|
| 1 | +--- |
| 2 | +title: SSH into Azure Kubernetes Service (AKS) cluster nodes |
| 3 | +description: Learn how to create an SSH connection with Azure Kubernetes Service (AKS) cluster nodes for troubleshooting and maintenance tasks. |
| 4 | +services: container-service |
| 5 | +author: iainfoulds |
| 6 | + |
| 7 | +ms.service: container-service |
| 8 | +ms.topic: article |
| 9 | +ms.date: 08/21/2018 |
| 10 | +ms.author: iainfou |
| 11 | +--- |
| 12 | + |
| 13 | +# Connect with SSH to Azure Kubernetes Service (AKS) cluster nodes for maintenance or troubleshooting |
| 14 | + |
| 15 | +Throughout the lifecycle of your Azure Kubernetes Service (AKS) cluster, you may need to access an AKS node. This access could be for maintenance, log collection, or other troubleshooting operations. The AKS nodes are Linux VMs, so you can access them using SSH. For security purposes, the AKS nodes are not exposed to the internet. |
| 16 | + |
| 17 | +This article shows you how to create an SSH connection with an AKS node using their private IP addresses. |
| 18 | + |
| 19 | +## Add your public SSH key |
| 20 | + |
| 21 | +By default, SSH keys are generated when you create an AKS cluster. If you did not specify your own SSH keys when you created your AKS cluster, add your public SSH keys to the AKS nodes. |
| 22 | + |
| 23 | +To add your SSH key to an AKS node, complete the following steps: |
| 24 | + |
| 25 | +1. Get the resource group name for your AKS cluster resources using [az aks show][az-aks-show]. Provide your own core resource group and AKS cluster name: |
| 26 | + |
| 27 | + ```azurecli |
| 28 | + az aks show --resource-group myResourceGroup --name myAKSCluster --query nodeResourceGroup -o tsv |
| 29 | + ``` |
| 30 | +
|
| 31 | +1. List the VMs in the AKS cluster resource group using the [az vm list][az-vm-list] command. These VMs are your AKS nodes: |
| 32 | +
|
| 33 | + ```azurecli |
| 34 | + az vm list --resource-group MC_myResourceGroup_myAKSCluster_eastus -o table |
| 35 | + ``` |
| 36 | +
|
| 37 | + The following example output shows the AKS nodes: |
| 38 | +
|
| 39 | + ``` |
| 40 | + Name ResourceGroup Location |
| 41 | + ------------------------ --------------------------------------------- ---------- |
| 42 | + aks-nodepool1-79590246-0 MC_myResourceGroupAKS_myAKSClusterRBAC_eastus eastus |
| 43 | + ``` |
| 44 | +
|
| 45 | +1. To add your SSH keys to the node, use the [az vm user update][az-vm-user-update] command. Provide the resource group name and then one of the AKS nodes obtained in the previous step. By default, the username for the AKS nodes is *azureuser*. Provide the location of your own SSH public key location, such as *~/.ssh/id_rsa.pub*, or paste the contents of your SSH public key: |
| 46 | +
|
| 47 | + ```azurecli |
| 48 | + az vm user update \ |
| 49 | + --resource-group MC_myResourceGroup_myAKSCluster_eastus \ |
| 50 | + --name aks-nodepool1-79590246-0 \ |
| 51 | + --username azureuser \ |
| 52 | + --ssh-key-value ~/.ssh/id_rsa.pub |
| 53 | + ``` |
| 54 | +
|
| 55 | +## Get the AKS node address |
| 56 | +
|
| 57 | +The AKS nodes are not publicly exposed to the internet. To SSH to the AKS nodes, you use the private IP address. |
| 58 | +
|
| 59 | +View the private IP address of an AKS cluster node using the [az vm list-ip-addresses][az-vm-list-ip-addresses] command. Provide your own AKS cluster resource group name obtained in a previous [az-aks-show][az-aks-show] step: |
| 60 | +
|
| 61 | +```azurecli |
| 62 | +az vm list-ip-addresses --resource-group MC_myAKSCluster_myAKSCluster_eastus -o table |
| 63 | +``` |
| 64 | + |
| 65 | +The following example output shows the private IP addresses of the AKS nodes: |
| 66 | + |
| 67 | +``` |
| 68 | +VirtualMachine PrivateIPAddresses |
| 69 | +------------------------ -------------------- |
| 70 | +aks-nodepool1-79590246-0 10.240.0.4 |
| 71 | +``` |
| 72 | + |
| 73 | +## Create the SSH connection |
| 74 | + |
| 75 | +To create an SSH connection to an AKS node, you run a helper pod in your AKS cluster. This helper pod provides you with SSH access into the cluster and then additional SSH node access. To create and use this helper pod, complete the following steps: |
| 76 | + |
| 77 | +1. Run a `debian` container image and attach a terminal session to it. This container can be used to create an SSH session with any node in the AKS cluster: |
| 78 | + |
| 79 | + ```console |
| 80 | + kubectl run -it --rm aks-ssh --image=debian |
| 81 | + ``` |
| 82 | + |
| 83 | +1. The base Debian image doesn't include SSH components. Once the terminal session is connected to the container, install an SSH client using `apt-get` as follows: |
| 84 | + |
| 85 | + ```console |
| 86 | + apt-get update && apt-get install openssh-client -y |
| 87 | + ``` |
| 88 | + |
| 89 | +1. In a new terminal window, not connected to your container, list the pods on your AKS cluster using the [kubectl get pods][kubectl-get] command. The pod created in the previous step starts with the name *aks-ssh*, as shown in the following example: |
| 90 | + |
| 91 | + ``` |
| 92 | + $ kubectl get pods |
| 93 | + |
| 94 | + NAME READY STATUS RESTARTS AGE |
| 95 | + aks-ssh-554b746bcf-kbwvf 1/1 Running 0 1m |
| 96 | + ``` |
| 97 | + |
| 98 | +1. In the first step of this article, you added your public SSH key the AKS node. Now, copy your private SSH key into the pod. This private key is used to create the SSH into the AKS nodes. |
| 99 | + |
| 100 | + Provide your own *aks-ssh* pod name obtained in the previous step. If needed, change *~/.ssh/id_rsa* to location of your private SSH key: |
| 101 | + |
| 102 | + ```console |
| 103 | + kubectl cp ~/.ssh/id_rsa aks-ssh-554b746bcf-kbwvf:/id_rsa |
| 104 | + ``` |
| 105 | + |
| 106 | +1. Back in the terminal session to your container, update the permissions on the copied `id_rsa` private SSH key so that it is user read-only: |
| 107 | + |
| 108 | + ```console |
| 109 | + chmod 0600 id_rsa |
| 110 | + ``` |
| 111 | + |
| 112 | +1. Now create an SSH connection to your AKS node. Again, the default username for AKS nodes is *azureuser*. Accept the prompt to continue with the connection as the SSH key is first trusted. You are then provided with the bash prompt of your AKS node: |
| 113 | + |
| 114 | + ```console |
| 115 | + |
| 116 | + |
| 117 | + ECDSA key fingerprint is SHA256:A6rnRkfpG21TaZ8XmQCCgdi9G/MYIMc+gFAuY9RUY70. |
| 118 | + Are you sure you want to continue connecting (yes/no)? yes |
| 119 | + Warning: Permanently added '10.240.0.4' (ECDSA) to the list of known hosts. |
| 120 | + |
| 121 | + Welcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.15.0-1018-azure x86_64) |
| 122 | + |
| 123 | + * Documentation: https://help.ubuntu.com |
| 124 | + * Management: https://landscape.canonical.com |
| 125 | + * Support: https://ubuntu.com/advantage |
| 126 | + |
| 127 | + Get cloud support with Ubuntu Advantage Cloud Guest: |
| 128 | + http://www.ubuntu.com/business/services/cloud |
| 129 | + |
| 130 | + [...] |
| 131 | + |
| 132 | + azureuser@aks-nodepool1-79590246-0:~$ |
| 133 | + ``` |
| 134 | + |
| 135 | +## Remove SSH access |
| 136 | + |
| 137 | +When done, `exit` the SSH session and then `exit` the interactive container session. When this container session closes, the pod used for SSH access from the AKS cluster is deleted. |
| 138 | + |
| 139 | +## Next steps |
| 140 | + |
| 141 | +If you need additional troubleshooting data, you can [view the kubelet logs][view-kubelet-logs] or [view the Kubernetes master node logs][view-master-logs]. |
| 142 | + |
| 143 | +<!-- EXTERNAL LINKS --> |
| 144 | +[kubectl-get]: https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#get |
| 145 | + |
| 146 | +<!-- INTERNAL LINKS --> |
| 147 | +[az-aks-show]: /cli/azure/aks#az-aks-show |
| 148 | +[az-vm-list]: /cli/azure/vm#az-vm-list |
| 149 | +[az-vm-user-update]: /cli/azure/vm/user#az-vm-user-update |
| 150 | +[az-vm-list-ip-addresses]: /cli/azure/vm#az-vm-list-ip-addresses |
| 151 | +[view-kubelet-logs]: kubelet-logs.md |
| 152 | +[view-master-logs]: view-master-logs.md |
0 commit comments