Skip to content

Commit 47d7d94

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #215339 from MGoedtel/bug2001906
Readded deleted AKS article
2 parents 13df9b9 + a28537f commit 47d7d94

File tree

3 files changed

+179
-5
lines changed

3 files changed

+179
-5
lines changed

‎.openpublishing.redirection.json

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -763,11 +763,6 @@
763763
"redirect_url": "/troubleshoot/azure/azure-kubernetes/welcome-azure-kubernetes",
764764
"redirect_document_id": false
765765
},
766-
{
767-
"source_path_from_root": "/articles/aks/node-access.md",
768-
"redirect_url": "/troubleshoot/azure/azure-kubernetes/welcome-azure-kubernetes",
769-
"redirect_document_id": false
770-
},
771766
{
772767
"source_path_from_root": "/articles/aks/troubleshooting.md",
773768
"redirect_url": "/troubleshoot/azure/azure-kubernetes/welcome-azure-kubernetes",

‎articles/aks/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,8 @@
218218
href: node-upgrade-github-actions.md
219219
- name: Process node OS updates
220220
href: node-updates-kured.md
221+
- name: Connect to cluster nodes
222+
href: node-access.md
221223
- name: Create virtual nodes
222224
items:
223225
- name: Use virtual nodes

‎articles/aks/node-access.md

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
---
2+
title: Connect to Azure Kubernetes Service (AKS) cluster nodes
3+
description: Learn how to connect to Azure Kubernetes Service (AKS) cluster nodes for troubleshooting and maintenance tasks.
4+
services: container-service
5+
ms.topic: article
6+
ms.date: 10/20/2022
7+
8+
ms.custom: contperf-fy21q4
9+
10+
#Customer intent: As a cluster operator, I want to learn how to connect to virtual machines in an AKS cluster to perform maintenance or troubleshoot a problem.
11+
---
12+
13+
# Connect to Azure Kubernetes Service (AKS) cluster nodes for maintenance or troubleshooting
14+
15+
Throughout the lifecycle of your Azure Kubernetes Service (AKS) cluster, you may need to access an AKS node. This access could be for maintenance, log collection, or other troubleshooting operations. You can access AKS nodes using SSH, including Windows Server nodes. You can also [connect to Windows Server nodes using remote desktop protocol (RDP) connections][aks-windows-rdp]. For security purposes, the AKS nodes aren't exposed to the internet. To connect to the AKS nodes, you use `kubectl debug` or the private IP address.
16+
17+
This article shows you how to create a connection to an AKS node.
18+
19+
## Before you begin
20+
21+
This article assumes you have an SSH key. If not, you can create an SSH key using [macOS or Linux][ssh-nix] or [Windows][ssh-windows]. If you use PuTTY Gen to create the key pair, save the key pair in an OpenSSH format rather than the default PuTTy private key format (.ppk file).
22+
23+
You also need the Azure CLI version 2.0.64 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
24+
25+
## Create an interactive shell connection to a Linux node
26+
27+
To create an interactive shell connection to a Linux node, use the `kubectl debug` command to run a privileged container on your node. To list your nodes, use the `kubectl get nodes` command:
28+
29+
```bash
30+
kubectl get nodes -o wide
31+
```
32+
33+
The following example resembles output from the command:
34+
35+
```output
36+
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
37+
aks-nodepool1-12345678-vmss000000 Ready agent 13m v1.19.9 10.240.0.4 <none> Ubuntu 18.04.5 LTS 5.4.0-1046-azure containerd://1.4.4+azure
38+
aks-nodepool1-12345678-vmss000001 Ready agent 13m v1.19.9 10.240.0.35 <none> Ubuntu 18.04.5 LTS 5.4.0-1046-azure containerd://1.4.4+azure
39+
aksnpwin000000 Ready agent 87s v1.19.9 10.240.0.67 <none> Windows Server 2019 Datacenter 10.0.17763.1935 docker://19.3.1
40+
```
41+
42+
Us the `kubectl debug` command to run a container image on the node to connect to it.
43+
44+
```bash
45+
kubectl debug node/aks-nodepool1-12345678-vmss000000 -it --image=mcr.microsoft.com/dotnet/runtime-deps:6.0
46+
```
47+
48+
The following command starts a privileged container on your node and connects to it.
49+
50+
```bash
51+
kubectl debug node/aks-nodepool1-12345678-vmss000000 -it --image=mcr.microsoft.com/dotnet/runtime-deps:6.0
52+
```
53+
54+
The following example resembles output from the command:
55+
56+
```output
57+
Creating debugging pod node-debugger-aks-nodepool1-12345678-vmss000000-bkmmx with container debugger on node aks-nodepool1-12345678-vmss000000.
58+
If you don't see a command prompt, try pressing enter.
59+
root@aks-nodepool1-12345678-vmss000000:/#
60+
```
61+
62+
This privileged container gives access to the node.
63+
64+
> [!NOTE]
65+
> You can interact with the node session by running `chroot /host` from the privileged container.
66+
67+
### Remove Linux node access
68+
69+
When done, `exit` the interactive shell session. After the interactive container session closes, delete the pod used for access with `kubectl delete pod`.
70+
71+
```bash
72+
kubectl delete pod node-debugger-aks-nodepool1-12345678-vmss000000-bkmmx
73+
```
74+
75+
## Create the SSH connection to a Windows node
76+
77+
At this time, you can't connect to a Windows Server node directly by using `kubectl debug`. Instead, you need to first connect to another node in the cluster, then connect to the Windows Server node from that node using SSH. Alternatively, you can [connect to Windows Server nodes using remote desktop protocol (RDP) connections][aks-windows-rdp] instead of using SSH.
78+
79+
To connect to another node in the cluster, use the `kubectl debug` command. For more information, see [Create an interactive shell connection to a Linux node][ssh-linux-kubectl-debug].
80+
81+
To create the SSH connection to the Windows Server node from another node, use the SSH keys provided when you created the AKS cluster and the internal IP address of the Windows Server node.
82+
83+
Open a new terminal window and use the `kubectl get pods` command to get the name of the pod started by `kubectl debug`.
84+
85+
```bash
86+
kubectl get pods
87+
```
88+
89+
The following example resembles output from the command:
90+
91+
```output
92+
NAME READY STATUS RESTARTS AGE
93+
node-debugger-aks-nodepool1-12345678-vmss000000-bkmmx 1/1 Running 0 21s
94+
```
95+
96+
In the above example, *node-debugger-aks-nodepool1-12345678-vmss000000-bkmmx* is the name of the pod started by `kubectl debug`.
97+
98+
Use the `kubectl port-forward` command to open a connection to the deployed pod:
99+
100+
```bash
101+
kubectl port-forward node-debugger-aks-nodepool1-12345678-vmss000000-bkmmx 2022:22
102+
```
103+
104+
The following example resembles output from the command:
105+
106+
```output
107+
Forwarding from 127.0.0.1:2022 -> 22
108+
Forwarding from [::1]:2022 -> 22
109+
```
110+
111+
The above example begins forwarding network traffic from port 2022 on your development computer to port 22 on the deployed pod. When using `kubectl port-forward` to open a connection and forward network traffic, the connection remains open until you stop the `kubectl port-forward` command.
112+
113+
Open a new terminal and run the command `kubectl get nodes` to show the internal IP address of the Windows Server node:
114+
115+
```bash
116+
kubectl get nodes -o wide
117+
```
118+
119+
The following example resembles output from the command:
120+
121+
```output
122+
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
123+
aks-nodepool1-12345678-vmss000000 Ready agent 13m v1.19.9 10.240.0.4 <none> Ubuntu 18.04.5 LTS 5.4.0-1046-azure containerd://1.4.4+azure
124+
aks-nodepool1-12345678-vmss000001 Ready agent 13m v1.19.9 10.240.0.35 <none> Ubuntu 18.04.5 LTS 5.4.0-1046-azure containerd://1.4.4+azure
125+
aksnpwin000000 Ready agent 87s v1.19.9 10.240.0.67 <none> Windows Server 2019 Datacenter 10.0.17763.1935 docker://19.3.1
126+
```
127+
128+
In the above example, *10.240.0.67* is the internal IP address of the Windows Server node.
129+
130+
Create an SSH connection to the Windows Server node using the internal IP address, and connect to port 22 through port 2022 on your development computer. The default username for AKS nodes is *azureuser*. Accept the prompt to continue with the connection. You are then provided with the bash prompt of your Windows Server node:
131+
132+
```bash
133+
ssh -o 'ProxyCommand ssh -p 2022 -W %h:%p [email protected]' [email protected]
134+
```
135+
136+
The following example resembles output from the command:
137+
138+
```output
139+
The authenticity of host '10.240.0.67 (10.240.0.67)' can't be established.
140+
ECDSA key fingerprint is SHA256:1234567890abcdefghijklmnopqrstuvwxyzABCDEFG.
141+
Are you sure you want to continue connecting (yes/no)? yes
142+
143+
[...]
144+
145+
Microsoft Windows [Version 10.0.17763.1935]
146+
(c) 2018 Microsoft Corporation. All rights reserved.
147+
148+
azureuser@aksnpwin000000 C:\Users\azureuser>
149+
```
150+
151+
> [!NOTE]
152+
> If you prefer to use password authentication, include the parameter `-o PreferredAuthentications=password`. For example:
153+
>
154+
> ```console
155+
> ssh -o 'ProxyCommand ssh -p 2022 -W %h:%p [email protected]' -o PreferredAuthentications=password [email protected]
156+
> ```
157+
158+
### Remove SSH access
159+
160+
When done, `exit` the SSH session, stop any port forwarding, and then `exit` the interactive container session. After the interactive container session closes, delete the pod used for SSH access using the `kubectl delete pod` command.
161+
162+
```bash
163+
kubectl delete pod node-debugger-aks-nodepool1-12345678-vmss000000-bkmmx
164+
```
165+
166+
## Next steps
167+
168+
If you need more troubleshooting data, you can [view the kubelet logs][view-kubelet-logs] or [view the Kubernetes master node logs][view-master-logs].
169+
170+
<!-- INTERNAL LINKS -->
171+
[view-kubelet-logs]: kubelet-logs.md
172+
[view-master-logs]: monitor-aks-reference.md#resource-logs
173+
[install-azure-cli]: /cli/azure/install-azure-cli
174+
[aks-windows-rdp]: rdp.md
175+
[ssh-nix]: ../virtual-machines/linux/mac-create-ssh-keys.md
176+
[ssh-windows]: ../virtual-machines/linux/ssh-from-windows.md
177+
[ssh-linux-kubectl-debug]: #create-an-interactive-shell-connection-to-a-linux-node

0 commit comments

Comments
 (0)