You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/node-access.md
+65-82Lines changed: 65 additions & 82 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: Connect to Azure Kubernetes Service (AKS) cluster nodes
3
3
description: Learn how to connect to Azure Kubernetes Service (AKS) cluster nodes for troubleshooting and maintenance tasks.
4
4
ms.topic: article
5
-
ms.date: 10/04/2023
5
+
ms.date: 12/20/2023
6
6
ms.reviewer: mattmcinnes
7
7
ms.custom: contperf-fy21q4, devx-track-linux
8
8
#Customer intent: As a cluster operator, I want to learn how to connect to virtual machines in an AKS cluster to perform maintenance or troubleshoot a problem.
@@ -16,11 +16,11 @@ This article shows you how to create a connection to an AKS node and update the
16
16
17
17
## Before you begin
18
18
19
-
* You have an SSH key. If you don't, you can create an SSH key using [macOS or Linux][ssh-nix] or [Windows][ssh-windows]. Save the key pair in an OpenSSH format, other formats like `.ppk` aren't supported.
19
+
This article assumes you have an SSH key. If not, you can create an SSH key using [macOS or Linux][ssh-nix] or [Windows][ssh-windows], to know more refer [Manage SSH configuration][manage-ssh-node-access]. Make sure you save the key pair in an OpenSSH format, other formats like .ppk aren't supported.
20
20
21
-
* The Azure CLI version 2.0.64 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
21
+
You also need the Azure CLI version 2.0.64 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
22
22
23
-
## Create an interactive shell connection to a Linux node
23
+
## Create an interactive shell connection to a Linux node using kubectl
24
24
25
25
To create an interactive shell connection to a Linux node, use the `kubectl debug` command to run a privileged container on your node.
26
26
@@ -29,20 +29,20 @@ To create an interactive shell connection to a Linux node, use the `kubectl debu
29
29
```bash
30
30
kubectl get nodes -o wide
31
31
```
32
-
32
+
33
33
The following example resembles output from the command:
34
-
34
+
35
35
```output
36
-
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
aksnpwin000000 Ready agent 160m v1.25.6 10.224.0.62 <none> Windows Server 2022 Datacenter
40
40
```
41
41
42
42
2. Use the `kubectl debug`command to run a container image on the node to connect to it. The following command starts a privileged container on your node and connects to it.
The following example resembles output from the command:
@@ -52,31 +52,70 @@ To create an interactive shell connection to a Linux node, use the `kubectl debu
52
52
If you don't see a command prompt, try pressing enter.
53
53
root@aks-nodepool1-37663765-vmss000000:/#
54
54
```
55
-
55
+
56
56
This privileged container gives access to the node.
57
-
57
+
58
58
> [!NOTE]
59
59
> You can interact with the node session by running `chroot /host` from the privileged container.
60
60
61
61
### Remove Linux node access
62
62
63
-
When you are done with a debugging pod, enter the `exit` command to end the interactive shell session. After the interactive container session closes, delete the pod used for access with `kubectl delete pod`.
63
+
When you'redone with a debugging pod, enter the `exit`command to end the interactive shell session. After the interactive container session closes, delete the pod used for access with `kubectl delete pod`.
64
64
65
65
```bash
66
66
kubectl delete pod node-debugger-aks-nodepool1-37663765-vmss000000-bkmmx
67
67
```
68
+
## Create an interactive shell connection to a node using private IP
69
+
70
+
If you don't have access to the Kubernetes API, you can get access to properties such as ```Node IP``` and ```Node Name``` through the AKS Agentpool Preview API(preview version 07-02-2023 or above) to troubleshoot node-specific issues in your AKS node pools. For convenience, we also expose the public IP if the node has a public IP assigned. However in order to SSH into the node, you need to be in the cluster's virtual network.
71
+
72
+
1. To get the private IP via CLI, use az cli version 2.53 or above with aks-preview extension installed.
73
+
74
+
```bash
75
+
az aks machine list --resource-group myResourceGroup --cluster-name myAKSCluster --nodepool-name nodepool1 -o table
76
+
77
+
```
78
+
79
+
The following example resembles output from the command:
2. Use the private IP to SSH into the node. [Azure Bastion][azure-bastion] also provides you with information for securely connecting to virtual machines via private IP address. Make sure that you configure an Azure Bastion host for the virtual network in which the VM resides.
Currently, you can't connect to a Windows Server node directly by using `kubectl debug`. Instead, you need to first connect to another node in the cluster, and then connect to the Windows Server node from that node using SSH. Alternatively, you can [connect to Windows Server nodes using remote desktop protocol (RDP) connections][aks-windows-rdp] instead of using SSH.
110
+
At this time, you can't connect to a Windows Server node directly by using `kubectl debug`. Instead, you need to first connect to another node in the cluster, then connect to the Windows Server node from that node using SSH. Alternatively, you can [connect to Windows Server nodes using remote desktop protocol (RDP) connections][aks-windows-rdp] instead of using SSH or use SSH with 'machines API' presented at the start of this document.
72
111
73
-
To connect to another node in the cluster, use the `kubectl debug` command. For more information, see [Create an interactive shell connection to a Linux node][ssh-linux-kubectl-debug].
112
+
To connect to another node in the cluster, use the `kubectl debug` command. For more information, see the Linux section.
74
113
75
114
To create the SSH connection to the Windows Server node from another node, use the SSH keys provided when you created the AKS cluster and the internal IP address of the Windows Server node.
76
115
77
116
> [!IMPORTANT]
78
117
>
79
-
> The following steps for creating the SSH connection to the Windows Server node from another node can only be used if you created your AKS cluster using the Azure CLI and the `--generate-ssh-keys` parameter. If you didn't use this method to create your cluster, use a password instead of an SSH key. To do this, see [Create the SSH connection to a Windows node using a password](#create-the-ssh-connection-to-a-windows-node-using-a-password)
118
+
> The following steps for creating the SSH connection to the Windows Server node from another node can only be used if you created your AKS cluster using the Azure CLI and the `--generate-ssh-keys` parameter. AKS Update command can also be used to manage, create SSH keys on an existing AKS cluster. For more information refer [Manage SSH configuration][manage-ssh-node-access].
80
119
81
120
1. Open a new terminal window and use the `kubectl get pods` command to get the name of the pod started by `kubectl debug`.
82
121
@@ -111,17 +150,14 @@ To create the SSH connection to the Windows Server node from another node, use t
111
150
3. Open a new terminal and run the command`kubectl get nodes` to show the internal IP address of the Windows Server node:
112
151
113
152
```bash
114
-
kubectl get nodes -o wide
153
+
kubectl get no -o custom-columns=NAME:metadata.name,'INTERNAL_IP:status.addresses[?(@.type == \"InternalIP\")].address'
115
154
```
116
155
117
156
The following example resembles output from the command:
118
157
119
158
```output
120
-
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE
### Create the SSH connection to a Windows node using a password
158
-
159
-
If you didn't create your AKS cluster using the Azure CLI and the `--generate-ssh-keys` parameter, you'll use a password instead of an SSH key to create the SSH connection. To do this with Azure CLI, perform the following steps. Replace `<nodeRG>` with a resource group name and `<vmssName>` with the scale set name in that resource group.
160
-
161
-
1. Create a root user called `azureuser`.
162
-
163
-
```azurecli
164
-
az vmss update -g <nodeRG> -n <vmssName> --set virtualMachineProfile.osProfile.adminUsername=azureuser
165
-
```
166
-
167
-
2. Create a password for the new root user.
168
-
169
-
```azurecli
170
-
az vmss update -g <nodeRG> -n <vmssName> --set virtualMachineProfile.osProfile.adminPassword=<new password>
171
-
```
172
-
173
-
3. Update the instances to use the above changes.
174
-
175
-
```azurecli
176
-
az vmss update-instances -g <nodeRG> -n <vmssName> --instance-ids '*'
177
-
```
178
-
179
-
4. Reimage the affected nodes so you can connect using your new credentials.
180
-
181
-
```azurecli
182
-
az vmss reimage -g <nodeRG> -n <vmssName> --instance-id <affectedNodeInstanceId>
183
-
```
184
-
185
-
5. Use `kubectl debug` to connect to another node.
6. Open a second terminal to use port forwarding to connect the debug pod to your local computer.
192
-
193
-
```azurecli
194
-
kubectl port-forward <debugPodName> 2022:22
195
-
```
196
-
197
-
7. Open a third terminal to get the IP address of the affected node to initiate the SSH connection. You can get this IP address with `kubectl get nodes -o wide`. The IP address is listed in the **INTERNAL-IP** column. After you have it, use the following command to connect:
When done, `exit` the SSH session, stop any port forwarding, and then `exit` the interactive container session. After the interactive container session closes, delete the pod used for SSH access using the `kubectl delete pod` command.
208
-
209
-
```bash
210
-
kubectl delete pod node-debugger-aks-nodepool1-37663765-vmss000000-bkmmx
211
-
```
212
-
213
193
## Next steps
214
194
215
-
* To help troubleshoot any issues with SSH connectivity to your clusters nodes, you can [view the kubelet logs][view-kubelet-logs] or [view the Kubernetes master node logs][view-master-logs].
216
-
* See [Manage SSH configuration][manage-ssh-node-access] to learn about managing the SSH key on an AKS cluster or node pools.
195
+
If you need more troubleshooting data, you can [view the kubelet logs][view-kubelet-logs] or [view the Kubernetes master node logs][view-master-logs].
196
+
197
+
See [Manage SSH configuration][manage-ssh-node-access] to learn about managing the SSH key on an AKS cluster or node pools.
0 commit comments