Skip to content

Commit d4c6dd5

Browse files
committed
update prereqs and formatting
1 parent 3efe47b commit d4c6dd5

File tree

1 file changed

+72
-64
lines changed

1 file changed

+72
-64
lines changed

articles/azure-arc/kubernetes/quickstart-connect-cluster.md

Lines changed: 72 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,61 @@
11
---
2-
title: 'Quickstart: Connect an existing Kubernetes cluster to Azure Arc'
3-
description: "In this quickstart, learn how to connect an Azure Arc-enabled Kubernetes cluster."
2+
title: Quickstart: Connect an existing Kubernetes cluster to Azure Arc
3+
description: In this quickstart, you learn how to connect an Azure Arc-enabled Kubernetes cluster.
44
ms.service: azure-arc
55
ms.topic: quickstart
6-
ms.date: 09/09/2021
6+
ms.date: 02/16/2022
77
ms.custom: template-quickstart, mode-other, devx-track-azurecli
88
ms.devlang: azurecli
99
keywords: "Kubernetes, Arc, Azure, cluster"
1010
---
1111

1212
# Quickstart: Connect an existing Kubernetes cluster to Azure Arc
1313

14-
In this quickstart, you'll learn the benefits of Azure Arc-enabled Kubernetes and how to connect an existing Kubernetes cluster to Azure Arc. For a conceptual look at connecting clusters to Azure Arc, see the [Azure Arc-enabled Kubernetes Agent Architecture article](./conceptual-agent-overview.md).
14+
Get started with Azure Arc-enabled Kubernetes by using Azure CLI or Azure PowerShell to connect an existing Kubernetes cluster to Azure Arc.
1515

16-
[!INCLUDE [quickstarts-free-trial-note](../../../includes/quickstarts-free-trial-note.md)]
16+
For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enabled Kubernetes agent overview](./conceptual-agent-overview.md).
1717

1818
## Prerequisites
1919

2020
### [Azure CLI](#tab/azure-cli)
2121

22+
* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
23+
24+
* A basic understanding of [Kubernetes core concepts](/azure/aks/concepts-clusters-workloads).
25+
2226
* [Install or upgrade Azure CLI](/cli/azure/install-azure-cli) to version >= 2.16.0 and <= 2.29.0
2327

2428
* Install the **connectedk8s** Azure CLI extension of version >= 1.2.0:
2529

26-
```console
30+
```
2731
az extension add --name connectedk8s
2832
```
2933

3034
* [Log in to Azure CLI](/cli/azure/authenticate-azure-cli) using the identity (user or service principal) that you want to use for connecting your cluster to Azure Arc.
31-
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
32-
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
35+
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
36+
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
3337

3438
* An up-and-running Kubernetes cluster. If you don't have one, you can create a cluster using one of these options:
35-
* [Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
36-
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
37-
* Self-managed Kubernetes cluster using [Cluster API](https://cluster-api.sigs.k8s.io/user/quick-start.html)
38-
* If you want to connect a OpenShift cluster to Azure Arc, you need to execute the following command just once on your cluster before running `az connectedk8s connect`:
39+
* [Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
40+
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
41+
* Self-managed Kubernetes cluster using [Cluster API](https://cluster-api.sigs.k8s.io/user/quick-start.html)
42+
* If you want to connect a OpenShift cluster to Azure Arc, you need to execute the following command just once on your cluster before running `az connectedk8s connect`:
3943

40-
```console
44+
```
4145
oc adm policy add-scc-to-user privileged system:serviceaccount:azure-arc:azure-arc-kube-aad-proxy-sa
4246
```
4347

4448
>[!NOTE]
4549
> The cluster needs to have at least one node of operating system and architecture type `linux/amd64`. Clusters with only `linux/arm64` nodes aren't yet supported.
4650
47-
* A `kubeconfig` file and context pointing to your cluster.
51+
* A [kubeconfig file](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) and context pointing to your cluster.
4852

4953
### [Azure PowerShell](#tab/azure-powershell)
5054

55+
* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
56+
57+
* A basic understanding of [Kubernetes core concepts](/azure/aks/concepts-clusters-workloads).
58+
5159
* [Azure PowerShell version 5.9.0 or later](/powershell/azure/install-az-ps)
5260

5361
* Install the **Az.ConnectedKubernetes** PowerShell module:
@@ -61,23 +69,23 @@ In this quickstart, you'll learn the benefits of Azure Arc-enabled Kubernetes an
6169
> the `Install-Module` cmdlet.
6270
6371
* [Log in to Azure PowerShell](/powershell/azure/authenticate-azureps) using the identity (user or service principal) that you want to use for connecting your cluster to Azure Arc.
64-
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
65-
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
72+
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
73+
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
6674
6775
* An up-and-running Kubernetes cluster. If you don't have one, you can create a cluster using one of these options:
68-
* [Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
69-
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
70-
* Self-managed Kubernetes cluster using [Cluster API](https://cluster-api.sigs.k8s.io/user/quick-start.html)
71-
* If you want to connect a OpenShift cluster to Azure Arc, you need to execute the following command just once on your cluster before running `New-AzConnectedKubernetes`:
76+
* [Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
77+
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
78+
* Self-managed Kubernetes cluster using [Cluster API](https://cluster-api.sigs.k8s.io/user/quick-start.html)
79+
* If you want to connect a OpenShift cluster to Azure Arc, you need to execute the following command just once on your cluster before running `New-AzConnectedKubernetes`:
7280
73-
```console
81+
```
7482
oc adm policy add-scc-to-user privileged system:serviceaccount:azure-arc:azure-arc-kube-aad-proxy-sa
7583
```
7684
7785
>[!NOTE]
7886
> The cluster needs to have at least one node of operating system and architecture type `linux/amd64`. Clusters with only `linux/arm64` nodes aren't yet supported.
7987
80-
* A `kubeconfig` file and context pointing to your cluster.
88+
* A [kubeconfig file](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) and context pointing to your cluster.
8189
8290
* Install [Helm 3](https://helm.sh/docs/intro/install). Ensure that the Helm 3 version is &lt; 3.7.0.
8391
@@ -100,17 +108,20 @@ In this quickstart, you'll learn the benefits of Azure Arc-enabled Kubernetes an
100108
|`*.servicebus.windows.net`, `guestnotificationservice.azure.com`, `*.guestnotificationservice.azure.com`, `sts.windows.net` | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
101109
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
102110
103-
## 1. Register providers for Azure Arc-enabled Kubernetes
111+
## Register providers for Azure Arc-enabled Kubernetes
104112
105113
### [Azure CLI](#tab/azure-cli)
106114
107115
1. Enter the following commands:
116+
108117
```azurecli
109118
az provider register --namespace Microsoft.Kubernetes
110119
az provider register --namespace Microsoft.KubernetesConfiguration
111120
az provider register --namespace Microsoft.ExtendedLocation
112121
```
113-
2. Monitor the registration process. Registration may take up to 10 minutes.
122+
123+
1. Monitor the registration process. Registration may take up to 10 minutes.
124+
114125
```azurecli
115126
az provider show -n Microsoft.Kubernetes -o table
116127
az provider show -n Microsoft.KubernetesConfiguration -o table
@@ -122,22 +133,24 @@ In this quickstart, you'll learn the benefits of Azure Arc-enabled Kubernetes an
122133
### [Azure PowerShell](#tab/azure-powershell)
123134
124135
1. Enter the following commands:
136+
125137
```azurepowershell
126138
Register-AzResourceProvider -ProviderNamespace Microsoft.Kubernetes
127139
Register-AzResourceProvider -ProviderNamespace Microsoft.KubernetesConfiguration
128140
Register-AzResourceProvider -ProviderNamespace Microsoft.ExtendedLocation
129141
```
142+
130143
1. Monitor the registration process. Registration may take up to 10 minutes.
144+
131145
```azurepowershell
132146
Get-AzResourceProvider -ProviderNamespace Microsoft.Kubernetes
133147
Get-AzResourceProvider -ProviderNamespace Microsoft.KubernetesConfiguration
134148
Get-AzResourceProvider -ProviderNamespace Microsoft.ExtendedLocation
135149
```
136150
137151
Once registered, you should see the `RegistrationState` state for these namespaces change to `Registered`.
138-
---
139152
140-
## 2. Create a resource group
153+
## Create a resource group
141154
142155
Run the following command:
143156
@@ -171,7 +184,7 @@ ResourceId : /subscriptions/00000000-0000-0000-0000-000000000000/resource
171184

172185
---
173186

174-
## 3. Connect an existing Kubernetes cluster
187+
## Connect an existing Kubernetes cluster
175188

176189
Run the following command:
177190

@@ -182,10 +195,11 @@ az connectedk8s connect --name AzureArcTest1 --resource-group AzureArcTest
182195
```
183196

184197
> [!NOTE]
185-
> If you are logged into Azure CLI using a service principal, an [additional parameter](troubleshooting.md#enable-custom-locations-using-service-principal) needs to be set for enabling the custom location feature on the cluster.
198+
> If you are logged into Azure CLI using a service principal, an [additional parameter](troubleshooting.md#enable-custom-locations-using-service-principal) needs to be set to enable the custom location feature on the cluster.
186199
187200
Output:
188-
<pre>
201+
202+
```
189203
Helm release deployment succeeded
190204
191205
{
@@ -218,7 +232,7 @@ Helm release deployment succeeded
218232
"totalNodeCount": null,
219233
"type": "Microsoft.Kubernetes/connectedClusters"
220234
}
221-
</pre>
235+
```
222236

223237
> [!TIP]
224238
> The above command without the location parameter specified creates the Azure Arc-enabled Kubernetes resource in the same location as the resource group. To create the Azure Arc-enabled Kubernetes resource in a different location, specify either `--location <region>` or `-l <region>` when running the `az connectedk8s connect` command.
@@ -230,20 +244,19 @@ New-AzConnectedKubernetes -ClusterName AzureArcTest1 -ResourceGroupName AzureArc
230244
```
231245

232246
Output:
233-
<pre>
247+
248+
```
234249
Location Name Type
235250
-------- ---- ----
236251
eastus AzureArcTest1 microsoft.kubernetes/connectedclusters
237-
</pre>
252+
```
238253

239-
---
254+
## Connect using an outbound proxy server
240255

241-
## 4a. Connect using an outbound proxy server
256+
If your cluster is behind an outbound proxy server, requests must be routed via the outbound proxy server.
242257

243258
### [Azure CLI](#tab/azure-cli)
244259

245-
If your cluster is behind an outbound proxy server, Azure CLI and the Azure Arc-enabled Kubernetes agents need to route their requests via the outbound proxy server.
246-
247260
1. Set the environment variables needed for Azure CLI to use the outbound proxy server:
248261

249262
```bash
@@ -258,15 +271,14 @@ If your cluster is behind an outbound proxy server, Azure CLI and the Azure Arc-
258271
az connectedk8s connect --name <cluster-name> --resource-group <resource-group> --proxy-https https://<proxy-server-ip-address>:<port> --proxy-http http://<proxy-server-ip-address>:<port> --proxy-skip-range <excludedIP>,<excludedCIDR> --proxy-cert <path-to-cert-file>
259272
```
260273

261-
> [!NOTE]
262-
> * Some network requests such as the ones involving in-cluster service-to-service communication need to be separated from the traffic that is routed via the proxy server for outbound communication. The `--proxy-skip-range` parameter can be used to specify the CIDR range and endpoints in a comma-separated way so that any communication from the agents to these endpoints do not go via the outbound proxy. At a minimum, the CIDR range of the services in the cluster should be specified as value for this parameter. For example, let's say `kubectl get svc -A` returns a list of services where all the services have ClusterIP values in the range `10.0.0.0/16`. Then the value to specify for `--proxy-skip-range` is `10.0.0.0/16,kubernetes.default.svc,.svc.cluster.local,.svc`.
263-
> * `--proxy-http`, `--proxy-https`, and `--proxy-skip-range` are expected for most outbound proxy environments. `--proxy-cert` is *only* required if you need to inject trusted certificates expected by proxy into the trusted certificate store of agent pods.
264-
> * The outbound proxy has to be configured to allow websocket connections.
274+
> [!NOTE]
275+
>
276+
> * Some network requests such as the ones involving in-cluster service-to-service communication need to be separated from the traffic that is routed via the proxy server for outbound communication. The `--proxy-skip-range` parameter can be used to specify the CIDR range and endpoints in a comma-separated way so that any communication from the agents to these endpoints do not go via the outbound proxy. At a minimum, the CIDR range of the services in the cluster should be specified as value for this parameter. For example, let's say `kubectl get svc -A` returns a list of services where all the services have ClusterIP values in the range `10.0.0.0/16`. Then the value to specify for `--proxy-skip-range` is `10.0.0.0/16,kubernetes.default.svc,.svc.cluster.local,.svc`.
277+
> * `--proxy-http`, `--proxy-https`, and `--proxy-skip-range` are expected for most outbound proxy environments. `--proxy-cert` is *only* required if you need to inject trusted certificates expected by proxy into the trusted certificate store of agent pods.
278+
> * The outbound proxy has to be configured to allow websocket connections.
265279

266280
### [Azure PowerShell](#tab/azure-powershell)
267281

268-
If your cluster is behind an outbound proxy server, Azure PowerShell and the Azure Arc-enabled Kubernetes agents need to route their requests via the outbound proxy server.
269-
270282
1. Set the environment variables needed for Azure PowerShell to use the outbound proxy server:
271283

272284
```powershell
@@ -281,9 +293,7 @@ If your cluster is behind an outbound proxy server, Azure PowerShell and the Azu
281293
New-AzConnectedKubernetes -ClusterName <cluster-name> -ResourceGroupName <resource-group> -Location eastus -Proxy 'https://<proxy-server-ip-address>:<port>'
282294
```
283295

284-
---
285-
286-
## 5. Verify cluster connection
296+
## Verify cluster connection
287297

288298
Run the following command:
289299

@@ -294,11 +304,12 @@ az connectedk8s list --resource-group AzureArcTest --output table
294304
```
295305

296306
Output:
297-
<pre>
307+
308+
```
298309
Name Location ResourceGroup
299310
------------- ---------- ---------------
300311
AzureArcTest1 eastus AzureArcTest
301-
</pre>
312+
```
302313

303314
### [Azure PowerShell](#tab/azure-powershell)
304315

@@ -307,32 +318,31 @@ Get-AzConnectedKubernetes -ResourceGroupName AzureArcTest
307318
```
308319

309320
Output:
310-
<pre>
321+
322+
```
311323
Location Name Type
312324
-------- ---- ----
313325
eastus AzureArcTest1 microsoft.kubernetes/connectedclusters
314-
</pre>
315-
316-
---
326+
```
317327

318328
> [!NOTE]
319329
> After onboarding the cluster, it takes around 5 to 10 minutes for the cluster metadata (cluster version, agent version, number of nodes, etc.) to surface on the overview page of the Azure Arc-enabled Kubernetes resource in Azure portal.
320330

321331
## 6. View Azure Arc agents for Kubernetes
322332

323-
Azure Arc-enabled Kubernetes deploys a few operators into the `azure-arc` namespace.
333+
Azure Arc-enabled Kubernetes deploys a few agents into the `azure-arc` namespace.
324334

325335
1. View these deployments and pods using:
326336

327-
```console
328-
kubectl get deployments,pods -n azure-arc
329-
```
337+
```
338+
kubectl get deployments,pods -n azure-arc
339+
```
330340

331341
1. Verify all pods are in a `Running` state.
332342

333-
Output:
334-
<pre>
343+
Output:
335344

345+
```
336346
NAME READY UP-TO-DATE AVAILABLE AGE
337347
deployment.apps/cluster-metadata-operator 1/1 1 1 13d
338348
deployment.apps/clusterconnect-agent 1/1 1 1 13d
@@ -356,11 +366,11 @@ Azure Arc-enabled Kubernetes deploys a few operators into the `azure-arc` namesp
356366
pod/kube-aad-proxy-67b87b9f55-bthqv 2/2 Running 0 13d
357367
pod/metrics-agent-575c565fd9-k5j2t 2/2 Running 0 13d
358368
pod/resource-sync-agent-6bbd8bcd86-x5bk5 2/2 Running 0 13d
359-
</pre>
369+
```
360370

361-
A conceptual overview of these agents is available [here](conceptual-agent-overview.md).
371+
For more information about these agents, see [Azure Arc-enabled Kubernetes agent overview](conceptual-agent-overview.md).
362372

363-
## 7. Clean up resources
373+
## Clean up resources
364374

365375
### [Azure CLI](#tab/azure-cli)
366376

@@ -371,7 +381,7 @@ az connectedk8s delete --name AzureArcTest1 --resource-group AzureArcTest
371381
```
372382

373383
>[!NOTE]
374-
> Deleting the Azure Arc-enabled Kubernetes resource using Azure portal removes any associated configuration resources, but *does not* remove any agents running on the cluster. Best practice is to delete the Azure Arc-enabled Kubernetes resource using `az connectedk8s delete` instead of Azure portal.
384+
> Deleting the Azure Arc-enabled Kubernetes resource using the Azure portal removes any associated configuration resources, but *does not* remove any agents running on the cluster. Best practice is to delete the Azure Arc-enabled Kubernetes resource using `az connectedk8s delete` rather than deleting the resource in the Azure portal.
375385

376386
### [Azure PowerShell](#tab/azure-powershell)
377387

@@ -382,9 +392,7 @@ Remove-AzConnectedKubernetes -ClusterName AzureArcTest1 -ResourceGroupName Azure
382392
```
383393

384394
>[!NOTE]
385-
> Deleting the Azure Arc-enabled Kubernetes resource using Azure portal removes any associated configuration resources, but *does not* remove any agents running on the cluster. Best practice is to delete the Azure Arc-enabled Kubernetes resource using `Remove-AzConnectedKubernetes` instead of Azure portal.
386-
387-
---
395+
> Deleting the Azure Arc-enabled Kubernetes resource using the Azure portal removes any associated configuration resources, but *does not* remove any agents running on the cluster. Best practice is to delete the Azure Arc-enabled Kubernetes resource using `Remove-AzConnectedKubernetes` rather than deleting the resource in the Azure portal.
388396

389397
## Next steps
390398

0 commit comments

Comments
 (0)