Skip to content

Commit 4a6d52f

Browse files
Update L4 steps
1 parent 5725ee6 commit 4a6d52f

File tree

1 file changed

+104
-62
lines changed

1 file changed

+104
-62
lines changed

articles/iot-operations/manage-layered-network/howto-configure-l4-cluster-layered-network.md

Lines changed: 104 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ ms.service: azure-iot-operations
1616

1717
[!INCLUDE [public-preview-note](../includes/public-preview-note.md)]
1818

19-
Azure IoT Layered Network Management Preview is one of the Azure IoT Operations Preview components. However, it can be deployed individually to the top network layer for supporting the Azure IoT Operations in the lower layer. In the top level of your network layers (usually level 4 of the ISA-95 network architecture), the cluster and Layered Network Management service have direct internet access. Once the setup is completed, the Layered Network Management service is ready for receiving network traffic from the child layer and forwards it to Azure Arc.
19+
Azure IoT Layered Network Management Preview is a component to support Azure IoT Operations Preview. However, it needs to be deployed individually to the top network layer for supporting the Azure IoT Operations in the lower layer. In the top level of your network layers (usually level 4 of the ISA-95 network architecture), the cluster and Layered Network Management service have direct internet access. Once the setup is completed, the Layered Network Management service is ready for receiving network traffic from the child layer and forwards it to Azure Arc.
2020

2121
## Prerequisites
2222
Meet the following minimum requirements for deploying the Layered Network Management individually on the system.
@@ -50,7 +50,6 @@ The following steps for setting up [AKS Edge Essentials](/azure/aks/hybrid/aks-e
5050
az extension add --name k8s-extension
5151
```
5252

53-
- [Install Azure CLI extension](/cli/azure/iot/ops) using `az extension add --name azure-iot-ops`.
5453

5554
## Create the K3S cluster
5655

@@ -60,6 +59,8 @@ The following steps for setting up [AKS Edge Essentials](/azure/aks/hybrid/aks-e
6059
curl -sfL https://get.k3s.io | sh -s - --disable=traefik --write-kubeconfig-mode 644
6160
```
6261

62+
Refer to the [K3s quick-start guide](https://docs.k3s.io/quick-start) for more detail.
63+
6364
> [!IMPORTANT]
6465
> Be sure to use the `--disable=traefik` parameter to disable treafik. Otherwise, you might have an issue when you try to allocate public IP for the Layered Network Management service in later steps.
6566

@@ -78,64 +79,47 @@ The following steps for setting up [AKS Edge Essentials](/azure/aks/hybrid/aks-e
7879

7980
# [AKS Edge Essentials](#tab/aksee)
8081

81-
## Prepare Windows 11
82-
83-
1. Install [Windows 11](https://www.microsoft.com/software-download/windows11) on your device.
84-
1. Install [Helm](https://helm.sh/docs/intro/install/) 3.8.0 or later.
85-
1. Install [Kubectl](https://kubernetes.io/docs/tasks/tools/).
86-
1. Install AKS Edge Essentials. Follow the steps in [Prepare your machines for AKS Edge Essentials](/azure/aks/hybrid/aks-edge-howto-setup-machine).
87-
1. Install Azure CLI. Follow the steps in [Install Azure CLI on Windows](/cli/azure/install-azure-cli-windows).
88-
1. Install connectedk8s using the following command:
89-
90-
```bash
91-
az extension add --name connectedk8s
92-
az extension add --name k8s-extension
93-
```
94-
95-
1. [Install Azure CLI extension](/cli/azure/iot/ops) using `az extension add --name azure-iot-ops`.
82+
For hosting the Layered Network Management service, you need a single machine deployment of AKS Edge Essentials. You can follow the AKS Edge Essentials documentation to create your cluster with default confiurations.
9683

97-
## Create the AKS Edge Essentials cluster
84+
## Prepare Windows 11
9885

99-
1. Verify you meet the [Prerequisites](/azure/aks/hybrid/aks-edge-quickstart#prerequisites) section of the AKS Edge Essentials quickstart.
100-
1. Follow the [Prepare your machines for AKS Edge Essentials](/azure/aks/hybrid/aks-edge-howto-setup-machine) steps to install AKS Edge Essentials on your Windows 11 machine.
101-
1. Follow the steps in the [Single machine deployment](/azure/aks/hybrid/aks-edge-howto-single-node-deployment) article.
102-
Use the *New-AksEdgeDeployment* PowerShell command to create a file named **aks-ee-config.json**, make the following modifications:
103-
- In the **Init** section, change the **ServiceIPRangeSize** property to **10**.
86+
1. Follow the steps in [Prepare your machines for AKS Edge Essentials](/azure/aks/hybrid/aks-edge-howto-setup-machine) to setup your Windows machine.
10487

105-
```json
106-
"Init": {
107-
"ServiceIPRangeSize": 10
108-
},
88+
1. In addition, you need to install the Azure CLI and extensions for later steps.
89+
1. Install Azure CLI. Follow the steps in [Install Azure CLI on Windows](/cli/azure/install-azure-cli-windows).
90+
1. Install connectedk8s using the following command:
91+
```bash
92+
az extension add --name connectedk8s
93+
az extension add --name k8s-extension
10994
```
11095

111-
- In the **Network** section, verify the following properties are added or set. Replace the placeholder text with your values. Confirm that the *Ip4AddressPrefix* **A.B.C** doesn't overlap with the IP range that is assigned within network layers.
112-
113-
```json
114-
"Network": {
115-
"NetworkPlugin": "flannel",
116-
"Ip4AddressPrefix": "<A.B.C.0/24>",
117-
"Ip4PrefixLength": 24,
118-
"InternetDisabled": false,
119-
"SkipDnsCheck": false,
120-
```
96+
## Create the AKS Edge Essentials cluster
12197

122-
For more information about deployment configurations, see [Deployment configuration JSON parameters](/azure/aks/hybrid/aks-edge-deployment-config-json).
98+
Follow the steps in [Single machine deployment](/azure/aks/hybrid/aks-edge-howto-single-node-deployment) to create your cluster.
99+
1. You need to complete step 1-3 in this document.
100+
1. In **aksedge-config.json** from step 1, you only need to make the following adjustment for Layered Network Management. You can keep the default value for the rest of the parameters. Otherwise, make proper adjustments based on your environment.
101+
```json
102+
"Init": {
103+
"ServiceIPRangeSize": 10
104+
},
105+
```
123106

124107
---
125108

126109
## Arc enable the cluster
127110

111+
# [K3S Cluster](#tab/k3s)
112+
128113
1. Sign in with Azure CLI. To avoid permission issues later, it's important that you sign in interactively using a browser window:
129114
```powershell
130115
az login
131116
```
132-
1. Set environment variables for the setup steps. Replace values in `<>` with valid values or names of your choice. The `CLUSTER_NAME` and `RESOURCE_GROUP` are created based on the names you provide:
117+
1. Set environment variables for the setup steps. Replace values in `<>` with valid values or names of your choice. The `CLUSTER_NAME` and `RESOURCE_GROUP` are created based on the names you provide. Refer to [Azure IoT Operations supported regions](../iot-operations/overview-iot-operations#supported-regions) for choosing the `LOCATION`.
133118
```powershell
134119
# Id of the subscription where your resource group and Arc-enabled cluster will be created
135120
$SUBSCRIPTION_ID = "<subscription-id>"
136121
# Azure region where the created resource group will be located
137-
# Currently supported regions: : "westus3" or "eastus2"
138-
$LOCATION = "WestUS3"
122+
$LOCATION = "<region>"
139123
# Name of a new resource group to create which will hold the Arc-enabled cluster and Azure IoT Operations resources
140124
$RESOURCE_GROUP = "<resource-group-name>"
141125
# Name of the Arc-enabled cluster to create in your resource group
@@ -166,8 +150,12 @@ The following steps for setting up [AKS Edge Essentials](/azure/aks/hybrid/aks-e
166150
```powershell
167151
az connectedk8s connect -n $CLUSTER_NAME -l $LOCATION -g $RESOURCE_GROUP --subscription $SUBSCRIPTION_ID
168152
```
169-
> [!TIP]
170-
> If the `connectedk8s` commands fail, try using the cmdlets in [Connect your AKS Edge Essentials cluster to Arc](/azure/aks/hybrid/aks-edge-howto-connect-to-arc).
153+
154+
# [AKS Edge Essentials](#tab/aksee)
155+
156+
- Follow the steps in [Connect your AKS Edge Essentials cluster to Arc](/azure/aks/hybrid/aks-edge-howto-connect-to-arc).
157+
- You need to complete step 1-3 in this document.
158+
---
171159
172160
## Deploy Layered Network Management Preview Service to the cluster
173161
@@ -186,7 +174,7 @@ Once your Kubernetes cluster is Arc-enabled, you can deploy the Layered Network
186174
1. Use the *kubectl* command to verify the Layered Network Management operator is running.
187175
188176
```bash
189-
kubectl get pods -n azure-iot-operations
177+
kubectl get pods
190178
```
191179
192180
```output
@@ -218,43 +206,97 @@ Create the Layered Network Management custom resource.
218206
allowList:
219207
enableArcDomains: true
220208
domains:
221-
- destinationUrl: "*.ods.opinsights.azure.com"
209+
- destinationUrl: "*.arc.azure.net"
222210
destinationType: external
223-
- destinationUrl: "*.oms.opinsights.azure.com"
211+
- destinationUrl: "*.data.mcr.microsoft.com"
224212
destinationType: external
225-
- destinationUrl: "*.monitoring.azure.com"
213+
- destinationUrl: "*.dp.kubernetesconfiguration.azure.com"
226214
destinationType: external
227-
- destinationUrl: "*.handler.control.monitor.azure.com"
215+
- destinationUrl: "*.guestnotificationservice.azure.com"
228216
destinationType: external
229-
- destinationUrl: "quay.io"
217+
- destinationUrl: "*.his.arc.azure.com"
230218
destinationType: external
231-
- destinationUrl: "*.quay.io"
219+
- destinationUrl: "*.login.microsoft.com"
232220
destinationType: external
233-
- destinationUrl: "docker.io"
221+
- destinationUrl: "*.login.microsoftonline.com"
234222
destinationType: external
235-
- destinationUrl: "*.docker.io"
223+
- destinationUrl: "*.obo.arc.azure.com"
236224
destinationType: external
237-
- destinationUrl: "*.docker.com"
225+
- destinationUrl: "*.servicebus.windows.net"
238226
destinationType: external
239-
- destinationUrl: "gcr.io"
240-
destinationType: external
241-
- destinationUrl: "*.googleapis.com"
227+
- destinationUrl: "graph.microsoft.com"
242228
destinationType: external
243229
- destinationUrl: "login.windows.net"
244230
destinationType: external
231+
- destinationUrl: "management.azure.com"
232+
destinationType: external
233+
- destinationUrl: "mcr.microsoft.com"
234+
destinationType: external
235+
- destinationUrl: "sts.windows.net"
236+
destinationType: external
237+
- destinationUrl: "*.ods.opinsights.azure.com"
238+
destinationType: external
245239
- destinationUrl: "graph.windows.net"
246240
destinationType: external
247241
- destinationUrl: "msit-onelake.pbidedicated.windows.net"
248242
destinationType: external
249-
- destinationUrl: "*.vault.azure.net"
243+
- destinationUrl: "*.azurecr.io"
244+
destinationType: external
245+
- destinationUrl: "*.azureedge.net"
246+
destinationType: external
247+
- destinationUrl: "*.blob.core.windows.net"
248+
destinationType: external
249+
- destinationUrl: "*.prod.hot.ingestion.msftcloudes.com"
250+
destinationType: external
251+
- destinationUrl: "*.prod.microsoftmetrics.com"
252+
destinationType: external
253+
- destinationUrl: "adhs.events.data.microsoft.com"
254+
destinationType: external
255+
- destinationUrl: "dc.services.visualstudio.com"
256+
destinationType: external
257+
- destinationUrl: "go.microsoft.com"
258+
destinationType: external
259+
- destinationUrl: "packages.microsoft.com"
260+
destinationType: external
261+
- destinationUrl: "www.powershellgallery.com"
262+
destinationType: external
263+
- destinationUrl: "*.gw.arc.azure.com"
264+
destinationType: external
265+
- destinationUrl: "*.gcs.prod.monitoring.core.windows.net"
266+
destinationType: external
267+
- destinationUrl: "*.prod.warm.ingest.monitor.core.windows.net"
250268
destinationType: external
251-
- destinationUrl: "*.k8s.io"
269+
- destinationUrl: "*.prod.hot.ingest.monitor.core.windows.net"
252270
destinationType: external
253-
- destinationUrl: "*.pkg.dev"
271+
- destinationUrl: "azure.archive.ubuntu.com"
272+
destinationType: external
273+
- destinationUrl: "crl.microsoft.com"
274+
destinationType: external
275+
- destinationUrl: "*.table.core.windows.net"
276+
destinationType: external
277+
- destinationUrl: "*.blob.storage.azure.net"
278+
destinationType: external
279+
- destinationUrl: "*.docker.com"
280+
destinationType: external
281+
- destinationUrl: "*.docker.io"
282+
destinationType: external
283+
- destinationUrl: "*.googleapis.com"
254284
destinationType: external
255285
- destinationUrl: "github.com"
256286
destinationType: external
257-
- destinationUrl: "raw.githubusercontent.com"
287+
- destinationUrl: "collect.traefik.io"
288+
destinationType: external
289+
- destinationUrl: "contracts.canonical.com"
290+
destinationType: external
291+
- destinationUrl: "database.clamav.net"
292+
destinationType: external
293+
- destinationUrl: "esm.ubuntu.com"
294+
destinationType: external
295+
- destinationUrl: "livepatch.canonical.com"
296+
destinationType: external
297+
- destinationUrl: "motd.ubuntu.com"
298+
destinationType: external
299+
- destinationUrl: "update.traefik.io"
258300
destinationType: external
259301
sourceIpRange:
260302
- addressPrefix: "0.0.0.0"
@@ -280,10 +322,10 @@ Create the Layered Network Management custom resource.
280322
lnm-level-4 LoadBalancer 10.43.91.54 192.168.0.4 80:30530/TCP,443:31117/TCP,10000:31914/TCP 95s
281323
```
282324
283-
### Add iptables configuration
325+
### Add iptables configuration for AKS Edge Essentials
284326
285327
> [!IMPORTANT]
286-
> This step is for AKS Edge Essentials only.
328+
> This step is applicable only when hosting the Layered Network Management in an AKS Edge Essentials cluster.
287329
288330
The Layered Network Management deployment creates a Kubernetes service of type *LoadBalancer*. To ensure that the service is accessible from outside the Kubernetes cluster, you need to map the underlying Windows host's ports to the appropriate ports on the Layered Network Management service.
289331

0 commit comments

Comments
 (0)