10.Azure / 20.AKS
프로젝트: astro-test1
원본 경로: installguide/10.Azure/20.AKS.md
AKS 생성(설정전)
1. 개요
AKS 생성과정을 가이드한다.
2. AKS 생성
1) 구독 확인
- 확인
# 구독 확인
$ az account show
{
"environmentName": "AzureCloud",
"homeTenantId": "4f0a3bfd-1156-4cce-8dc2-a049a13dba23",
"id": "7028e6ad-e80b-47ba-9bf1-c46415daf5f5",
"isDefault": true,
"managedByTenants": [],
"name": "sub-cloudbiz-common-01",
"state": "Enabled",
"tenantDefaultDomain": "ktds.co.kr",
"tenantDisplayName": "KTDS",
"tenantId": "4f0a3bfd-1156-4cce-8dc2-a049a13dba23",
"user": {
"name": "82023066@ktds.co.kr",
"type": "user"
}
}
# 리소스 그룹 확인
$ az group list -o table
Name Location Status
---------------------- ------------ ---------
rg-cloudbiz-comm-01 koreacentral Succeeded
rg-cloudbiz-common-sso koreacentral Succeeded
2) AKS Private 클러스터 생성
(1) CLI 로 생성
AKS 클러스터 생성
#$SUBSCRIPTION_ID="9f3e1937-23f1-4460-b49c-804126c44b08" // 구독 ID
$SUBSCRIPTION_WORK="sub-900001131-common-01" // 구독 명
$SERVICE_NAME="az01-prd-common" // 서비스 명 (az01-[dev/prd]-단위서비스)
$RESOURCE_GROUP_NAME="rg-az01-prd-common-01" // 리소스 그룹 명
$LOCATION="koreacentral" // 리소스 생성 지역
$VNET_NAME="vnet-az01-prd-common-01" // VNET 명
$VNET_SUBNET_APP="sbn-az01-prd-common-app" // 서브넷 명
$SUBNET_UDR_APP="udr-az01-prd-common-app" // 서브넷 UDR 명
az account set -s $SUBSCRIPTION_ID
az account show -o table
$CONTROL_ID="umi-$SERVICE_NAME-aks-control-id"
$KUBELET_ID="umi-$SERVICE_NAME-aks-kubelet-id"
$FULL_CONTROL_ID="/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$CONTROL_ID"
$FULL_KUBELET_ID="/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$KUBELET_ID"
$CONTROL_ID_INFO=(az identity create --name $CONTROL_ID --resource-group $RESOURCE_GROUP_NAME)
$CONTROL_ID_CLIENT = ($CONTROL_ID_INFO | ConvertFrom-Json).principalId
$KUBELET_ID_INFO=(az identity create --name $KUBELET_ID --resource-group $RESOURCE_GROUP_NAME)
az role assignment create --assignee-object-id $CONTROL_ID_CLIENT --assignee-principal-type ServicePrincipal --role Contributor --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.Network/routeTables/$SUBNET_UDR_APP
az role assignment create --assignee-object-id $CONTROL_ID_CLIENT --assignee-principal-type ServicePrincipal --role Contributor --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.Network/virtualNetworks/$VNET_NAME
az role assignment create --assignee-object-id $CONTROL_ID_CLIENT --assignee-principal-type ServicePrincipal --role "Managed Identity Operator" --scope $FULL_KUBELET_ID
$CLUSTER_NAME="aks-$SERVICE_NAME-01"
$CLUSTER_TIER="standard"
$NODE_SKU="Standard_D4as_v5"
$NODE_OS="Ubuntu"
$NODE_DISK_SIZE=128
$NODE_COUNT=2
$MIN_NODE_COUNT=$NODE_COUNT
$MAX_NODE_COUNT=5
$LOCATION="koreacentral"
$KUBE_VERSION="1.30.11"
$MAX_PODS=250
$AKS_POD_CIDR="100.64.0.0/18"
$AKS_SVC_CIDR="100.64.252.0/22"
$AKS_SVC_DNS_IP="100.64.255.253"
$NODEPOOL_NAME="common"
$ACR_NAME="acraz01comm"
az provider register --namespace Microsoft.ContainerService
``
az aks create `
--name $CLUSTER_NAME `
--resource-group $RESOURCE_GROUP_NAME `
--location $LOCATION `
--enable-private-cluster `
--kubernetes-version $KUBE_VERSION `
--outbound-type userDefinedRouting `
--max-pods $MAX_PODS `
--node-count $NODE_COUNT `
--enable-cluster-autoscaler `
--min-count $MIN_NODE_COUNT `
--max-count $MAX_NODE_COUNT `
--network-plugin azure `
--network-plugin-mode overlay `
--vnet-subnet-id /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.Network/virtualNetworks/$VNET_NAME/subnets/$VNET_SUBNET_APP `
--pod-cidr $AKS_POD_CIDR `
--dns-service-ip $AKS_SVC_DNS_IP `
--service-cidr $AKS_SVC_CIDR `
--node-vm-size $NODE_SKU `
--os-sku $NODE_OS `
--node-osdisk-size $NODE_DISK_SIZE `
--assign-kubelet-identity $FULL_KUBELET_ID `
--assign-identity $FULL_CONTROL_ID `
--generate-ssh-keys `
--nodepool-name $NODEPOOL_NAME `
--private-dns-zone none `
--enable-encryption-at-host `
--node-os-upgrade-channel none `
--tier $CLUSTER_TIER `
--zones 1 2 3
az feature show --namespace Microsoft.Compute --name EncryptionAtHost
AKS nodepool 추가(개발)
export RG_NAME=abclab-dev-rg
export AKS_CLUSTER_NAME=abclab-dev-aks
export VM_SIZE=Standard_D4as_v5
export NODE_POOL=apppool
az aks nodepool add \
--cluster-name $AKS_CLUSTER_NAME \
--name $NODE_POOL \
--labels nodepool=apppool \
--mode user \
--resource-group $RG_NAME \
--node-count 2 \
--node-vm-size $VM_SIZE
(2) AKS 확인
$ az aks list -o table
Name Location ResourceGroup KubernetesVersion CurrentKubernetesVersion ProvisioningState Fqdn
------------------------- ------------ ------------------- ------------------- -------------------------- ------------------- ----------------------------------------------------------------------
aks-az01-cloudbiz-comm-01 koreacentral rg-cloudbiz-comm-01 1.31 1.31.7 Creating aks-az01-c-rg-cloudbiz-comm-7028e6-w13b2hru.hcp.koreacentral.azmk8s.io
...
aks-az01-cloudbiz-comm-01 koreacentral rg-cloudbiz-comm-01 1.31 1.31.7 Succeeded aks-az01-c-rg-cloudbiz-comm-7028e6-w13b2hru.hcp.koreacentral.azmk8s.io
(3) Node Pool 에 Label 설정
- 메뉴 : AKS
- Settings > Node pools > node pool > 우측
- Edit Labels
- Nodepool : app
- Nodepool : infra
3) kubectl 설치 및 클러스터 연결
kubectl을 설치(설치되어 있지 않은 경우에만 수행)
$ az aks install-cli
AKS 클러스터와 연결
$ az account show -o table
EnvironmentName HomeTenantId IsDefault Name State TenantDefaultDomain TenantDisplayName TenantId
----------------- ------------------------------------ ----------- ---------------------- ------- --------------------- ------------------- ------------------------------------
AzureCloud 4f0a3bfd-1156-4cce-8dc2-a049a13dba23 True sub-cloudbiz-common-01 Enabled ktds.co.kr KTDS 4f0a3bfd-1156-4cce-8dc2-a049a13dba23
$ az account set -s sub-cloudbiz-common-01
$ az aks list -o table
Name Location ResourceGroup KubernetesVersion CurrentKubernetesVersion ProvisioningState Fqdn
------------------------- ------------ ------------------- ------------------- -------------------------- ------------------- ----------------------------------------------------------------------
aks-az01-cloudbiz-comm-01 koreacentral rg-cloudbiz-comm-01 1.31 1.31.7 Succeeded aks-az01-c-rg-cloudbiz-comm-7028e6-w13b2hru.hcp.koreacentral.azmk8s.io
# 연결
export RG_NAME=rg-cloudbiz-comm-01
export AKS_CLUSTER_NAME=aks-az01-cloudbiz-comm-01
$ az aks get-credentials \
--name $AKS_CLUSTER_NAME \
--resource-group $RG_NAME
Merged "aks-az01-cloudbiz-comm-01" as current context in /Users/song/.kube/config
# 확인
$ kubectl config view
...
4) use-context
context 를 switching 한다.
# 확인
$ kubectl config view
# get-context
$ kubectl config get-contexts
CURRENT NAME CLUSTER AUTHINFO NAMESPACE
* aks-az01-cloudbiz-comm-01 aks-az01-cloudbiz-comm-01 clusterUser_rg-cloudbiz-comm-01_aks-az01-cloudbiz-comm-01
...
# use-context
$ kubectl config use-context aks-az01-cloudbiz-comm-01
5) Clean Up
# aks 확인
$ az aks list -o table
export RG_NAME=rg-cloudbiz-comm-01
export AKS_CLUSTER_NAME=aks-az01-cloudbiz-comm-01
# aks 삭제시...
$ az aks delete \
--name $AKS_CLUSTER_NAME \
--resource-group $RG_NAME