Skip to content

Commit 7dabbb9

Browse files
aamini7aamini7
committed
Fix aks
1 parent 4e9184e commit 7dabbb9

File tree

1 file changed

+71
-166
lines changed

1 file changed

+71
-166
lines changed

‎scenarios/CreateAKSWebApp/README.md‎

Lines changed: 71 additions & 166 deletions
Original file line numberDiff line numberDiff line change
@@ -149,31 +149,29 @@ az aks create \
149149

150150
## Connect to the cluster
151151

152-
To manage a Kubernetes cluster, use the Kubernetes command-line client, kubectl. kubectl is already installed if you use Azure Cloud Shell.
152+
Install az aks CLI locally using the az aks install-cli command
153153

154-
1. Install az aks CLI locally using the az aks install-cli command
155-
156-
```bash
157-
if ! [ -x "$(command -v kubectl)" ]; then az aks install-cli; fi
158-
```
154+
```bash
155+
if ! [ -x "$(command -v kubectl)" ]; then az aks install-cli; fi
156+
```
159157

160-
2. Configure kubectl to connect to your Kubernetes cluster using the az aks get-credentials command. The following command:
158+
## Configure kubectl to connect to your Kubernetes cluster using the az aks get-credentials command. The following command:
161159

162-
- Downloads credentials and configures the Kubernetes CLI to use them.
163-
- Uses ~/.kube/config, the default location for the Kubernetes configuration file. Specify a different location for your Kubernetes configuration file using --file argument.
160+
- Downloads credentials and configures the Kubernetes CLI to use them.
161+
- Uses ~/.kube/config, the default location for the Kubernetes configuration file. Specify a different location for your Kubernetes configuration file using --file argument.
164162

165-
> [!WARNING]
166-
> This will overwrite any existing credentials with the same entry
163+
> [!WARNING]
164+
> This will overwrite any existing credentials with the same entry
167165
168-
```bash
169-
az aks get-credentials --resource-group $MY_RESOURCE_GROUP_NAME --name $MY_AKS_CLUSTER_NAME --overwrite-existing
170-
```
166+
```bash
167+
az aks get-credentials --resource-group $MY_RESOURCE_GROUP_NAME --name $MY_AKS_CLUSTER_NAME --overwrite-existing
168+
```
171169

172-
3. Verify the connection to your cluster using the kubectl get command. This command returns a list of the cluster nodes.
170+
## Verify the connection to your cluster using the kubectl get command. This command returns a list of the cluster nodes.
173171

174-
```bash
175-
kubectl get nodes
176-
```
172+
```bash
173+
kubectl get nodes
174+
```
177175

178176
## Install NGINX Ingress Controller
179177

@@ -437,11 +435,7 @@ spec:
437435
app: store-front
438436
type: LoadBalancer
439437
EOF
440-
```
441-
442-
To deploy this app, run the following command
443438

444-
```bash
445439
kubectl apply -f azure-vote-start.yml
446440
```
447441

@@ -463,48 +457,10 @@ while [[ $(date -u +%s) -le $endtime ]]; do
463457
sleep 10;
464458
fi;
465459
done
466-
```
467460

468-
```bash
469461
curl "http://$FQDN"
470462
```
471463

472-
Results:
473-
474-
<!-- expected_similarity=0.3 -->
475-
476-
```HTML
477-
<!DOCTYPE html>
478-
<html xmlns="http://www.w3.org/1999/xhtml">
479-
<head>
480-
<link rel="stylesheet" type="text/css" href="/static/default.css">
481-
<title>Azure Voting App</title>
482-
483-
<script language="JavaScript">
484-
function send(form){
485-
}
486-
</script>
487-
488-
</head>
489-
<body>
490-
<div id="container">
491-
<form id="form" name="form" action="/"" method="post"><center>
492-
<div id="logo">Azure Voting App</div>
493-
<div id="space"></div>
494-
<div id="form">
495-
<button name="vote" value="Cats" onclick="send()" class="button button1">Cats</button>
496-
<button name="vote" value="Dogs" onclick="send()" class="button button2">Dogs</button>
497-
<button name="vote" value="reset" onclick="send()" class="button button3">Reset</button>
498-
<div id="space"></div>
499-
<div id="space"></div>
500-
<div id="results"> Cats - 0 | Dogs - 0 </div>
501-
</form>
502-
</div>
503-
</div>
504-
</body>
505-
</html>
506-
```
507-
508464
## Add HTTPS termination to custom domain
509465

510466
At this point in the tutorial you have an AKS web app with NGINX as the Ingress controller and a custom domain you can use to access your application. The next step is to add an SSL certificate to the domain so that users can reach your application securely via HTTPS.
@@ -515,96 +471,75 @@ In order to add HTTPS we are going to use Cert Manager. Cert Manager is an open
515471

516472
1. In order to install cert-manager, we must first create a namespace to run it in. This tutorial will install cert-manager into the cert-manager namespace. It is possible to run cert-manager in a different namespace, although you will need to make modifications to the deployment manifests.
517473

518-
```bash
519-
kubectl create namespace cert-manager
520-
```
521-
522-
2. We can now install cert-manager. All resources are included in a single YAML manifest file. This can be installed by running the following:
523-
524-
```bash
525-
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.0/cert-manager.crds.yaml
526-
```
474+
```bash
475+
kubectl create namespace cert-manager
527476

528-
3. Add the certmanager.k8s.io/disable-validation: "true" label to the cert-manager namespace by running the following. This will allow the system resources that cert-manager requires to bootstrap TLS to be created in its own namespace.
477+
# We can now install cert-manager. All resources are included in a single YAML manifest file. This can be installed by running the following:
478+
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.0/cert-manager.crds.yaml
479+
480+
#Add the certmanager.k8s.io/disable-validation: "true" label to the cert-manager namespace by running the following. This will allow the system resources that cert-manager requires to bootstrap TLS to be created in its own namespace.
529481

530-
```bash
531-
kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true
532-
```
482+
kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true
483+
```
533484

534485
## Obtain certificate via Helm Charts
535486

536487
Helm is a Kubernetes deployment tool for automating creation, packaging, configuration, and deployment of applications and services to Kubernetes clusters.
537488

538489
Cert-manager provides Helm charts as a first-class method of installation on Kubernetes.
539490

540-
1. Add the Jetstack Helm repository
541-
542-
This repository is the only supported source of cert-manager charts. There are some other mirrors and copies across the internet, but those are entirely unofficial and could present a security risk.
543-
544-
```bash
545-
helm repo add jetstack https://charts.jetstack.io
546-
```
491+
```bash
492+
# Add the Jetstack Helm repository
493+
# This repository is the only supported source of cert-manager charts. There are some other mirrors and copies across the internet, but those are entirely unofficial and could present a security risk.
547494

548-
2. Update local Helm Chart repository cache
495+
helm repo add jetstack https://charts.jetstack.io
549496

550-
```bash
551-
helm repo update
552-
```
497+
# Update local Helm Chart repository cache
498+
helm repo update
553499

554-
3. Install Cert-Manager addon via helm by running the following:
500+
# Install Cert-Manager addon via helm by running the following
501+
helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.7.0
555502

556-
```bash
557-
helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.7.0
558-
```
503+
# ClusterIssuers are Kubernetes resources that represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request.
504+
# The issuer we are using can be found in the `cluster-issuer-prod.yml file`
505+
506+
cat <<EOF > cluster-issuer-prod.yml
507+
apiVersion: cert-manager.io/v1
508+
kind: ClusterIssuer
509+
metadata:
510+
name: letsencrypt-prod
511+
spec:
512+
acme:
513+
# You must replace this email address with your own.
514+
# Let's Encrypt will use this to contact you about expiring
515+
# certificates, and issues related to your account.
516+
email: $SSL_EMAIL_ADDRESS
517+
# ACME server URL for Let’s Encrypt’s prod environment.
518+
# The staging environment will not issue trusted certificates but is
519+
# used to ensure that the verification process is working properly
520+
# before moving to production
521+
server: https://acme-v02.api.letsencrypt.org/directory
522+
# Secret resource used to store the account's private key.
523+
privateKeySecretRef:
524+
name: letsencrypt
525+
# Enable the HTTP-01 challenge provider
526+
# you prove ownership of a domain by ensuring that a particular
527+
# file is present at the domain
528+
solvers:
529+
- http01:
530+
ingress:
531+
class: nginx
532+
podTemplate:
533+
spec:
534+
nodeSelector:
535+
"kubernetes.io/os": linux
536+
EOF
559537

560-
4. Apply Certificate Issuer YAML File
538+
cluster_issuer_variables=$(<cluster-issuer-prod.yml)
561539

562-
ClusterIssuers are Kubernetes resources that represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request.
563-
The issuer we are using can be found in the `cluster-issuer-prod.yml file`
564-
565-
```bash
566-
cat <<EOF > cluster-issuer-prod.yml
567-
apiVersion: cert-manager.io/v1
568-
kind: ClusterIssuer
569-
metadata:
570-
name: letsencrypt-prod
571-
spec:
572-
acme:
573-
# You must replace this email address with your own.
574-
# Let's Encrypt will use this to contact you about expiring
575-
# certificates, and issues related to your account.
576-
email: $SSL_EMAIL_ADDRESS
577-
# ACME server URL for Let’s Encrypt’s prod environment.
578-
# The staging environment will not issue trusted certificates but is
579-
# used to ensure that the verification process is working properly
580-
# before moving to production
581-
server: https://acme-v02.api.letsencrypt.org/directory
582-
# Secret resource used to store the account's private key.
583-
privateKeySecretRef:
584-
name: letsencrypt
585-
# Enable the HTTP-01 challenge provider
586-
# you prove ownership of a domain by ensuring that a particular
587-
# file is present at the domain
588-
solvers:
589-
- http01:
590-
ingress:
591-
class: nginx
592-
podTemplate:
593-
spec:
594-
nodeSelector:
595-
"kubernetes.io/os": linux
596-
EOF
597-
```
598-
599-
```bash
600-
cluster_issuer_variables=$(<cluster-issuer-prod.yml)
601-
```
602-
603-
5. Upate Voting App Application to use Cert-Manager to obtain an SSL Certificate.
604-
605-
The full YAML file can be found in `azure-vote-nginx-ssl.yml`
540+
# Upate Voting App Application to use Cert-Manager to obtain an SSL Certificate.
541+
# The full YAML file can be found in `azure-vote-nginx-ssl.yml`
606542

607-
```bash
608543
cat << EOF > azure-vote-nginx-ssl.yml
609544
---
610545
# INGRESS WITH SSL PROD
@@ -635,38 +570,10 @@ spec:
635570
port:
636571
number: 80
637572
EOF
638-
```
639-
640-
```bash
641-
azure_vote_nginx_ssl_variables=$(<azure-vote-nginx-ssl.yml)
642-
echo "${azure_vote_nginx_ssl_variables//\$FQDN/$FQDN}" | kubectl apply -f -
643-
```
644-
645-
<!--## Validate application is working
646-
647-
Wait for the SSL certificate to issue. The following command will query the
648-
status of the SSL certificate for 3 minutes. In rare occasions it may take up to
649-
15 minutes for Lets Encrypt to issue a successful challenge and
650-
the ready state to be 'True'
651573

652-
```bash
653-
runtime="10 minute"; endtime=$(date -ud "$runtime" +%s); while [[ $(date -u +%s) -le $endtime ]]; do STATUS=$(kubectl get certificate --output jsonpath={..status.conditions[0].status}); echo $STATUS; if [ "$STATUS" = 'True' ]; then break; else sleep 10; fi; done
654-
```
655-
656-
Validate SSL certificate is True by running the follow command:
657-
658-
```bash
659-
kubectl get certificate --output jsonpath={..status.conditions[0].status}
660-
```
661-
662-
Results:
663-
664-
<!-- expected_similarity=0.3 -->
665-
<!--
666-
```ASCII
667-
True
574+
azure_vote_nginx_ssl_variables=$(<azure-vote-nginx-ssl.yml)
575+
echo "${azure_vote_nginx_ssl_variables//\$FQDN/$FQDN}" | kubectl apply -f -
668576
```
669-
-->
670577

671578
## Browse your AKS Deployment Secured via HTTPS
672579

@@ -687,9 +594,7 @@ while [[ $(date -u +%s) -le $endtime ]]; do
687594
sleep 10;
688595
fi;
689596
done
690-
```
691597

692-
```bash
693598
echo "You can now visit your web server at https://$FQDN"
694599
```
695600

0 commit comments

Comments
 (0)