策略引擎>> ansible-deploy-aks>> 返回
项目作者： XenitAB

项目描述 ：
Ansible deployment of AKS
高级语言：
项目地址: git://github.com/XenitAB/ansible-deploy-aks.git
创建时间： 2019-02-21T08:30:44Z
项目社区：https://github.com/XenitAB/ansible-deploy-aks
开源协议：MIT License
下载


ansible-deploy-aks

Introduction

Ansible deployment of AKS

Information

Two playbooks to deploy and configure Azure Kubernetes Service.

Includes the following in Azure:

  • AKS Cluster (RBAC)
  • ContainerInsights (disabled by default)
  • DNS Zone (to be configured with external-dns)
  • Azure Container Registry
  • Not implemented: Azure AD Configuration

Includes the following in Kubernetes:

  • Istio (using istio-operator)
  • cert-manager
  • external-dns
  • goldpinger
  • ark (velero)
  • kubedb (disabled by default)
  • datadog agent (and tracing)

Configure the following files

How to run

TODO: Create Azure AD Application (isn’t implemented as of now)

Follow this guide: Integrate Azure Active Directory with Azure Kubernetes Service

Generate service principal for Azure

  1. # Login to Azure
  2. az login
  4. # List subscriptions
  5. az account list --output table
  7. # Select subscription
  8. az account set --subscription "<Subscription Name>"
  10. # Valdiate that the correct subscription is selected
  11. az account list --query "[?isDefault==\`true\`]" --output table
  13. # Create variables with the subscription data
  14. TenantID=$(az account list --query "[?isDefault==\`true\`].tenantId" --output tsv)
  15. SubscriptionID=$(az account list --query "[?isDefault==\`true\`].id" --output tsv)
  17. # Create Service Principal
  18. # Store the password in a safe place and write down that it will expire in a year
  19. # This will make the service principal contributor to the subscription
  20. az ad sp create-for-rbac --name sp-aks
  21. ClientID=$(az ad sp list --query "[?appDisplayName=='sp-aks'].appId" --output tsv)

Ansible

Deploy AKS

  1. cd deploy-aks
  2. ansible-playbook -i hosts deploy-aks.yml -e "ansible_python_interpreter=<python>" -e AZURE_CLIENT_ID="<ClientID>" -e AZURE_SECRET='"<Secret>"' -e AZURE_SUBSCRIPTION_ID="<SubscriptionID>" -e AZURE_TENANT="<TenantID>" --flush-cache

TODO: AAD Integration: (not included as of now)

ansible-playbook -i hosts-prd deploy-aks.yml -e “ansible_python_interpreter=“ -e AZURE_CLIENT_ID=”“ -e AZURE_SECRET=’”“‘ -e AZURE_SUBSCRIPTION_ID=”“ -e AZURE_TENANT=”“ -e aksAADClientAppID=”“ -e aksAADServerAppID=”“ -e aksAADServerAppSecret=’”“‘ -e aksAADTenantID=”“ —flush-cache

Manual steps:

  • Configure the nameservers of the domain, pointing to the zone created in the resource group. Do this before running configure-aks.

Configure AKS

  1. cd configure-aks
  2. ansible-playbook -i hosts configure-aks.yml -e "ansible_python_interpreter=<python>" -e AZURE_CLIENT_ID="<ClientID>" -e AZURE_SECRET='"<Secret>"' -e AZURE_SUBSCRIPTION_ID="<SubscriptionID>" -e AZURE_TENANT="<TenantID>" -e DATADOG_API_KEY='"<DatadogApiKey>"' --flush-cache

Citrix ingress controller

Citrix has an ingress controller which can be used instead of products like ingress-nginx. You can find more information about it here:

How to use

I’ve tested it without Istio and haven’t tried it together. I recommend disabling istioOperator in configure-aks/roles/configure-aks/defaults/main.yml.

Enable citrixCpx in configure-aks/roles/configure-aks/defaults/main.yml.

When configure-aks has completed, deploy cpx-ingress-apache.yaml to one of your namespaces and verify functionality. Make sure to change the domain names (example.com) to the correct one. I’ve added a responder to redirect http to https to show how to use that functionality.

Kubernetes

Goldpinger

  1. kubectl -n goldpinger port-forward $(kubectl -n goldpinger get pod -l app=goldpinger -o jsonpath='{.items[0].metadata.name}') 8080:80