# Part 1: Provision

This is Part 1 of a multi-part, self-paced quick start exercise that will focus on provisioning an AKS cluster in Azure using the web console, RCTL CLI, or Terraform.

---

## What Will You Do

In part 1, you will:

- Create a new [Project](https://docs.rafay.co/security/tenancy/projects/) in your Org
- Create a Cloud Credential
- Provision an Azure AKS cluster
- Verify cluster health
- Review available dashboards

Watch a video of this exercise.

[Provision AKS Cluster: Getting Started with Rafay Terraform Provider for AKS](https://www.youtube.com/watch?v=0XfhkhY9Vrc)

---

## Step 1: Create Project  
In this step, we will create a new project which will serve as a logically isolated "operating environment" (sub tenant).

Note: Creating a project requires " [Org Admin](https://docs.rafay.co/security/rbac/roles/)" privileges.

- Create a new project called "aks"

- Switch context to this project by clicking on the project in the web console

---

## Step 2: Create Cloud Credential  
Cloud credentials provide the controller with privileges to programmatically interact with your Azure account so that it can manage the lifecycle of infrastructure associated with AKS clusters.

- Follow the step-by-step [instructions](https://docs.rafay.co/clusters/aks/azure_setup/) to setup Azure and obtain the required credentials.
- Follow the step-by-step [instructions](https://docs.rafay.co/clusters/aks/credentials/) to create an Azure cloud credential on the controller.
- Validate the newly created cloud credential to ensure it is configured correctly.

---

## Step 3: Configure & Provision Cluster  
In this step, you will configure and customize your Azure AKS Cluster using either the web console, the RCTL CLI with a YAML based cluster specification, or Terraform with some configuration files.

Select a method to provision and manage your AKS cluster from the tabs below.

[Web Console](https://docs.rafay.co/learn/quickstart/aks/clusterlifecycle/provision/#__tabbed_1_1)[RCTL CLI](https://docs.rafay.co/learn/quickstart/aks/clusterlifecycle/provision/#__tabbed_1_2)[Terraform](https://docs.rafay.co/learn/quickstart/aks/clusterlifecycle/provision/#__tabbed_1_3)

- Navigate to the previously created project in your Org
- Select Infrastructure -> Clusters
- Click "New Cluster"
- Select "Create a New Cluster"
- Click "Continue"

- Select "Public Cloud"
- Select "Azure"
- Select "Azure AKS"
- Enter a cluster name
- Click "Continue"

- Enter the "Resource Group" where the cluster will be created
- Select the previously created "Cloud Credentials"
- Select the Azure Region for the cluster
- Select the K8S Version for the cluster
- Select the "default-aks" blueprint
- Click "Save Changes"

- Click "Provision"

Provisioning will take approximately 10 minutes to complete. The final step in the process is the blueprint sync for the default blueprint. This can take a few minutes to complete because this requires the download of several container images and deployment of monitoring and log aggregation components.

- Save the below specification file to your computer as "aks-cluster-basic.yaml". Note, the highlighted sections in the spec will need to be updated to match your environment.

```yaml
apiVersion: infra.k8smgmt.io/v3
kind: Cluster
metadata:
  name: aks-get-started-cluster
  project: defaultproject
spec:
  blueprintConfig:
    name: default-aks
  cloudCredentials: azure-cc
  config:
    kind: aksClusterConfig
    metadata:
      name: aks-get-started-cluster
    spec:
      managedCluster:
        apiVersion: "2022-07-01"
        identity:
          type: SystemAssigned
        location: centralindia
        properties:
          apiServerAccessProfile:
            enablePrivateCluster: true
          dnsPrefix: aks-get-started-cluster-dns
          kubernetesVersion: 1.29.4
          networkProfile:
            loadBalancerSku: standard
            networkPlugin: kubenet
        sku:
          name: Basic
          tier: Free
        type: Microsoft.ContainerService/managedClusters
      nodePools:
      - apiVersion: "2022-07-01"
        location: centralindia
        name: primary
        properties:
          count: 1
          enableAutoScaling: true
          maxCount: 1
          maxPods: 40
          minCount: 1
          mode: System
          orchestratorVersion: 1.29.4
          osType: Linux
          type: VirtualMachineScaleSets
          vmSize: Standard_DS2_v2
        type: Microsoft.ContainerService/managedClusters/agentPools
      resourceGroupName: Resource-Group
  proxyConfig: {}
  type: aks
```

Update the following sections of the specification file with details to match your environment:

- Update the name and project sections with the name of the cluster and the name of the project in your organization:

```yaml
  metadata:
    name: aks-get-started-cluster
    project: defaultproject
```

- Update the cloudprovider section with the name of the cloud credential that was previously created:

```yaml
  cloudprovider: azure-cc
```

- Update the name section with the name of the cluster to be created:

```yaml
  metadata:
    name: aks-get-started-cluster
```

### Managed Identity  
- Update the identity type to use either a System-assigned or User-assigned managed identity

Below is the configuration needed for a System-assigned managed identity:

```yaml
    type: SystemAssigned
```

Below is a sample configuration needed for a User-assigned managed identity:

```yaml
    type: UserAssigned
    userAssignedIdentities: /subscriptions/a2252eb2-7a25-432b-a5ec-e18eba6f26b1/resourceGroups/demo/providers/Microsoft.ManagedIdentity/userAssignedIdentities/demo-mgi-cli: {}
```

- Update the location sections with the Azure region where the cluster will be created:

```yaml
    location: centralindia
```

- Update the dnsprefix section with the DNS name prefix to use with the hosted Kubernetes API server FQDN:

```yaml
    dnsPrefix: aks-get-started-cluster-dns
```

- Update the resourceGroupName section with the name of the Azure Resource Group where the resources will be created:

```yaml
    resourceGroupName: Resource-Group
```

- Save the updates that were made to the file
- Execute the following command to provision the cluster from the specification file previously saved:

```bash
./rctl apply -f aks-cluster-basic.yaml
```

**_Expected output (with a task id):_**

```json
{
  "taskset_id": "w2l0q62",
  "operations": [
    {
      "operation": "ClusterCreation",
      "resource_name": "aks-get-started-cluster",
      "status": "PROVISION_TASK_STATUS_PENDING"
    },
    {
      "operation": "NodegroupCreation",
      "resource_name": "primary",
      "status": "PROVISION_TASK_STATUS_INPROGRESS"
    },
    {
      "operation": "BlueprintSync",
      "resource_name": "aks-get-started-cluster",
      "status": "PROVISION_TASK_STATUS_INPROGRESS"
    }
  ],
  "comments": "The status of the operations can be fetched using taskset_id",
  "status": "PROVISION_TASKSET_STATUS_PENDING"
}
```

To retrieve the status of the apply operation, enter the below command with the generated task id:

```bash
./rctl status apply w2l0q62
```

**_Expected Output:_**

```json
{
  "taskset_id": "w2l0q62",
  "operations": [
    {
      "operation": "ClusterCreation",
      "resource_name": "aks-get-started-cluster",
      "status": "PROVISION_TASK_STATUS_INPROGRESS"
    },
    {
      "operation": "NodegroupCreation",
      "resource_name": "primary",
      "status": "PROVISION_TASK_STATUS_PENDING"
    },
    {
      "operation": "BlueprintSync",
      "resource_name": "aks-get-started-cluster",
      "status": "PROVISION_TASK_STATUS_PENDING"
    }
  ],
  "comments": "Configuration is being applied to the cluster",
  "status": "PROVISION_TASKSET_STATUS_INPROGRESS"
}
```

- Login to the web console and view the cluster being provisioned

Once the cluster finishes provisioning, download the cluster configuration file and compare it to the specification file used to create the cluster. The two files will match.

- Go to Clusters -> Infrastructure.
- Click on the Settings Icon for the newly created cluster and select "Download Cluster Config"

Make sure the following are installed or available:

- [Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli)
- Text editor (or ability to update files using a terminal)

Make sure you have the following information. You may need to create these in your Azure environment or in the console:

- [Azure Subscription ID](https://docs.rafay.co/clusters/aks/azure_setup/#subscription-id)
- [Azure Application ID and Azure Tenant ID](https://docs.rafay.co/clusters/aks/azure_setup/#application-and-tenant-id)
- [Azure Client Secret](https://docs.rafay.co/clusters/aks/azure_setup/#generate-secret-value)
- [Azure Resource Group](https://docs.rafay.co/clusters/aks/azure_setup/#create-a-resource-group)
- [Console API Key and Secret](https://docs.rafay.co/security/rbac/users/#api-keys-settings)

To provision a cluster using Terraform:

- Download and decompress the [Get Started](https://github.com/RafaySystems/getstarted) package. Navigate to the `/terraform/aks` folder.
- Edit the `config.json` file. The file location is **/terraform/artifacts/credentials/config.json**.
- Edit the `terraform.tfvars` file. The file location is **/terraform/terraform.tfvars**.
- Open the terminal or command line.
- Run `terraform init`.
- Run `terraform validate`.
- Run `terraform apply`. Enter `yes` when prompted.

It can take 20 minutes to provision the cluster. Check the console for the provisioning status.

---

## Step 4: Verify Cluster  
Once provisioning is complete, you should have a ready to use Azure AKS Cluster. We will verify the cluster by checking its health and status.

---

### Step 4a: Cluster Status & Health  
The Kubernetes management operator automatically deployed on the cluster by the controller will "maintain a heartbeat" with the controller and will "proactively monitor" the status of the components on the worker node required for communication with the control plane and the controller.

- Cluster reachability should be not more than 1 minute
- Control plane should report as Healthy

---

### Step 4b : Zero Trust Kubectl  
Your AKS Cluster's API Server is private and secure. The controller provides a [zero trust kubectl](https://docs.rafay.co/accessproxy/overview/) channel for authorized users.

- Click the "Kubectl" button on the cluster card.
- This will launch a web based kubectl shell for you to securely interact with the API server over a zero trust channel.

---

## Step 5: Dashboards  
The default cluster blueprint automatically deploys Prometheus and other components required to monitor the AKS cluster. This data is aggregated from the cluster on the controller in a central, time series database. This data is then made available to administrators in the form of detailed dashboards.

### Step 5a: Cluster Dashboard  
Click on the cluster name to view the cluster dashboard. You will be presented with time series data for the following:

- Cluster Health
- CPU Utilization
- Memory Utilization
- Storage Utilization
- Number of Worker Nodes
- Number of workloads and their status
- Number of pods and their status

---

### Step 5b: Node Dashboard  
Click on the node to view the node dashboard.

Now, click on "Overview". You will be presented with time series data for the following metrics:

- Node Health
- CPU Utilization
- Memory Utilization
- Storage Utilization

---

### Step 5c: Kubernetes Resources  
The dashboard also comes with an integrated Kubernetes dashboard. Click on "Resources" and you will be presented with all the Kubernetes resources organized using a number of filters.

---

## Recap  
Congratulations! At this point, you have:

- Successfully configured and provisioned an Azure AKS cluster
- Used zero trust kubectl to securely access the AKS cluster's API server
- Used the integrated cluster, node and k8s dashboards to monitor and view details about the cluster

---