You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: AKS-Hybrid/ad-sso.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Use Active Directory single sign-on for secure connection to Kubernetes A
3
3
description: Use Active Directory Authentication to securely connect to the API server with SSO credentials
4
4
author: sethmanheim
5
5
ms.topic: how-to
6
-
ms.date: 02/15/2024
6
+
ms.date: 06/24/2024
7
7
ms.author: sethm
8
8
ms.lastreviewed: 1/14/2022
9
9
ms.reviewer: sulahiri
@@ -21,7 +21,7 @@ You can create a secure connection to your Kubernetes API server in AKS enabled
21
21
22
22
## Overview of AD in AKS enabled by Arc
23
23
24
-
Without Active Directory authentication, users must rely on a certificate-based _kubeconfig_ file when connecting to the API server via the `kubectl` command. The kubeconfig file contains secrets such as private keys and certificates that need to be carefully distributed, which can be a significant security risk.
24
+
Without Active Directory authentication, you must rely on a certificate-based _kubeconfig_ file when you connect to the API server via the `kubectl` command. The **kubeconfig** file contains secrets such as private keys and certificates that need to be carefully distributed, which can be a significant security risk.
25
25
26
26
As an alternative to using certificate-based kubeconfig, you can use AD SSO credentials as a secure way to connect to the API server. AD integration with AKS Arc lets users on a Windows domain-joined machine connect to the API server via `kubectl` using their SSO credentials. This removes the need to manage and distribute certificate-based kubeconfig files that contain private keys.
27
27
@@ -32,7 +32,7 @@ Another security benefit with AD integration is that the users and groups are st
32
32
> [!NOTE]
33
33
> Currently, AD SSO connectivity is only supported for workload clusters.
34
34
35
-
This article guides you through the following steps to set up Active Directory as the identity provider and to enable SSO via `kubectl`:
35
+
This article guides you through the steps to set up Active Directory as the identity provider and to enable SSO via `kubectl`:
36
36
37
37
- Create the AD account for the API server, and then create the [keytab](https://web.mit.edu/kerberos/krb5-devel/doc/basic/keytab_def.html) file associated with the account. See [Create AD Auth using the keytab file](#create-ad-auth-using-the-keytab-file) to create the AD account and generate the keytab file.
38
38
- Use the [keytab](https://web.mit.edu/kerberos/krb5-devel/doc/basic/keytab_def.html) file to install AD Auth on the Kubernetes cluster. As part of this step, a default role-based access control (RBAC) configuration is automatically created.
To find the SID for the user account, see [Determine the user or group security identifier](#determine-the-user-or-group-security-identifier).
103
103
104
-
Before proceeding to the next steps, make note of the following items:
104
+
Before you proceed to the next steps, make note of the following items:
105
105
106
106
- Make sure the keytab file is named **current.keytab**.
107
107
- Replace the SPN that corresponds to your environment.
@@ -154,19 +154,19 @@ You should copy the following three files from the AKS workload cluster to your
154
154
155
155
### Step 6: Connect to the API server from the client machine
156
156
157
-
After you've completed the previous steps, use your SSO credentials to sign in to your Windows domain-joined client machine. Open PowerShell, and then attempt to access the API server using `kubectl`. If the operation completes successfully, you haveset up AD SSO correctly.
157
+
After you complete the previous steps, use your SSO credentials to sign in to your Windows domain-joined client machine. Open PowerShell, and then attempt to access the API server using `kubectl`. If the operation completes successfully, you set up AD SSO correctly.
158
158
159
159
## Create and update the AD group role binding
160
160
161
-
As mentioned in Step 2, a default role binding with cluster admin privileges is created forthe user and/or the group that was provided during installation. Role bindingin Kubernetes defines the access policies forAD groups. This step describes how to use RBAC to create new AD group role bindingsin Kubernetes and to edit existing role bindings. For example, the cluster admin may want to grant additional privileges to users by using AD groups (which makes the process more efficient). For more information about RBAC, see [using RBAC authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).
161
+
As mentioned in Step 2, a default role binding with cluster admin privileges is created for the user and/or the group that was provided during installation. Role binding in Kubernetes defines the access policies for AD groups. This step describes how to use RBAC to create new AD group role bindings in Kubernetes and to edit existing role bindings. For example, the cluster admin might want to grant additional privileges to users by using AD groups (which makes the process more efficient). For more information about RBAC, see [using RBAC authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).
162
162
163
163
When you create or edit other AD group RBAC entries, the subject name should have the **microsoft:activedirectory:CONTOSO\group name** prefix. Note that the names must contain a domain name and a prefix that are enclosed by double quotes.
164
164
165
165
Here are two examples:
166
166
167
167
### Example 1
168
168
169
-
```yml
169
+
```yaml
170
170
apiVersion: rbac.authorization.k8s.io/v1
171
171
kind: ClusterRoleBinding
172
172
metadata:
@@ -185,7 +185,7 @@ subjects:
185
185
186
186
The following example shows how to create a custom role and role binding for a [namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) with an AD group. In the example, `SREGroup` is a pre-existing group in the Contoso Active Directory. When users are added to the AD group, they're immediately granted privileges.
Copy file name to clipboardExpand all lines: AKS-Hybrid/concepts-container-networking.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: Container networking concepts
3
3
description: Learn about container networking in AKS enabled by Azure Arc.
4
4
ms.topic: conceptual
5
-
ms.date: 10/04/2022
5
+
ms.date: 06/24/2024
6
6
ms.author: sethm
7
7
ms.lastreviewed: 05/31/2022
8
8
ms.reviewer: mikek
@@ -19,7 +19,7 @@ author: sethmanheim
19
19
20
20
Application components must work together to process their tasks in a container-based microservices approach. Kubernetes provides resources that enable application communications and allow you to connect to and expose applications internally or externally. You can load balance your applications to build highly available applications.
21
21
22
-
More complex applications may require configuration of ingress traffic for SSL/TLS termination or routing of multiple components. You may also need to restrict the flow of network traffic into or between pods and nodes for security.
22
+
More complex applications might require configuration of ingress traffic for SSL/TLS termination or routing of multiple components. You might also need to restrict the flow of network traffic into or between pods and nodes for security.
23
23
24
24
This article introduces the core concepts that provide networking to your applications in AKS enabled by Arc:
25
25
@@ -119,16 +119,16 @@ Calico supports multiple data planes including: a Linux eBPF data plane, a Linux
119
119
> [!IMPORTANT]
120
120
> Currently, the default selection is to use Calico in an overlay networking mode. To enable Flannel, use the `-primaryNetworkPlugin` parameter of the [`New-AksHciCluster`](./reference/ps/new-akshcicluster.md) PowerShell command and specify `flannel` as the value. This value cannot be changed after you deploy the cluster, and it applies to both Windows and Linux cluster nodes.
This article covers networking concepts for containers in AKS nodes on Azure Stack HCI. For more information on AKS on Azure Stack HCI concepts, see the following articles:
130
+
This article covers networking concepts for containers in AKS nodes on Azure Stack HCI. For more information about AKS on Azure Stack HCI concepts, see the following articles:
131
131
132
132
-[Network concepts for AKS nodes](./concepts-node-networking.md)
133
133
-[Clusters and workloads](./kubernetes-concepts.md)
134
-
-[Secure traffic between pods using network policies](./calico-networking-policy.md).
134
+
-[Secure traffic between pods using network policies](./calico-networking-policy.md)
You can choose between two IP address assignment models for your networking architecture for AKS enabled by Azure Arc. AKS supports [several deployment options](aks-overview.md) for Azure Kubernetes Service (AKS).
19
+
You can choose between two IP address assignment models for your networking architecture for AKS enabled by Arc. AKS supports [several deployment options](aks-overview.md) for Azure Kubernetes Service (AKS):
20
20
21
21
-**Static IP networking**: the virtual network allocates static IP addresses to the Kubernetes cluster API server, Kubernetes nodes, underlying VMs, load balancers, and any Kubernetes services that run on top of the cluster.
22
22
-**DHCP networking**: the virtual network allocates dynamic IP addresses to the Kubernetes nodes, underlying VMs, and load balancers using a DHCP server. The Kubernetes cluster API server, and any Kubernetes services you run on top of your cluster, are still allocated static IP addresses.
@@ -49,7 +49,7 @@ This networking model creates a virtual network that allocates IP addresses from
49
49
Specify the following parameters while defining a virtual network with static IP configurations:
50
50
51
51
> [!IMPORTANT]
52
-
> This version of AKS does not allow any network configuration changes once the AKS host or the workload cluster is deployed. In order to change the networking settings, you must start fresh by removing the workload cluster(s) and uninstalling AKS.
52
+
> This version of AKS does not allow any network configuration changes once the AKS host or the workload cluster is deployed. In order to change the networking settings, you must start fresh by removing the workload clusters and uninstalling AKS.
53
53
54
54
- Name: The name of your virtual network.
55
55
- Address prefix: The IP address prefix to use for your subnet.
@@ -61,17 +61,14 @@ Specify the following parameters while defining a virtual network with static IP
61
61
> [!NOTE]
62
62
> The VIP pool must be part of the same subnet as the Kubernetes node VM pool.
63
63
64
-
- vLAN ID: The vLAN ID for the virtual network. If omitted, the virtual network is not tagged.
64
+
- vLAN ID: The vLAN ID for the virtual network. If it's omitted, the virtual network is not tagged.
65
65
66
66
## Virtual network with DHCP networking
67
67
68
68
This networking model creates a virtual network that allocates IP addresses using DHCP to all objects in the deployment.
69
69
70
70
You must specify the following parameters while defining a virtual network with static IP configurations:
71
71
72
-
> [!IMPORTANT]
73
-
> In this version of AKS, it is not possible to change the network configuration once the AKS host or the workload cluster are deployed. The only way to change the networking settings is to start fresh by removing the workload cluster(s) and uninstall AKS.
74
-
75
72
- Name: The name of your virtual network.
76
73
- Virtual IP pool: The continuous range of IP addresses to be used for your Kubernetes cluster API server and Kubernetes services.
Copy file name to clipboardExpand all lines: AKS-Hybrid/concepts-storage.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Concepts - Storage options for applications in AKS enabled by Azure Arc
3
3
description: Storage options for applications in AKS enabled by Azure Arc.
4
4
author: sethmanheim
5
5
ms.topic: conceptual
6
-
ms.date: 10/07/2022
6
+
ms.date: 06/24/2024
7
7
ms.author: sethm
8
8
ms.lastreviewed: 1/14/2022
9
9
ms.reviewer: abha
@@ -80,7 +80,7 @@ spec:
80
80
storage: 5Gi
81
81
```
82
82
83
-
When you create a pod definition, the persistent volume claim is specified to request the desired storage. You also then specify the `volumeMount` for your applications to read and write data. The following example YAML manifest shows how the previous persistent volume claim can be used to mount a volume at `/mnt/aks-hci`:
83
+
When you create a pod definition, you specify the persistent volume claim to request the desired storage. You also then specify the `volumeMount` for your applications to read and write data. The following example YAML manifest shows how the previous persistent volume claim can be used to mount a volume at `/mnt/aks-hci`:
This article details how to configure **HAProxy** as your load balancer for a workload cluster in AKS Arc. For custom load balancer integration, see [Create and use a custom load balancer](configure-custom-load-balancer.md).
20
+
This article describes how to configure **HAProxy** as your load balancer for a workload cluster in AKS Arc. For custom load balancer integration, see [Create and use a custom load balancer](configure-custom-load-balancer.md).
21
21
22
-
In AKS enabled by Azure Arc, the load balancer is deployed as a virtual machine (VM) running Linux and **HAProxy + KeepAlive** to provide load balanced services for the workload clusters. AKS load balances requests to the Kubernetes API server, and manages traffic to application services.
22
+
In AKS Arc, the load balancer is deployed as a virtual machine (VM) running Linux and **HAProxy + KeepAlive** to provide load balanced services for the workload clusters. AKS load balances requests to the Kubernetes API server, and manages traffic to application services.
Copy file name to clipboardExpand all lines: AKS-Hybrid/create-ingress-controller.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Use an ingress controller in AKS enabled by Azure Arc
3
3
description: Learn how to deploy an ingress controller in Azure Kubernetes Service in AKS enabled by Arc.
4
4
author: sethmanheim
5
5
ms.topic: how-to
6
-
ms.date: 10/18/2022
6
+
ms.date: 06/25/2024
7
7
ms.author: sethm
8
8
ms.lastreviewed: 1/14/2022
9
9
ms.reviewer: EkeleAsonye
@@ -15,7 +15,7 @@ ms.reviewer: EkeleAsonye
15
15
16
16
An *ingress controller* is a Kubernetes resource that allows external access to services within the Kubernetes cluster. Ingress lets an operator expose a service to external network requests, usually HTTP or HTTPS. You configure access by creating a set of rules that define the inbound connections that reach specific services.
17
17
18
-
An ingress controller is a piece of software that provides configurable traffic routing for Kubernetes services. Kubernetes ingress resources are used to configure the ingress rules and routes for individual Kubernetes services. By using an ingress controller and ingress rules, you can use a single IP address to route traffic to multiple services in a Kubernetes cluster.
18
+
An ingress controller is software that provides configurable traffic routing for Kubernetes services. Kubernetes ingress resources are used to configure the ingress rules and routes for individual Kubernetes services. By using an ingress controller and ingress rules, you can use a single IP address to route traffic to multiple services in a Kubernetes cluster.
19
19
20
20
After you deploy the controller in your environment, you can then create and deploy the ingress manifest. Currently, you use ingress in AKS Arc by using the NGINX ingress controller. For information about how to install, configure, and use the NGINX ingress controller, see [Installation with Manifests](https://kubernetes.github.io/ingress-nginx/deploy/#azure).
21
21
@@ -58,7 +58,7 @@ The `spec` section provides information about what's configured. In this example
58
58
59
59
## Use ingress to load balance traffic
60
60
61
-
In the following example, another path is added to the manifest that permits load balancing between different backends of an application. In this example, the operator can split traffic and send it to different service endpoints and deployments based on the path described. Behind each path, is a deployment and a service, which is helpful for endpoints that receive more traffic:
61
+
In the following example, another path is added to the manifest that permits load balancing between different backends of an application. In this example, the operator can split traffic and send it to different service endpoints and deployments based on the path described. Behind each path is a deployment and a service, which is helpful for endpoints that receive more traffic:
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments