You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-arc/kubernetes/use-azure-policy-flux-2.md
+40-35Lines changed: 40 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,42 +1,43 @@
1
1
---
2
2
title: "Deploy applications consistently at scale using Flux v2 configurations and Azure Policy"
3
-
ms.date: 06/02/2023
3
+
ms.date: 12/13/2023
4
4
ms.topic: how-to
5
5
description: "Use Azure Policy to apply Flux v2 configurations at scale on Azure Arc-enabled Kubernetes or AKS clusters."
6
6
---
7
7
8
8
# Deploy applications consistently at scale using Flux v2 configurations and Azure Policy
9
9
10
-
You can use Azure Policy to apply Flux v2 configurations (`Microsoft.KubernetesConfiguration/fluxConfigurations` resource type) at scale on Azure Arc-enabled Kubernetes (`Microsoft.Kubernetes/connectedClusters`) or AKS (`Microsoft.ContainerService/managedClusters`) clusters.
10
+
You can use Azure Policy to apply Flux v2 configurations (`Microsoft.KubernetesConfiguration/fluxConfigurations` resource type) at scale on Azure Arc-enabled Kubernetes (`Microsoft.Kubernetes/connectedClusters`) or AKS (`Microsoft.ContainerService/managedClusters`) clusters. To use Azure Policy, you select a built-in policy definition and create a policy assignment.
11
11
12
-
To use Azure Policy, select a built-in policy definition and create a policy assignment. You can search for **flux** to find all of the Flux v2 policy definitions. When creating the policy assignment:
12
+
Before you assign the policy that creates Flux configurations, you must ensure that the Flux extension is deployed to your clusters. You can do this by first assigning a policy that deploys the extension to all clusters in the selected scope (all resource groups in a subscription or management group, or to specific resource groups). Then, when creating the policy assignment to deploy configurations, you set parameters for the Flux configuration that will be applied to the clusters in that scope.
13
13
14
-
1. Set the scope for the assignment to all resource groups in a subscription or management group, or to specific resource groups.
15
-
2. Set the parameters for the Flux v2 configuration that will be created.
14
+
To enable separation of concerns, you can create multiple policy assignments, each with a different Flux v2 configuration pointing to a different source. For example, one Git repository can be used by cluster admins while other repositories can be used by application teams.
16
15
17
-
Once the assignment is created, the Azure Policy engine identifies all Azure Arc-enabled Kubernetes clusters located within the scope and applies the GitOps configuration to each cluster.
16
+
## Built-in policy definitions
18
17
19
-
To enable separation of concerns, you can create multiple policy assignments, each with a different Flux v2 configuration pointing to a different source. For example, one git repository may be used by cluster admins and other repositories may be used by application teams.
18
+
The following [built-in policy definitions](policy-reference.md) provide support for these scenarios:
20
19
21
-
> [!TIP]
22
-
> There are [built-in policy definitions](policy-reference.md) for these scenarios:
23
-
>
24
-
> * Flux extension install (required for all scenarios): `Configure installation of Flux extension on Kubernetes cluster`
25
-
> * Flux configuration using public Git repository (generally a test scenario): `Configure Kubernetes clusters with Flux v2 configuration using public Git repository`
26
-
> * Flux configuration using private Git repository with SSH auth: `Configure Kubernetes clusters with Flux v2 configuration using Git repository and SSH secrets`
27
-
> * Flux configuration using private Git repository with HTTPS auth: `Configure Kubernetes clusters with Flux v2 configuration using Git repository and HTTPS secrets`
28
-
> * Flux configuration using private Git repository with HTTPS CA cert auth: `Configure Kubernetes clusters with Flux v2 configuration using Git repository and HTTPS CA Certificate`
29
-
> * Flux configuration using private Git repository with local K8s secret: `Configure Kubernetes clusters with Flux v2 configuration using Git repository and local secrets`
30
-
> * Flux configuration using private Bucket source and KeyVault secrets: `Configure Kubernetes clusters with Flux v2 configuration using Bucket source and secrets in KeyVault`
31
-
> * Flux configuration using private Bucket source and local K8s secret: `Configure Kubernetes clusters with specified Flux v2 Bucket source using local secrets`
20
+
|Description |Policy |
21
+
|---------|---------|
22
+
|Flux extension install (required for all scenarios) |`Configure installation of Flux extension on Kubernetes cluster`|
23
+
|Flux configuration using public Git repository (generally a test scenario) |`Configure Kubernetes clusters with Flux v2 configuration using public Git repository`|
24
+
|Flux configuration using private Git repository with SSH auth |`Configure Kubernetes clusters with Flux v2 configuration using Git repository and SSH secrets`|
25
+
|Flux configuration using private Git repository with HTTPS auth |`Configure Kubernetes clusters with Flux v2 configuration using Git repository and HTTPS secrets`|
26
+
|Flux configuration using private Git repository with HTTPS CA cert auth |`Configure Kubernetes clusters with Flux v2 configuration using Git repository and HTTPS CA Certificate`|
27
+
|Flux configuration using private Git repository with local K8s secret |`Configure Kubernetes clusters with Flux v2 configuration using Git repository and local secrets`|
28
+
|Flux configuration using private Bucket source and KeyVault secrets |`Configure Kubernetes clusters with Flux v2 configuration using Bucket source and secrets in KeyVault`|
29
+
|Flux configuration using private Bucket source and local K8s secret |`Configure Kubernetes clusters with specified Flux v2 Bucket source using local secrets`|
30
+
31
+
To find all of the Flux v2 policy definitions, search for **flux**. For more information, see [Azure policy built-in definitions for Azure Arc-enabled Kubernetes](policy-reference.md).
32
32
33
33
## Prerequisites
34
34
35
-
Verify you have `Microsoft.Authorization/policyAssignments/write` permissions on the scope (subscription or resource group) where you'll create this policy assignment.
35
+
* One or more Arc-enabled Kubernetes clusters and/or AKS clusters.
36
+
*`Microsoft.Authorization/policyAssignments/write` permissions on the scope (subscription or resource group) where you'll create the policy assignments.
36
37
37
-
## Create a policy assignment
38
+
## Create a policy assignment to install the Flux extension
38
39
39
-
In order for a policy to apply Flux v2 configurations to a cluster, the Flux extension must be installed on each cluster. You can ensure this by assigning the **Configure installation of Flux extension on Kubernetes cluster** policy definition to the desired scope.
40
+
In order for a policy to apply Flux v2 configurations to a cluster, the Flux extension must first be installed on the cluster. To ensure that the extension is installed to each of your clusters, assign the **Configure installation of Flux extension on Kubernetes cluster** policy definition to the desired scope.
40
41
41
42
1. In the Azure portal, navigate to **Policy**.
42
43
1. In the **Authoring** section of the sidebar, select **Definitions**.
@@ -48,40 +49,44 @@ In order for a policy to apply Flux v2 configurations to a cluster, the Flux ext
48
49
1. Ensure **Policy enforcement** is set to **Enabled**.
49
50
1. Select **Review + create**, then select **Create**.
50
51
51
-
Next, return to the **Definitions** list to apply the configuration policy definition to the same scope.
52
+
## Create a policy assignment to apply Flux configurations
53
+
54
+
Next, return to the **Definitions** list (in the **Authoring** section of **Policy**) to apply the configuration policy definition to the same scope.
52
55
53
56
1. In the "Kubernetes" category, select the **Configure Kubernetes clusters with Flux v2 configuration using public Git repository**
54
-
built-in policy definition.
57
+
built-in policy definition, or one of the other policy definitions to apply Flux configurations.
55
58
1. Select **Assign**.
56
-
1. Set the **Scope** to the same scope that you selected when assigning the first policy, including any exceptions.
59
+
1. Set the **Scope** to the same scope that you selected when assigning the first policy, including any exclusions.
57
60
1. Give the policy assignment an easily identifiable **Assignment name** and **Description**.
58
61
1. Ensure **Policy enforcement** is set to **Enabled**.
59
62
1. Select **Next**, then select **Next** again to open the **Parameters** tab.
60
63
1. Set the parameter values to be used.
61
64
* For more information about parameters, see the [tutorial on deploying Flux v2 configurations](./tutorial-use-gitops-flux2.md).
62
-
* When creating Flux configurations you must provide a value for one (and only one) of these parameters: `repositoryRefBranch`, `repositoryRefTag`, `repositoryRefSemver`, `repositoryRefCommit`.
65
+
* When creating Flux configurations, you must provide a value for one (and only one) of these parameters: `repositoryRefBranch`, `repositoryRefTag`, `repositoryRefSemver`, `repositoryRefCommit`.
63
66
1. Select **Next** to open the **Remediation** task.
64
67
1. Enable **Create a remediation task**.
65
-
1. Verify that **Create a Managed Identity** is checked, and that the identity will have **Contributor** permissions.
66
-
* For more information, see [Quickstart: Create a policy assignment to identify non-compliant resources](../../governance/policy/assign-policy-portal.md) and [Remediate non-compliant resources with Azure Policy](../../governance/policy/how-to/remediate-resources.md).
68
+
1. Verify that **Create a Managed Identity** is checked, and that the identity has **Contributor** permissions. For more information, see [Quickstart: Create a policy assignment to identify non-compliant resources](../../governance/policy/assign-policy-portal.md) and [Remediate non-compliant resources with Azure Policy](../../governance/policy/how-to/remediate-resources.md).
69
+
67
70
1. Select **Review + create**, then select **Create**.
68
71
69
-
After creating the policy assignments, the configuration is applied to new Azure Arc-enabled Kubernetes or AKS clusters created within the scope of policy assignment.
72
+
The configuration is then applied to new Azure Arc-enabled Kubernetes or AKS clusters created within the scope of policy assignment.
70
73
71
-
For existing clusters, you may need to manually run a remediation task. This task typically takes 10 to 20 minutes for the policy assignment to take effect.
74
+
For existing clusters, you might need to manually run a remediation task. This task typically takes 10 to 20 minutes for the policy assignment to take effect.
72
75
73
-
## Verify a policy assignment
76
+
## Verify the policy assignment
74
77
75
78
1. In the Azure portal, navigate to one of your Azure Arc-enabled Kubernetes or AKS clusters.
76
79
1. In the **Settings** section of the sidebar, select **GitOps**.
77
-
* In the configurations list, you should see the configuration created by the policy assignment.
80
+
81
+
In the configurations list, you should see the configuration created by the policy assignment.
82
+
78
83
1. In the **Kubernetes resources** section of the sidebar, select **Namespaces** and **Workloads**.
79
-
* You should see the namespace and artifacts that were created by the Flux configuration.
80
-
* You should see the objects described by the manifests in the Git repo deployed on the cluster.
81
84
82
-
## Customizing a policy
85
+
You should see the namespace and artifacts that were created by the Flux configuration. You should also see the objects described by the manifests in the Git repo deployed on the cluster.
86
+
87
+
## Customize a policy
83
88
84
-
The built-in policies cover the main scenarios for using GitOps with Flux v2 in your Kubernetes clusters. However, due to limitations on the number of parameters allowed in Azure Policy assignments (max of 20), not all parameters are present in the built-in policies. Also, to fit within the 20-parameter limit, only a single Kustomization can be created with the built-in policies.
89
+
The built-in policies cover the main scenarios for using GitOps with Flux v2 in your Kubernetes clusters. However, due to limitations on the number of parameters allowed in Azure Policy assignments (max of 20), not all parameters are present in the built-in policies. Also, to fit within the 20-parameter limit, only a single kustomization can be created with the built-in policies.
85
90
86
91
If you have a scenario that differs from the built-in policies, you can overcome the limitations by creating [custom policies](../../governance/policy/tutorials/create-custom-policy-definition.md) using the built-in policies as templates. You can create custom policies that contain only the parameters you need, and hard-code the rest, therefore working around the 20-parameter limit.
0 commit comments