Repository for the Enterprise Scale for AKS LevelUp training.
-
During this workshop, attendees will be learning about the following topics around containers and AKS.
- Microservices
- Persistent volume claims and using Managed databases on Azure in your microservice
- Private AKS clusters
- Docker
- Azure policies for AKS
- App Gateway Ingress Controller with TLS
- CSI driver for Keyvault secret provider
- Terraform
- .devcontainers
Outline of workshop:
- Quick introduction to Enterprise scale for AKS and why we have it
- Go over the customer scenario and their requirements
- Quickly Simulate ES for AKS workshop to gather customer requirements and make architectural decisions
- Build Enterprise scale for AKS hub, landing zone and supporting services (including ACR and KV) and private cluster using Terraform
- Create a Policy so the cluster can only pull images from ACR
- Make slight changes to the Node server JavaScript code to accommodate the limitations of AGIC
- Build the images required using docker build and push them to ACR
- Copy Redis image from Docker hub to ACR
- Create Postgres database only accessible via private link using Terraform
- Modify the current manifest files as required and create new ones for PVC (for Redis), Secret providers and TLS AGIC
- Test the deployment
- Wrap up
Prerequisites
To follow along, you will need to have access to an Azure tenant where you have user admin role in AAD to be able to complete some of the steps and User access admin & Contributor role to the subscription you are using. This is why it would be best to use your MSDN subscription if possible. If not, you can still join and watch as I go through the ensure process step by step.
- You will also need
- Have a L200 AKS knowledge of AKS
OR
- Review the AKS Workshop here: Azure Kubernetes Service Workshop - Learn | Microsoft Docs
-
Basic knowledge of IaC would also be helpful (Terraform, ARM or Bicep)
-
Visual Studio code with Remote Development package installed
-
Docker desktop or similar installed
-
Optional: WSL
We will be using a Linux terminal for this workshop
Customer scenario:
During the LevelUp, you are acting CSA assigned to help Contoso International deploy a secure AKS cluster for their workload
Contoso International is an organization with multiple divisions. One of the divisions, Contoso R&D has a business units that needs a web application that provides the value in the Fibonacci sequence when an index is provided and keeps track of all numbers that have been calculated in a secure and persistent manner. This is important for the business units because they use it in their engineering work.
This project has been assigned to their development and software consulting division, Contoso developers. Contoso developers has extensive experience using Kubernetes and deploying to AWS and terraform but has no experience with Azure. They have been instructed by Corporate that all new workloads must be deployed on Azure.
One of their software developers has been assigned to begin development of this application by creating a quick POC / MVP that can be used to test out the value of the product and ensure they are going in the right direction. Being experienced with React and Node JaveScript frameworks, he has created a very simple AKS cluster with no security or persistent storage and has developed a simple application to use for the POC that can calculate the numbers from 1 to 40. He used NGINX ingress controller because that is what the team is familiar with. His team has contacted you to help create a more secure cluster.
Below is a picture of the starting cluster the developer made
By the end of the workshop, we would have used Enterprise-scale for AKS to create a more secure cluster that looks like this
