Platform Center
Home / Platform management / Clusters / Clusters / Take Over Cluster / Cluster of access / Access Azure AKS Cluster

Access Azure AKS Cluster

Unified management of deployed Azure AKS cluster access platforms.

Prerequisites

Prepare Operation Environment

To comply with the security requirements of Azure AKS, the following steps need to be performed using Cloud Shell.

  1. Ensure network connectivity with Azure Console.

  2. Open the Kubernetes service feature page , find the cluster you want to connect to, and click on the cluster overview page.

  3. Click the Connect button, a floating window named Connect to <Cluster Name> will appear. Follow the instructions on the window to open Cloud Shell and configure the operating environment.

Get cluster information

Get Access Cluster Token

The KubeConfig file of a public cloud cluster cannot be directly used to access the cluster.

Please refer to the FAQ How to obtain cluster information? to obtain the access token for accessing the cluster.

Cluster of access

  1. In the left navigation pane, click Clusters > Cluster of clusters.

  2. Click on Cluster of access.

  3. Configure the relevant parameters according to the following instructions.

    Parameter Description
    repository The repository that stores the platform components images required by the cluster.
    - Default: The repository configured when deploying the global platform.
    - Private repository: A pre-built repository that stores the platform components. You need to enter the private repository address, port, username, and password to access the repository.
    - Public repository: Use a repository service located on the public network. Before using it, you need to refer to Updating public network repository cloud credentials to obtain repository authentication permissions.
    Cluster Information Note: Please upload the KubeConfig file, which will be automatically parsed and filled in by the platform.

    Cluster Address: The access address of the API Server exposed to the outside of the cluster, used for the platform to access the API Server of the connected cluster.

    CA Certificate: The CA certificate of the connected cluster.

    Authentication Method: The authentication method of the connected cluster. You need to use the token with cluster management permissions created in the previous step for authentication.

  4. Click on Check Connectivity to verify the network connectivity with the connected cluster and automatically identify the type of the connected cluster. The cluster type will be displayed as a badge in the top right corner of the form.

  5. After passing the connectivity check, click on Connect and confirm.

    Tip:

    • Click on the icon on the right side of the cluster in the In Progress state to view the execution progress of the cluster (status.conditions) in the popped-up Execution Progress dialog box.

    • After successful cluster access, you can view key information about the cluster in the cluster list. The status of the cluster is displayed as normal, and you can perform cluster-related operations.

Network Configuration

To ensure global connectivity with the connected cluster network, please refer to the configuration related to accessing the cluster network .

What’s next

Deployment plugins

After successfully accessing the cluster, you can go to Plugin Management to select the necessary plugins for cluster deployment.

Note: Since AKS is a managed cluster without a master node, it is not possible to view Kubernetes component monitoring data or log audit data in the platform interface.

Namespace under the tube cluster

After accessing the cluster, you can add the cluster to an existing project by creating a project based on the cluster or by adding a cluster associated with a project , and associate the newly accessed cluster with the project.

Furthermore, by performing the import namespace operation, existing Kubernetes namespaces within the cluster can be included and managed under the platform’s project.

FAQ

How to Allow AKS node External IP Security Group?

The node itself only has an internal IP, and the public IP is configured on a frontend load balancer (LB). By default, the node uses this public IP for outbound traffic. The LB is controlled by the AKS principal, so manually modifying this configuration will cause an exception. To allow traffic, you can go to Kubernetes > Properties > Infrastructure Resource Group > Network Security Group > Add all outbound/inbound rules.

How to Login AKS node Node?

To view the logs of system components such as Kubelet, CNI, and kernel, you need to SSH into the Node first. It is recommended to use the kubectl-node-shell plugin instead of assigning a public IP address to each node.

Solution 1: Using kubectl node-shell

To access the shell of a node in a Kubernetes cluster, you can use the kubectl node-shell command. This command allows you to directly access the shell of a node without needing to SSH into it separately.

Here are the steps to use kubectl node-shell:

  1. First, ensure that you have the necessary permissions to access the shell of a node. You will need cluster-admin privileges or equivalent permissions.

  2. Open a terminal and run the following command to access the shell of a specific node:

    kubectl node-shell <node-name>

    Replace <node-name> with the name of the node you want to access.

  3. If successful, you will be connected to the shell of the specified node. From here, you can execute commands and perform administrative tasks on the node.

    Note: Keep in mind that accessing the shell of a node should be done with caution, as it allows direct access to the underlying system. Make sure to only perform authorized actions and avoid making any unintended changes.

  4. To exit the node shell, simply type exit and press Enter.

Using kubectl node-shell provides a convenient way to access the shell of a node in a Kubernetes cluster without the need for additional SSH configuration.

Official Link

Solution 2: Using debug

In this solution, we can use the debug feature to troubleshoot and diagnose issues in our Kubernetes infrastructure. Debugging allows us to inspect the state of our cluster, pods, and containers, and gather information that can help us identify and resolve problems.

To use the debug feature, we need to follow these steps:

  1. Identify the pod or container that is experiencing issues.
  2. Use the kubectl debug command to attach a debug container to the target pod or container.
  3. Once attached, we can run commands inside the debug container to investigate the problem.
  4. We can inspect the logs, check the network connectivity, examine the file system, and perform other troubleshooting tasks.
  5. After troubleshooting, we can detach the debug container and continue normal operations.

Using the debug feature can be helpful in scenarios where we need to investigate issues that are specific to a particular pod or container. It provides us with a way to interactively debug and diagnose problems in our Kubernetes environment.

Official Link 

kubectl alpha debug node/aks-newadd-41368356-vmss000002 -it --image=mcr.microsoft.com/dotnet/runtime-deps:6.0
chroot /host

Azure alb uses Intranet load balancing

Reference official link 

apiVersion: v1
kind: Service
metadata:
  name: internal-app
  namespace: cpaas-system
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
  type: LoadBalancer
  ports:
  - name: http-port
    port: 80
    protocol: TCP
  - name: https-port
    port: 443
    protocol: TCP
  selector:
    service.cpaas.io/name: deployment-aks-alb
    service_name: alb2-aks-alb

Azure alb uses external network load balancing

Deploy a highly available Application Load Balancer (ALB) and fill in the external LB address as the access address.

apiVersion: v1
kind: Service
metadata:
  name: azure-alb
  namespace: cpaas-system
spec:
  type: LoadBalancer
  ports:
  - name: http-port
    port: 80
    protocol: TCP
  - name: https-port
    port: 443
    protocol: TCP
  - name: prom-port
    port: 11780
    protocol: TCP
  - name: prom2-port
    port: 11781
    protocol: TCP
  - name: prom3-port
    port: 15012
    protocol: TCP
  selector:
    service_name: alb2-cpaas-system

If it has been deployed in advance, you can use the following command to modify it.

kubectl edit helmrequest -n cpaas-system uat-cluster-aks-alb

The Add node button is grayened after accessing the cluster. How to add nodes?

Unable to add nodes through the platform interface, please contact the cluster provider to add nodes.

Which certificates are supported by the certificate management function of the access cluster?

  1. Kubernetes certificate: All access to the cluster only supports viewing the APIServer certificate information in the platform’s certificate management interface. It does not support viewing other Kubernetes certificates and does not support automatic rotation.

  2. Platform Component Certificate: All access to the cluster can view the platform component certificate information in the platform certificate management interface and support automatic rotation.

What Functions are not Supported for AKS Cluster?