You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Quickstart: Connect an existing Kubernetes cluster to Azure Arc
13
13
14
-
In this quickstart, you'll learn the benefits of Azure Arc-enabled Kubernetes and how to connect an existing Kubernetes cluster to Azure Arc. For a conceptual look at connecting clusters to Azure Arc, see the [Azure Arc-enabled Kubernetes Agent Architecture article](./conceptual-agent-overview.md).
14
+
Get started with Azure Arc-enabled Kubernetes by using Azure CLI or Azure PowerShell to connect an existing Kubernetes cluster to Azure Arc.
For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enabled Kubernetes agent overview](./conceptual-agent-overview.md).
17
17
18
18
## Prerequisites
19
19
20
20
### [Azure CLI](#tab/azure-cli)
21
21
22
+
* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
23
+
24
+
* A basic understanding of [Kubernetes core concepts](/azure/aks/concepts-clusters-workloads).
25
+
22
26
*[Install or upgrade Azure CLI](/cli/azure/install-azure-cli) to version >= 2.16.0 and <= 2.29.0
23
27
24
28
* Install the **connectedk8s** Azure CLI extension of version >= 1.2.0:
25
29
26
-
```console
30
+
```
27
31
az extension add --name connectedk8s
28
32
```
29
33
30
34
*[Log in to Azure CLI](/cli/azure/authenticate-azure-cli) using the identity (user or service principal) that you want to use for connecting your cluster to Azure Arc.
31
-
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
32
-
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
35
+
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
36
+
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
33
37
34
38
* An up-and-running Kubernetes cluster. If you don't have one, you can create a cluster using one of these options:
35
-
*[Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
36
-
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
37
-
* Self-managed Kubernetes cluster using [Cluster API](https://cluster-api.sigs.k8s.io/user/quick-start.html)
38
-
* If you want to connect a OpenShift cluster to Azure Arc, you need to execute the following command just once on your cluster before running `az connectedk8s connect`:
39
+
*[Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
40
+
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
41
+
* Self-managed Kubernetes cluster using [Cluster API](https://cluster-api.sigs.k8s.io/user/quick-start.html)
42
+
* If you want to connect a OpenShift cluster to Azure Arc, you need to execute the following command just once on your cluster before running `az connectedk8s connect`:
> The cluster needs to have at least one node of operating system and architecture type `linux/amd64`. Clusters with only `linux/arm64` nodes aren't yet supported.
46
50
47
-
* A `kubeconfig` file and context pointing to your cluster.
51
+
* A [kubeconfig file](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) and context pointing to your cluster.
48
52
49
53
### [Azure PowerShell](#tab/azure-powershell)
50
54
55
+
* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
56
+
57
+
* A basic understanding of [Kubernetes core concepts](/azure/aks/concepts-clusters-workloads).
58
+
51
59
*[Azure PowerShell version 5.9.0 or later](/powershell/azure/install-az-ps)
52
60
53
61
* Install the **Az.ConnectedKubernetes** PowerShell module:
@@ -61,23 +69,23 @@ In this quickstart, you'll learn the benefits of Azure Arc-enabled Kubernetes an
61
69
> the `Install-Module` cmdlet.
62
70
63
71
* [Log in to Azure PowerShell](/powershell/azure/authenticate-azureps) using the identity (user or service principal) that you want to use for connecting your cluster to Azure Arc.
64
-
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
65
-
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
72
+
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
73
+
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
66
74
67
75
* An up-and-running Kubernetes cluster. If you don't have one, you can create a cluster using one of these options:
68
-
* [Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
69
-
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
70
-
* Self-managed Kubernetes cluster using [Cluster API](https://cluster-api.sigs.k8s.io/user/quick-start.html)
71
-
* If you want to connect a OpenShift cluster to Azure Arc, you need to execute the following command just once on your cluster before running `New-AzConnectedKubernetes`:
76
+
* [Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
77
+
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
78
+
* Self-managed Kubernetes cluster using [Cluster API](https://cluster-api.sigs.k8s.io/user/quick-start.html)
79
+
* If you want to connect a OpenShift cluster to Azure Arc, you need to execute the following command just once on your cluster before running `New-AzConnectedKubernetes`:
> The cluster needs to have at least one node of operating system and architecture type `linux/amd64`. Clusters with only `linux/arm64` nodes aren't yet supported.
79
87
80
-
* A `kubeconfig` file and context pointing to your cluster.
88
+
* A [kubeconfig file](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) and context pointing to your cluster.
81
89
82
90
* Install [Helm 3](https://helm.sh/docs/intro/install). Ensure that the Helm 3 version is < 3.7.0.
83
91
@@ -100,17 +108,20 @@ In this quickstart, you'll learn the benefits of Azure Arc-enabled Kubernetes an
100
108
|`*.servicebus.windows.net`, `guestnotificationservice.azure.com`, `*.guestnotificationservice.azure.com`, `sts.windows.net` | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
101
109
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
102
110
103
-
## 1. Register providers for Azure Arc-enabled Kubernetes
111
+
## Register providers for Azure Arc-enabled Kubernetes
104
112
105
113
### [Azure CLI](#tab/azure-cli)
106
114
107
115
1. Enter the following commands:
116
+
108
117
```azurecli
109
118
az provider register --namespace Microsoft.Kubernetes
110
119
az provider register --namespace Microsoft.KubernetesConfiguration
111
120
az provider register --namespace Microsoft.ExtendedLocation
112
121
```
113
-
2. Monitor the registration process. Registration may take up to 10 minutes.
122
+
123
+
1. Monitor the registration process. Registration may take up to 10 minutes.
124
+
114
125
```azurecli
115
126
az provider show -n Microsoft.Kubernetes -o table
116
127
az provider show -n Microsoft.KubernetesConfiguration -o table
@@ -122,22 +133,24 @@ In this quickstart, you'll learn the benefits of Azure Arc-enabled Kubernetes an
> If you are logged into Azure CLI using a service principal, an [additional parameter](troubleshooting.md#enable-custom-locations-using-service-principal) needs to be set for enabling the custom location feature on the cluster.
198
+
> If you are logged into Azure CLI using a service principal, an [additional parameter](troubleshooting.md#enable-custom-locations-using-service-principal) needs to be set to enable the custom location feature on the cluster.
> The above command without the location parameter specified creates the Azure Arc-enabled Kubernetes resource in the same location as the resource group. To create the Azure Arc-enabled Kubernetes resource in a different location, specify either `--location <region>` or `-l <region>` when running the `az connectedk8s connect` command.
If your cluster is behind an outbound proxy server, requests must be routed via the outbound proxy server.
242
257
243
258
### [Azure CLI](#tab/azure-cli)
244
259
245
-
If your cluster is behind an outbound proxy server, Azure CLI and the Azure Arc-enabled Kubernetes agents need to route their requests via the outbound proxy server.
246
-
247
260
1. Set the environment variables needed for Azure CLI to use the outbound proxy server:
248
261
249
262
```bash
@@ -258,15 +271,14 @@ If your cluster is behind an outbound proxy server, Azure CLI and the Azure Arc-
>* Some network requests such as the ones involving in-cluster service-to-service communication need to be separated from the traffic that is routed via the proxy server foroutbound communication. The `--proxy-skip-range` parameter can be used to specify the CIDR range and endpointsin a comma-separated way so that any communication from the agents to these endpoints do not go via the outbound proxy. At a minimum, the CIDR range of the services in the cluster should be specified as value forthis parameter. For example, let's say `kubectl get svc -A` returns a list of services where all the services have ClusterIP valuesin the range `10.0.0.0/16`. Then the value to specify for`--proxy-skip-range` is `10.0.0.0/16,kubernetes.default.svc,.svc.cluster.local,.svc`.
263
-
>*`--proxy-http`, `--proxy-https`, and `--proxy-skip-range` are expected for most outbound proxy environments. `--proxy-cert` is *only* required if you need to inject trusted certificates expected by proxy into the trusted certificate store of agent pods.
264
-
>* The outbound proxy has to be configured to allow websocket connections.
274
+
> [!NOTE]
275
+
>
276
+
>* Some network requests such as the ones involving in-cluster service-to-service communication need to be separated from the traffic that is routed via the proxy server foroutbound communication. The `--proxy-skip-range` parameter can be used to specify the CIDR range and endpointsin a comma-separated way so that any communication from the agents to these endpoints do not go via the outbound proxy. At a minimum, the CIDR range of the services in the cluster should be specified as value forthis parameter. For example, let's say `kubectl get svc -A` returns a list of services where all the services have ClusterIP valuesin the range `10.0.0.0/16`. Then the value to specify for`--proxy-skip-range` is `10.0.0.0/16,kubernetes.default.svc,.svc.cluster.local,.svc`.
277
+
>*`--proxy-http`, `--proxy-https`, and `--proxy-skip-range` are expected for most outbound proxy environments. `--proxy-cert` is *only* required if you need to inject trusted certificates expected by proxy into the trusted certificate store of agent pods.
278
+
>* The outbound proxy has to be configured to allow websocket connections.
265
279
266
280
### [Azure PowerShell](#tab/azure-powershell)
267
281
268
-
If your cluster is behind an outbound proxy server, Azure PowerShell and the Azure Arc-enabled Kubernetes agents need to route their requests via the outbound proxy server.
269
-
270
282
1. Set the environment variables needed for Azure PowerShell to use the outbound proxy server:
271
283
272
284
```powershell
@@ -281,9 +293,7 @@ If your cluster is behind an outbound proxy server, Azure PowerShell and the Azu
> After onboarding the cluster, it takes around 5 to 10 minutes forthe cluster metadata (cluster version, agent version, number of nodes, etc.) to surface on the overview page of the Azure Arc-enabled Kubernetes resourcein Azure portal.
320
330
321
331
## 6. View Azure Arc agents for Kubernetes
322
332
323
-
Azure Arc-enabled Kubernetes deploys a few operators into the `azure-arc` namespace.
333
+
Azure Arc-enabled Kubernetes deploys a few agents into the `azure-arc` namespace.
> Deleting the Azure Arc-enabled Kubernetes resource using Azure portal removes any associated configuration resources, but *does not* remove any agents running on the cluster. Best practice is to delete the Azure Arc-enabled Kubernetes resource using `az connectedk8s delete`instead of Azure portal.
384
+
> Deleting the Azure Arc-enabled Kubernetes resource using the Azure portal removes any associated configuration resources, but *does not* remove any agents running on the cluster. Best practice is to delete the Azure Arc-enabled Kubernetes resource using `az connectedk8s delete`rather than deleting the resource in the Azure portal.
> Deleting the Azure Arc-enabled Kubernetes resource using Azure portal removes any associated configuration resources, but *does not* remove any agents running on the cluster. Best practice is to delete the Azure Arc-enabled Kubernetes resource using `Remove-AzConnectedKubernetes` instead of Azure portal.
386
-
387
-
---
395
+
> Deleting the Azure Arc-enabled Kubernetes resource using the Azure portal removes any associated configuration resources, but *does not* remove any agents running on the cluster. Best practice is to delete the Azure Arc-enabled Kubernetes resource using `Remove-AzConnectedKubernetes` rather than deleting the resource in the Azure portal.
0 commit comments