You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-arc/kubernetes/cluster-connect.md
+51-46Lines changed: 51 additions & 46 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: "Use Cluster Connect to connect to Azure Arc-enabled Kubernetes clusters"
3
3
services: azure-arc
4
4
ms.service: azure-arc
5
-
ms.date: 04/05/2021
5
+
ms.date: 10/31/2021
6
6
ms.topic: article
7
7
author: shashankbarsin
8
8
ms.author: shasb
@@ -17,94 +17,89 @@ With Cluster Connect, you can securely connect to Azure Arc-enabled Kubernetes c
17
17
18
18
A conceptual overview of this feature is available in [Cluster connect - Azure Arc-enabled Kubernetes](conceptual-cluster-connect.md) article.
19
19
20
-
[!INCLUDE [preview features note](./includes/preview/preview-callout.md)]
21
-
22
20
## Prerequisites
23
21
24
22
-[Install or upgrade Azure CLI](/cli/azure/install-azure-cli) to version >= 2.16.0
25
23
26
24
- Install the `connectedk8s` Azure CLI extension of version >= 1.1.0:
27
25
28
-
```azurecli
26
+
```console
29
27
az extension add --name connectedk8s
30
28
```
31
29
32
30
If you've already installed the `connectedk8s` extension, update the extension to the latest version:
33
31
34
-
```azurecli
32
+
```console
35
33
az extension update --name connectedk8s
36
34
```
37
35
38
36
- An existing Azure Arc-enabled Kubernetes connected cluster.
39
37
- If you haven't connected a cluster yet, use our [quickstart](quickstart-connect-cluster.md).
40
38
- [Upgrade your agents](agent-upgrade.md#manually-upgrade-agents) to version >= 1.1.0.
41
39
42
-
- Enable the Cluster Connect on any Azure Arc-enabled Kubernetes cluster by running the following command on a machine where the `kubeconfig` file is pointed to the cluster of concern:
43
-
44
-
```azurecli
45
-
az connectedk8s enable-features --features cluster-connect -n <clusterName> -g <resourceGroupName>
46
-
```
47
-
48
40
- Enable the below endpoints for outbound access in addition to the ones mentioned under [connecting a Kubernetes cluster to Azure Arc](quickstart-connect-cluster.md#meet-network-requirements):
- Replace the placeholders and run the below command to set the environment variables used in this document:
56
48
57
-
Two authentication options are supported with the Cluster Connect feature:
58
-
* Azure Active Directory (Azure AD)
59
-
* Service account token
49
+
```console
50
+
CLUSTER_NAME=<cluster-name>
51
+
RESOURCE_GROUP=<resource-group-name>
52
+
ARM_ID_CLUSTER=$(az connectedk8s show -n $CLUSTER_NAME -g $RESOURCE_GROUP --query id -o tsv)
53
+
```
60
54
61
-
### Option 1: Azure Active Directory
62
55
63
-
1. With the `kubeconfig` file pointing to the `apiserver` of your Kubernetes cluster, create a ClusterRoleBinding or RoleBinding to the Azure AD entity (service principal or user) requiring access:
You can enable the Cluster Connect on any Azure Arc-enabled Kubernetes cluster by running the following command on a machine where the `kubeconfig` file is pointed to the cluster of concern:
70
59
71
-
**For Azure AD application:**
60
+
```console
61
+
az connectedk8s enable-features --features cluster-connect -n $CLUSTER_NAME -g $RESOURCE_GROUP
62
+
```
72
63
73
-
1. Get the `objectId` associated with your Azure AD application:
64
+
## Azure Active Directory authentication option
74
65
75
-
```azurecli
76
-
az ad sp show --id <id> --query objectId -o tsv
77
-
```
66
+
1. Get the `objectId` associated with your Azure AD entity:
67
+
68
+
- For Azure AD user account:
78
69
79
-
1. Create a ClusterRoleBinding or RoleBinding to the Azure AD entity (service principal or user) that needs to access this cluster:
AAD_ENTITY_OBJECT_ID=$(az ad signed-in-user show --query objectId -o tsv)
83
72
```
84
73
85
-
1. After logging into Azure CLI using the Azure AD entity of interest, get the Cluster Connect `kubeconfig` needed to communicate with the cluster from anywhere (from even outside the firewall surrounding the cluster):
74
+
- For Azure AD application:
86
75
87
-
```azurecli
88
-
az connectedk8s proxy -n <cluster-name> -g <resource-group-name>
89
-
```
76
+
```console
77
+
AAD_ENTITY_OBJECT_ID=$(az ad sp show --id <id> --query objectId -o tsv)
78
+
```
90
79
91
-
1. Use `kubectl` to send requests to the cluster:
80
+
1. Authorize the AAD entity with appropriate permissions:
92
81
93
-
```console
94
-
kubectl get pods
95
-
```
82
+
- If you are using Kubernetes native ClusterRoleBinding or RoleBinding for authorization checks on the cluster, with the `kubeconfig` file pointing to the `apiserver` of your cluster for direct access, you can create one mapped to the Azure AD entity (service principal or user) that needs to access this cluster. Example:
96
83
97
-
You should now see a response from the cluster containing the list of all pods under the `default` namespace.
- If you are using Azure RBAC for authorization checks on the cluster, you can create an Azure role assignment mapped to the Azure AD entity. Example:
89
+
90
+
```console
91
+
az role assignment create --role "Azure Arc Kubernetes Viewer" --assignee $AAD_ENTITY_OBJECT_ID --scope $ARM_ID_CLUSTER
92
+
```
93
+
94
+
## Service account token authentication option
100
95
101
96
1. With the `kubeconfig` file pointing to the `apiserver` of your Kubernetes cluster, create a service account in any namespace (following command creates it in the default namespace):
102
97
103
98
```console
104
99
kubectl create serviceaccount admin-user
105
100
```
106
101
107
-
1. Create ClusterRoleBinding or RoleBinding to grant this [service account the appropriate permissions on the cluster](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#kubectl-create-rolebinding):
102
+
1. Create ClusterRoleBinding or RoleBinding to grant this [service account the appropriate permissions on the cluster](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#kubectl-create-rolebinding). Example:
@@ -120,18 +115,28 @@ Two authentication options are supported with the Cluster Connect feature:
120
115
TOKEN=$(kubectl get secret ${SECRET_NAME} -o jsonpath='{$.data.token}' | base64 -d | sed $'s/$/\\\n/g')
121
116
```
122
117
123
-
1. Get the Cluster Connect `kubeconfig` needed to communicate with the cluster from anywhere (from even outside the firewall surrounding the cluster):
118
+
## Access your cluster
124
119
125
-
```azurecli
126
-
az connectedk8s proxy -n <cluster-name> -g <resource-group-name> --token $TOKEN
127
-
```
120
+
1. Set up the Cluster Connect based kubeconfig needed to access your cluster based on the authentication option used:
121
+
122
+
- If using Azure Active Directory authentication option, after logging into Azure CLI using the Azure AD entity of interest, get the Cluster Connect `kubeconfig` needed to communicate with the cluster from anywhere (from even outside the firewall surrounding the cluster):
123
+
124
+
```console
125
+
az connectedk8s proxy -n $CLUSTER_NAME -g $RESOURCE_GROUP
126
+
```
127
+
128
+
- If using the service account authentication option, get the Cluster Connect `kubeconfig` needed to communicate with the cluster from anywhere:
129
+
130
+
```console
131
+
az connectedk8s proxy -n $CLUSTER_NAME -g $RESOURCE_GROUP --token $TOKEN
132
+
```
128
133
129
134
1. Use `kubectl` to send requests to the cluster:
130
135
131
136
```console
132
137
kubectl get pods
133
138
```
134
-
139
+
135
140
You should now see a response from the cluster containing the list of all pods under the `default` namespace.
title: Access Kubernetes resources from Azure portal
3
+
services: azure-arc
4
+
ms.service: azure-arc
5
+
ms.date: 10/31/2021
6
+
ms.topic: article
7
+
author: shashankbarsin
8
+
ms.author: shasb
9
+
description: Learn how to interact with Kubernetes resources to manage an Azure Arc-enabled Kubernetes cluster from the Azure portal.
10
+
---
11
+
12
+
# Access Kubernetes resources from Azure portal
13
+
14
+
The Azure portal includes a Kubernetes resource view for easy access to the Kubernetes resources in your Azure Arc-enabled Kubernetes cluster. Viewing Kubernetes resources from the Azure portal reduces context switching between the Azure portal and the `kubectl` command-line tool, streamlining the experience for viewing and editing your Kubernetes resources. The resource viewer currently includes multiple resource types, such as deployments, pods, and replica sets.
15
+
16
+
[!INCLUDE [preview features note](./includes/preview/preview-callout.md)]
17
+
18
+
## Prerequisites
19
+
20
+
- An existing Kubernetes cluster [connected](quickstart-connect-cluster.md) to Azure as an Azure Arc-enabled Kubernetes resource.
21
+
22
+
-[Cluster Connect feature has to be enabled](cluster-connect.md#enable-cluster-connect-feature) on the Azure Arc-enabled Kubernetes cluster.
23
+
24
+
-[Service account token](cluster-connect.md#service-account-token-authentication-option) for authentication to the cluster.
25
+
26
+
## View Kubernetes resources
27
+
28
+
To see the Kubernetes resources, navigate to your AKS cluster in the Azure portal. The navigation pane on the left is used to access your resources. The resources include:
29
+
30
+
-**Namespaces** displays the namespaces of your cluster. The filter at the top of the namespace list provides a quick way to filter and display your namespace resources.
31
+
-**Workloads** shows information about deployments, pods, replica sets, stateful sets, daemon sets, jobs, and cron jobs deployed to your cluster.
32
+
-**Services and ingresses** shows all of your cluster's service and ingress resources.
33
+
-**Storage** shows your Azure storage classes and persistent volume information.
34
+
-**Configuration** shows your cluster's config maps and secrets.
35
+
36
+
[](media/kubernetes-resource-view/workloads.png#lightbox)
37
+
38
+
## Edit YAML
39
+
40
+
The Kubernetes resource view also includes a YAML editor. A built-in YAML editor means you can update Kubernetes objects from within the portal and apply changes immediately.
41
+
42
+
After editing the YAML, changes are applied by selecting **Review + save**, confirming the changes, and then saving again.
43
+
44
+
[](media/kubernetes-resource-view/yaml-editor.png#lightbox)
45
+
46
+
>[!WARNING]
47
+
> Performing direct production changes via UI or CLI is not recommended and you should consider using [Configurations (GitOps)](tutorial-use-gitops-connected-cluster.md) for production environments. The Azure portal Kubernetes management capabilities and the YAML editor are built for learning and flighting new deployments in a development and testing setting.
48
+
49
+
## Next steps
50
+
51
+
Azure Monitor for containers provides more in-depth information about nodes and containers of the cluster when compared to the logical view of the Kubernetes resources available with Kubernetes resources view described in this article. Learn how to [deploy Azure Monitor for containers](../../azure-monitor/containers/container-insights-enable-arc-enabled-clusters.md?toc=/azure/azure-arc/kubernetes/toc.json) on your cluster.
0 commit comments