|
1 | 1 | --- |
2 | 2 | title: "Azure Arc-enabled Kubernetes agent overview" |
3 | | -ms.date: 08/03/2021 |
| 3 | +ms.date: 12/07/2022 |
4 | 4 | ms.topic: conceptual |
5 | | -description: "This article provides an overview of the Azure Arc agents deployed on the Kubernetes clusters when connecting them to Azure Arc." |
| 5 | +description: "Learn about the Azure Arc agents deployed on the Kubernetes clusters when connecting them to Azure Arc." |
6 | 6 | --- |
7 | 7 |
|
8 | 8 | # Azure Arc-enabled Kubernetes agent overview |
9 | 9 |
|
10 | | -[Kubernetes](https://kubernetes.io/) can deploy containerized workloads consistently on hybrid and multi-cloud environments. [Azure Arc-enabled Kubernetes](overview.md) provides a centralized, consistent control plane to manage policy, governance, and security across Kubernetes clusters on these heterogenous environments. |
| 10 | +[Azure Arc-enabled Kubernetes](overview.md) provides a centralized, consistent control plane to manage policy, governance, and security across Kubernetes clusters in different environments. |
11 | 11 |
|
12 | | -This article provides an overview of the Azure Arc agents deployed on the Kubernetes clusters when [connecting them to Azure Arc](quickstart-connect-cluster.md). |
| 12 | +Azure Arc agents are deployed on Kubernetes clusters when you [connect them to Azure Arc](quickstart-connect-cluster.md), This article provides an overview of these agents. |
13 | 13 |
|
14 | 14 | ## Deploy agents to your cluster |
15 | 15 |
|
16 | | -Most on-premises datacenters enforce strict network rules that prevent inbound communication on the network boundary firewall. Azure Arc-enabled Kubernetes works with these restrictions by not requiring inbound ports on the firewall. Azure Arc agents only require outbound communication to a [set list of network endpoints](quickstart-connect-cluster.md#meet-network-requirements). |
| 16 | +Most on-premises datacenters enforce strict network rules that prevent inbound communication on the network boundary firewall. Azure Arc-enabled Kubernetes works with these restrictions by not requiring inbound ports on the firewall. Azure Arc agents require outbound communication to a [set list of network endpoints](quickstart-connect-cluster.md#meet-network-requirements). |
17 | 17 |
|
18 | 18 | :::image type="content" source="media/architectural-overview.png" alt-text="Diagram showing an architectural overview of the Azure Arc-enabled Kubernetes agents." lightbox="media/architectural-overview.png"::: |
19 | 19 |
|
20 | 20 | The following high-level steps are involved in [connecting a Kubernetes cluster to Azure Arc](quickstart-connect-cluster.md): |
21 | 21 |
|
22 | | -1. Create a Kubernetes cluster on your choice of infrastructure (VMware vSphere, Amazon Web Services, Google Cloud Platform, etc.). |
23 | | - |
24 | | - > [!NOTE] |
25 | | - > Azure Arc-enabled Kubernetes currently only supports attaching existing Kubernetes clusters to Azure Arc. You must create the cluster before you connect it to Azure Arc. |
| 22 | +1. Create a Kubernetes cluster on your choice of infrastructure (VMware vSphere, Amazon Web Services, Google Cloud Platform, etc.). The cluster must already exist before you connect it to Azure Arc. |
26 | 23 |
|
27 | 24 | 1. Start the Azure Arc registration for your cluster. |
28 | | - * The agent Helm chart is deployed on the cluster. |
29 | | - * The cluster nodes initiate an outbound communication to the [Microsoft Container Registry](https://github.com/microsoft/containerregistry), pulling the images needed to create the following agents in the `azure-arc` namespace: |
30 | | - |
31 | | - | Agent | Description | |
32 | | - | ----- | ----------- | |
33 | | - | `deployment.apps/clusteridentityoperator` | Azure Arc-enabled Kubernetes currently supports only [system assigned identities](../../active-directory/managed-identities-azure-resources/overview.md). `clusteridentityoperator` initiates the first outbound communication. This first communication fetches the Managed Service Identity (MSI) certificate used by other agents for communication with Azure. | |
34 | | - | `deployment.apps/config-agent` | Watches the connected cluster for source control configuration resources applied on the cluster. Updates the compliance state. | |
35 | | - | `deployment.apps/controller-manager` | An operator of operators that orchestrates interactions between Azure Arc components. | |
36 | | - | `deployment.apps/metrics-agent` | Collects metrics of other Arc agents to verify optimal performance. | |
37 | | - | `deployment.apps/cluster-metadata-operator` | Gathers cluster metadata, including cluster version, node count, and Azure Arc agent version. | |
38 | | - | `deployment.apps/resource-sync-agent` | Syncs the above-mentioned cluster metadata to Azure. | |
39 | | - | `deployment.apps/flux-logs-agent` | Collects logs from the flux operators deployed as a part of source control configuration. | |
40 | | - | `deployment.apps/extension-manager` | Installs and manages lifecycle of extension helm charts | |
41 | | - | `deployment.apps/kube-aad-proxy` | Used for authentication of requests sent to the cluster using Cluster Connect. | |
42 | | - | `deployment.apps/clusterconnect-agent` | Reverse proxy agent that enables the Cluster Connect feature to provide access to `apiserver` of the cluster. Optional component deployed only if the [Cluster Connect](conceptual-cluster-connect.md) feature is enabled. | |
43 | | - | `deployment.apps/guard` | Authentication and authorization webhook server used for Azure Active Directory (Azure AD) RBAC. Optional component deployed only if [Azure RBAC](conceptual-azure-rbac.md) is enabled on the cluster. | |
| 25 | + |
| 26 | + * The agent Helm chart is deployed on the cluster. |
| 27 | + * The cluster nodes initiate an outbound communication to the [Microsoft Container Registry](https://github.com/microsoft/containerregistry), pulling the images needed to create the following agents in the `azure-arc` namespace: |
| 28 | + |
| 29 | + | Agent | Description | |
| 30 | + | ----- | ----------- | |
| 31 | + | `deployment.apps/clusteridentityoperator` | Azure Arc-enabled Kubernetes currently supports only [system assigned identities](../../active-directory/managed-identities-azure-resources/overview.md). `clusteridentityoperator` initiates the first outbound communication. This first communication fetches the Managed Service Identity (MSI) certificate used by other agents for communication with Azure. | |
| 32 | + | `deployment.apps/config-agent` | Watches the connected cluster for source control configuration resources applied on the cluster. Updates the compliance state. | |
| 33 | + | `deployment.apps/controller-manager` | An operator of operators that orchestrates interactions between Azure Arc components. | |
| 34 | + | `deployment.apps/metrics-agent` | Collects metrics of other Arc agents to verify optimal performance. | |
| 35 | + | `deployment.apps/cluster-metadata-operator` | Gathers cluster metadata, including cluster version, node count, and Azure Arc agent version. | |
| 36 | + | `deployment.apps/resource-sync-agent` | Syncs the above-mentioned cluster metadata to Azure. | |
| 37 | + | `deployment.apps/flux-logs-agent` | Collects logs from the Flux operators deployed as a part of [source control configuration](conceptual-gitops-flux2.md). | |
| 38 | + | `deployment.apps/extension-manager` | Installs and manages lifecycle of extension Helm charts. | |
| 39 | + | `deployment.apps/kube-aad-proxy` | Used for authentication of requests sent to the cluster using cluster connect. | |
| 40 | + | `deployment.apps/clusterconnect-agent` | Reverse proxy agent that enables the cluster connect feature to provide access to `apiserver` of the cluster. Optional component deployed only if the [cluster connect](conceptual-cluster-connect.md) feature is enabled. | |
| 41 | + | `deployment.apps/guard` | Authentication and authorization webhook server used for Azure Active Directory (Azure AD) RBAC. Optional component deployed only if [Azure RBAC](conceptual-azure-rbac.md) is enabled on the cluster. | |
44 | 42 |
|
45 | 43 | 1. Once all the Azure Arc-enabled Kubernetes agent pods are in `Running` state, verify that your cluster is connected to Azure Arc. You should see: |
46 | | - * An Azure Arc-enabled Kubernetes resource in [Azure Resource Manager](../../azure-resource-manager/management/overview.md). Azure tracks this resource as a projection of the customer-managed Kubernetes cluster, not the actual Kubernetes cluster itself. |
47 | | - * Cluster metadata (such as Kubernetes version, agent version, and number of nodes) appearing on the Azure Arc-enabled Kubernetes resource as metadata. |
| 44 | + |
| 45 | + * An Azure Arc-enabled Kubernetes resource in [Azure Resource Manager](../../azure-resource-manager/management/overview.md). Azure tracks this resource as a projection of the customer-managed Kubernetes cluster, not the actual Kubernetes cluster itself. |
| 46 | + * Cluster metadata (such as Kubernetes version, agent version, and number of nodes) appearing on the Azure Arc-enabled Kubernetes resource as metadata. |
48 | 47 |
|
49 | 48 | ## Next steps |
50 | 49 |
|
|
0 commit comments