julie-ng / cloudkube-aks-clusters Goto Github PK
View Code? Open in Web Editor NEW3 Clusters, 1 Repo. Opinionated infrastructure as code for my Azure Kubernetes clusters for running demo apps.
License: MIT License
3 Clusters, 1 Repo. Opinionated infrastructure as code for my Azure Kubernetes clusters for running demo apps.
License: MIT License
Per Azure Pod Identity project repo, Pod Identity will be replaced by workload identity federation (preview) in the future.
❗ IMPORTANT: As mentioned in the announcement, we are planning to replace AAD Pod Identity with Azure Workload Identity. Going forward, we will no longer add new features to this project in favor of Azure Workload Identity. However, we will continue patching critical bugs and security vulnerabilities until further notice.
While Workload Identities are in preview, I won't try that in this change yet.
So taking pod identity off the table, we have:
Currently code relies on ARM to create the identity. Instead specify own via https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#kubelet_identity
Currently the default_node_pool
block is used for the system node pool. But this defaults to user mode.
AKS has a mode
property that can be either system
or user
which beyond semantics adds the CriticalAddonsOnly=true:NoSchedule
taint.
Docs Referender: Manage system node pools in Azure Kubernetes Service (AKS) > System and user node pools
default_node_pool
block and the kubernetes_cluster_node_pool
resource definitions.Try auto-generating documentation for my aks-cluster
module
In the terraform code, we'll just listen to the orchestrator_version
(k8s version on nodes) and run the upgrade command when that changes.
We will not use kubernetes_version
, which applies to the control plane and should be upgraded first before the node pools.
AKS does not automatically reboot nodes to actually use newer images - to avoid potentially breaking user workloads.
Per Apply security and kernel updates to Linux nodes in Azure Kubernetes Service (AKS)
To protect your clusters, security updates are automatically applied to Linux nodes in AKS. These updates include OS security fixes or kernel updates. Some of these updates require a node reboot to complete the process. AKS doesn't automatically reboot these Linux nodes to complete the update process.
and later…
Some security updates, such as kernel updates, require a node reboot to finalize the process. A Linux node that requires a reboot creates a file named /var/run/reboot-required. This reboot process doesn't happen automatically.
Additionally updates apply to existing nodes. But new nodes will run the old image
Unattended upgrades apply updates to the Linux node OS, but the image used to create nodes for your cluster remains unchanged. If a new Linux node is added to your cluster, the original image is used to create the node.
For for zero downtime upgrades, run az aks upgrade…
which will
Details described in this doc
Right now if the cluster needs to be rebuilt (Terraform likes that) all the Ingress MI Role assignments to get TLS certificates need to be reset because the identities die with the node resource group.
Moving them outside of Node RG requires a bit more work
https://azure.github.io/aad-pod-identity/docs/getting-started/role-assignment/#user-assigned-identities-that-are-not-within-the-node-resource-group
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.