You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -30,11 +30,11 @@ There are a few different ways that you can provide SSH keys for your cluster no
30
30
* If you want to use different SSH keys for different agent pools or control plane nodes, you can provide a unique public key for each pool, allows you to manage SSH access more granularly, this overrides the cluster wide keys. Any new agent pool gets added to the cluster later without keys use the cluster wide keys, if it has key then it uses the provided key.
31
31
* If you don't provide any SSH keys when creating your cluster, no SSH keys are inserted into the nodes. This means that users can't SSH into the nodes. You can add SSH keys later by updating the cluster configuration, but can't remove those keys once added.
32
32
33
-
Refer the [Disconnected mode access](./howto-kubernetes-cluster-connect.md#disconnected-mode-access) guide for steps to find the cluster node IP address.
33
+
<!--Refer the [Disconnected mode access](./howto-kubernetes-cluster-connect.md#disconnected-mode-access) guide for steps to find the cluster node IP address.-->
34
34
35
35
### [Azure CLI](#tab/azure-cli)
36
36
37
-
Following are the variables you need to set, along with the [quickstart guide](./quickstarts-kubernetes-cluster-deployment-cli.md#create-an-azure-nexus-kubernetes-cluster) default values you can use for certain variables.
37
+
Following are the variables you need to set, along with the [QuickStart guide](./quickstarts-kubernetes-cluster-deployment-cli.md#create-an-azure-nexus-kubernetes-cluster) default values you can use for certain variables.
38
38
39
39
*`SSH_PUBLIC_KEY` - For the cluster wide keys. Note that using cluster wide key with agent pool and control plane keys doesn't have any effect as the control plane and agent pool keys are used instead of the cluster wide keys.
40
40
*`CONTROL_PLANE_SSH_PUBLIC_KEY` - For the control plane, you can provide public keys that are inserted into the control plane nodes.
@@ -64,30 +64,55 @@ Following are the variables you need to set, along with the [quickstart guide](.
64
64
dns-service-ip="${DNS_SERVICE_IP}"
65
65
```
66
66
67
-
### [Azure ARM/Bicep](#tab/other)
67
+
### [Azure ARM](#tab/other)
68
68
69
-
The `administratorConfiguration` can be inserted into the `properties` object for the cluster wide keys, and into the `initialAgentPoolConfigurations[].administratorConfiguration` object for each agent pool. The `controlPlaneNodeConfiguration.administratorConfiguration` object is used for the control plane. Update the quickstart ARM template and Bicep templates with the required keys, and in required object.
69
+
The `administratorConfiguration` can be inserted into the `properties` object for the cluster wide keys, and into the `initialAgentPoolConfigurations[].administratorConfiguration` object for each agent pool. The `controlPlaneNodeConfiguration.administratorConfiguration` object is used for the control plane.
70
70
71
-
```arm
72
-
"administratorConfiguration": {
73
-
"adminUsername": "[parameters('adminUsername')]",
74
-
"sshPublicKeys": [
71
+
Update the quickstart ARM template or Bicep template parameters with the required keys so that the keys are inserted into the nodes when the cluster is created.
72
+
73
+
#### To provide cluster wide keys
74
+
75
+
```json
76
+
"sshPublicKeys": {
77
+
"value": [
78
+
{
79
+
"keyData": "ssh-rsa AAAAA...."
80
+
},
75
81
{
76
-
"keyData": "[parameters('sshPublicKey')]"
82
+
"keyData": "ssh-rsa BBBBB...."
77
83
}
78
84
]
79
85
}
80
86
```
81
87
82
-
```bicep
83
-
administratorConfiguration: {
84
-
adminUsername: adminUsername
85
-
sshPublicKeys: [
86
-
{
87
-
keyData: sshPublicKey
88
-
}
89
-
]
90
-
}
88
+
#### To provide keys for the control plane
89
+
90
+
```json
91
+
"controlPlaneSshKeys": {
92
+
"value": [
93
+
{
94
+
"keyData": "ssh-rsa AAAAA...."
95
+
},
96
+
{
97
+
"keyData": "ssh-rsa BBBBB...."
98
+
}
99
+
]
100
+
}
101
+
```
102
+
103
+
#### To provide keys for the agent pool
104
+
105
+
```json
106
+
"agentPoolSshKeys": {
107
+
"value": [
108
+
{
109
+
"keyData": "ssh-rsa AAAAA...."
110
+
},
111
+
{
112
+
"keyData": "ssh-rsa BBBBB...."
113
+
}
114
+
]
115
+
}
91
116
```
92
117
93
118
---
@@ -105,32 +130,174 @@ To update the SSH keys, you can apply the same Bicep/ARM configuration used duri
105
130
3. If you try to update the agent pool keys or control plane with an empty array, the operation succeeds, and the cluster wide keys are used instead.
106
131
4. If you try to update the keys for a cluster that was created without any keys, the new key is added, but you can't remove it.
107
132
108
-
### Update SSH keys using Azure CLI
133
+
### Before you begin
134
+
135
+
1. Ensure that you have the required permissions to update the cluster configuration.
136
+
2. You have the new SSH keys that you want to use for the cluster nodes.
137
+
3. You have the parameters file used during the initial deployment or the variables used in the CLI command.
138
+
4. To use this guide, you must have an existing Operator Nexus Kubernetes cluster that was created using the quickstart guide.
109
139
110
-
####Update cluster wide SSH keys
140
+
### Update cluster wide SSH keys
111
141
112
-
Use the following command to update the cluster wide SSH keys, which are used for all nodes in the cluster. All the nodes in the cluster will be updated with the new keys if the clster was created with only cluster wide keys.
142
+
Use the following command to update the cluster wide SSH keys, which are used for all nodes in the cluster. The existing keys are replaced with the new keys.
143
+
144
+
> [!NOTE]
145
+
> This works only if the cluster was created with cluster wide keys. If the cluster was created with agent pool or control plane keys, this operation has no effect. Refer the next sections to update agent pool or control plane keys.
146
+
147
+
#### Azure CLI to update cluster wide SSH keys
148
+
149
+
1. Set the `NEW_CLUSTER_WIDE_KEY` variable with the new SSH key.
150
+
151
+
```bash
152
+
NEW_CLUSTER_WIDE_KEY="ssh-rsa CCCCC...."
153
+
```
154
+
155
+
2. Use the following command to update the cluster wide SSH keys.
#### Azure ARM and Bicep to update agent pool SSH keys
215
+
216
+
> [!NOTE]
217
+
> Updating node pools created through initial agent pool configuration is not possible with this method, as there is no separate agent pool template and parameter file. Only the agent pool keys for pools created after cluster creation can be updated using this method. To update the keys for the initial agent pool, refer to the CLI command provided in the previous section. If the initial agent pool was created with cluster wide keys, and if you want to update the keys for the initial agent pool, you can update the cluster wide keys.
218
+
219
+
1. Update the `agentPoolSshKeys` parameter in `kubernetes-nodepool-parameters.json` with the new SSH key.
220
+
221
+
```json
222
+
"agentPoolSshKeys": {
223
+
"value": [
224
+
{
225
+
"keyData": "ssh-rsa DDDDD...."
226
+
}
227
+
]
228
+
}
229
+
```
230
+
231
+
2. Redeploy the template.
232
+
233
+
for ARM:
234
+
235
+
```azurecli
236
+
az deployment group create --resource-group myResourceGroup --template-file kubernetes-add-agentpool.json --parameters @kubernetes-nodepool-parameters.json
237
+
```
238
+
239
+
for Bicep:
240
+
241
+
```azurecli
242
+
az deployment group create --resource-group myResourceGroup --template-file kubernetes-add-agentpool.bicep --parameters @kubernetes-nodepool-parameters.json
243
+
```
244
+
245
+
### Update control plane SSH keys
246
+
247
+
Use the following command to update the SSH keys for the control plane.
248
+
249
+
* All the nodes in the control plane will be updated with the new keys.
250
+
* If the control plane was created with keys, the new keys will replace the existing keys.
251
+
* If the control plane was created without keys, the new keys will be added.
252
+
* If the control plane was created with cluster wide keys, the new keys will replace the existing keys.
253
+
* If you try to update the keys for a cluster that was created without any keys, the new key is added, but you can't remove it.
254
+
* If you try to update the control plane keys with an empty array, the operation succeeds, and the cluster wide keys are used instead.
255
+
256
+
> [!NOTE]
257
+
> The control plane keys can be updated using the initial deployment template and parameter file, as the control plane is a part of the cluster. However, agent pool keys cannot be updated in the same way, as the agent pool is a sub-resource, unless the agent pool uses cluster wide keys.
258
+
259
+
#### Azure CLI to update control plane SSH keys
260
+
261
+
1. Set the `CONTROL_PLANE_KEY` variable with the new SSH key.
262
+
263
+
```bash
264
+
CONTROL_PLANE_KEY="ssh-rsa EEEEE...."
265
+
```
266
+
267
+
2. Use the following command to update the control plane SSH keys.
#### Azure ARM and Bicep to update control plane SSH keys
274
+
275
+
1. Update the `controlPlaneSshKeys` parameter in `kubernetes-deploy-parameters.json` with the new SSH key.
276
+
277
+
```json
278
+
"controlPlaneSshKeys": {
279
+
"value": [
280
+
{
281
+
"keyData": "ssh-rsa EEEEE...."
282
+
}
283
+
]
284
+
}
285
+
```
286
+
287
+
2. Redeploy the template.
288
+
289
+
for ARM:
290
+
291
+
```azurecli
292
+
az deployment group create --resource-group myResourceGroup --template-file kubernetes-deploy.json --parameters @kubernetes-deploy-parameters.json
293
+
```
294
+
295
+
for Bicep:
296
+
297
+
```azurecli
298
+
az deployment group create --resource-group myResourceGroup --template-file kubernetes-deploy.bicep --parameters @kubernetes-deploy-parameters.json
299
+
```
300
+
134
301
## Next steps
135
302
136
303
By understanding how to configure and manage SSH keys on your Operator Nexus Kubernetes cluster nodes, you can ensure that your cluster is secure and that you can access the nodes when you need to troubleshoot issues.
0 commit comments