configure and customize your Azure AKS Cluster using either the web console, the RCTL CLI with a YAML based cluster specification, or Terraform with some configuration files.

Select a method to provision and manage your AKS cluster from the tabs below.

Web ConsoleRCTL CLITerraform

Provisioning will take approximately 10 minutes to complete. The final step in the process is the blueprint sync for the default blueprint. This can take a few minutes to complete because this requires the download of several container images and deployment of monitoring and log aggregation components.

apiVersion: infra.k8smgmt.io/v3
kind: Cluster
metadata:
  name: aks-get-started-cluster
  project: defaultproject
spec:
  blueprintConfig:
    name: default-aks
  cloudCredentials: azure-cc
  config:
    kind: aksClusterConfig
    metadata:
      name: aks-get-started-cluster
    spec:
      managedCluster:
        apiVersion: "2022-07-01"
        identity:
          type: SystemAssigned
        location: centralindia
        properties:
          apiServerAccessProfile:
            enablePrivateCluster: true
          dnsPrefix: aks-get-started-cluster-dns
          kubernetesVersion: 1.29.4
          networkProfile:
            loadBalancerSku: standard
            networkPlugin: kubenet
        sku:
          name: Basic
          tier: Free
        type: Microsoft.ContainerService/managedClusters
      nodePools:
      - apiVersion: "2022-07-01"
        location: centralindia
        name: primary
        properties:
          count: 1
          enableAutoScaling: true
          maxCount: 1
          maxPods: 40
          minCount: 1
          mode: System
          orchestratorVersion: 1.29.4
          osType: Linux
          type: VirtualMachineScaleSets
          vmSize: Standard_DS2_v2
        type: Microsoft.ContainerService/managedClusters/agentPools
      resourceGroupName: Resource-Group
  proxyConfig: {}
  type: aks

Update the following sections of the specification file with details to match your environment:

  metadata:
    name: aks-get-started-cluster
    project: defaultproject

  cloudprovider: azure-cc

  metadata:
    name: aks-get-started-cluster

Managed Identity

Below is the configuration needed for a System-assigned managed identity:

    type: SystemAssigned

Below is a sample configuration needed for a User-assigned managed identity:

    type: UserAssigned
    userAssignedIdentities: /subscriptions/a2252eb2-7a25-432b-a5ec-e18eba6f26b1/resourceGroups/demo/providers/Microsoft.ManagedIdentity/userAssignedIdentities/demo-mgi-cli: {}

    location: centralindia

    dnsPrefix: aks-get-started-cluster-dns

    resourceGroupName: Resource-Group

./rctl apply -f aks-cluster-basic.yaml

Expected output (with a task id):

{
  "taskset_id": "w2l0q62",
  "operations": [
    {
      "operation": "ClusterCreation",
      "resource_name": "aks-get-started-cluster",
      "status": "PROVISION_TASK_STATUS_PENDING"
    },
    {
      "operation": "NodegroupCreation",
      "resource_name": "primary",
      "status": "PROVISION_TASK_STATUS_INPROGRESS"
    },
    {
      "operation": "BlueprintSync",
      "resource_name": "aks-get-started-cluster",
      "status": "PROVISION_TASK_STATUS_INPROGRESS"
    }
  ],
  "comments": "The status of the operations can be fetched using taskset_id",
  "status": "PROVISION_TASKSET_STATUS_PENDING"
}

To retrieve the status of the apply operation, enter the below command with the generated task id:

./rctl status apply w2l0q62

Expected Output:

{
  "taskset_id": "w2l0q62",
  "operations": [
    {
      "operation": "ClusterCreation",
      "resource_name": "aks-get-started-cluster",
      "status": "PROVISION_TASK_STATUS_INPROGRESS"
    },
    {
      "operation": "NodegroupCreation",
      "resource_name": "primary",
      "status": "PROVISION_TASK_STATUS_PENDING"
    },
    {
      "operation": "BlueprintSync",
      "resource_name": "aks-get-started-cluster",
      "status": "PROVISION_TASK_STATUS_PENDING"
    }
  ],
  "comments": "Configuration is being applied to the cluster",
  "status": "PROVISION_TASKSET_STATUS_INPROGRESS"
}

Once the cluster finishes provisioning, download the cluster configuration file and compare it to the specification file used to create the cluster. The two files will match.

Make sure the following are installed or available:

Make sure you have the following information. You may need to create these in your Azure environment or in the console:

To provision a cluster using Terraform:

It can take 20 minutes to provision the cluster. Check the console for the provisioning status.

Step 4: Verify Cluster

Once provisioning is complete, you should have a ready to use Azure AKS Cluster. We will verify the cluster by checking its health and status.

Step 4a: Cluster Status & Health

The Kubernetes management operator automatically deployed on the cluster by the controller will "maintain a heartbeat" with the controller and will "proactively monitor" the status of the components on the worker node required for communication with the control plane and the controller.

Step 4b : Zero Trust Kubectl

Your AKS Cluster's API Server is private and secure. The controller provides a zero trust kubectl channel for authorized users.

Step 5: Dashboards

The default cluster blueprint automatically deploys Prometheus and other components required to monitor the AKS cluster. This data is aggregated from the cluster on the controller in a central, time series database. This data is then made available to administrators in the form of detailed dashboards.

Step 5a: Cluster Dashboard

Click on the cluster name to view the cluster dashboard. You will be presented with time series data for the following:

Step 5b: Node Dashboard

Click on the node to view the node dashboard.

Now, click on "Overview". You will be presented with time series data for the following metrics:

Step 5c: Kubernetes Resources

The dashboard also comes with an integrated Kubernetes dashboard. Click on "Resources" and you will be presented with all the Kubernetes resources organized using a number of filters.

Recap

Congratulations! At this point, you have: