update templates

This commit is contained in:
cloudmelon
2020-08-14 00:08:28 +01:00
parent 01386f7790
commit 31731966be
2 changed files with 261 additions and 211 deletions
@@ -2,34 +2,176 @@
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"routeTables_bdcaks_rt_name": {
"aksclusterName": {
"type": "string",
"metadata": {
"description": "The name of the AKS Managed Cluster resource."
}
},
"location": {
"type": "string",
"defaultValue": "[resourceGroup().location]",
"metadata": {
"description": "The Azure location of the AKS resource."
}
},
"dnsPrefix": {
"type": "string",
"metadata": {
"description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN."
}
},
"agentCount": {
"defaultValue": 3,
"minValue": 1,
"maxValue": 50,
"type": "int",
"metadata": {
"description": "The number of agent nodes for the cluster. Production workloads have a recommended minimum of 3."
}
},
"agentVMSize": {
"defaultValue": "Standard_D13_v2",
"type": "string",
"metadata": {
"description": "The recommended size of the Virtual Machine."
}
},
"existingServicePrincipalObjectId": {
"type": "string",
"metadata": {
"description": "Object ID against which the Network Contributor roles will be assigned on the subnet"
}
},
"existingServicePrincipalClientId": {
"type": "string",
"metadata": {
"description": "Client ID (used by cloudprovider)"
}
},
"existingServicePrincipalClientSecret": {
"type": "securestring",
"metadata": {
"description": "The Service Principal Client Secret."
}
},
"kubernetesVersion": {
"defaultValue": "1.16.13",
"type": "string",
"metadata": {
"description": "The version of Kubernetes."
}
},
"serviceCidr": {
"type": "string",
"defaultValue": "10.3.0.0/24",
"metadata": {
"description": "A CIDR notation IP range from which to assign service cluster IPs."
}
},
"dnsServiceIP": {
"type": "string",
"defaultValue": "10.3.0.10",
"metadata": {
"description": "Containers DNS server IP address."
}
},
"dockerBridgeCidr": {
"type": "string",
"defaultValue": "172.17.0.1/16",
"metadata": {
"description": "A CIDR notation IP for Docker bridge."
}
},
"routetableName": {
"defaultValue": "bdcaks-rt",
"type": "String"
},
"virtualNetworks_bdc_vnet_name": {
"defaultValue": "bdc-vnet",
"vnetName": {
"defaultValue": "bdcaks-vnet",
"type": "String"
},
"azureFirewalls_bdcaksazfw_name": {
"subnetName": {
"defaultValue": "bdcaks-subnet",
"type": "String"
},
"azureFirewallName": {
"defaultValue": "bdcaksazfw",
"type": "String"
},
"publicIPAddresses_bdcaksazfw_ip_name": {
"azureFirewallPublicIP": {
"defaultValue": "bdcaksazfw-ip",
"type": "String"
},
"managedClusters_bdcaksprivatecluster_name": {
"defaultValue": "bdcaksprivatecluster",
"type": "String"
}
}
},
"variables": {
"networkRoleDefinitionID":"[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
"vnetSubnetID":"[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnetName'))]"
},
"variables": {},
"resources": [
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2020-05-01",
"name": "[parameters('vnetName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/routeTables', parameters('routetableName'))]"
],
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.0.0.0/8"
]
},
"dhcpOptions": {
"dnsServers": []
},
"virtualNetworkPeerings": [],
"enableDdosProtection": false,
"enableVmProtection": false
},
"resources": [
{
"type": "subnets",
"apiVersion": "2020-05-01",
"location": "[parameters('location')]",
"name": "AzureFirewallSubnet",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]"
],
"properties": {
"addressPrefix": "10.2.0.0/24",
"delegations": [],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
},
{
"type": "subnets",
"apiVersion": "2020-05-01",
"location": "[parameters('location')]",
"name": "[parameters('subnetName')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]",
"[resourceId('Microsoft.Network/routeTables', parameters('routetableName'))]"
],
"properties": {
"addressPrefix": "10.1.0.0/16",
"routeTable": {
"id": "[resourceId('Microsoft.Network/routeTables', parameters('routetableName'))]"
},
"delegations": [],
"privateEndpointNetworkPolicies": "Disabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
]
},
{
"type": "Microsoft.Network/publicIPAddresses",
"apiVersion": "2020-05-01",
"name": "[parameters('publicIPAddresses_bdcaksazfw_ip_name')]",
"location": "northeurope",
"name": "[parameters('azureFirewallPublicIP')]",
"location": "[parameters('location')]",
"sku": {
"name": "Standard"
},
@@ -44,8 +186,8 @@
{
"type": "Microsoft.Network/routeTables",
"apiVersion": "2020-05-01",
"name": "[parameters('routeTables_bdcaks_rt_name')]",
"location": "northeurope",
"name": "[parameters('routetableName')]",
"location": "[parameters('location')]",
"properties": {
"disableBgpRoutePropagation": false,
"routes": [
@@ -67,189 +209,14 @@
]
}
},
{
"type": "Microsoft.ContainerService/managedClusters",
"apiVersion": "2020-06-01",
"name": "[parameters('managedClusters_bdcaksprivatecluster_name')]",
"location": "northeurope",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'aks-subnet')]"
],
"sku": {
"name": "Basic",
"tier": "Free"
},
"properties": {
"kubernetesVersion": "1.16.13",
"dnsPrefix": "bdcakspriv-private-bdc-rg-a00fa0",
"agentPoolProfiles": [
{
"name": "nodepool1",
"count": 2,
"vmSize": "Standard_D13_v2",
"osDiskSizeGB": 128,
"vnetSubnetID": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'aks-subnet')]",
"maxPods": 30,
"type": "VirtualMachineScaleSets",
"orchestratorVersion": "1.16.13",
"enableNodePublicIP": false,
"nodeLabels": {},
"mode": "System",
"osType": "Linux",
"nodeImageVersion": "AKSUbuntu-1604-2020.07.16"
}
],
"linuxProfile": {
"adminUsername": "azureuser",
"ssh": {
"publicKeys": [
{
"keyData": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+2Ev5GnLtDTsb/xnYFVFqyJejTQy+tH9Z5jhh4h+h1zDLZESubjzKkSIcBaUq1BDypC2HWY3GojxOW8QSKtlxdZNMBoX2/POsc+XeU/iPPYi243wMCBKOyIS5iLrT+86sDCDSVScmaFiA7fGSQOp3ghYY+517s1yWFWdbbChVP0OWjPDa8CeiMPDJFraT5stcFuEJ/ef1qidz48bvJJJKiKQ+7VS4VjqKFsM+n7uvKC0V5hZZ6WH7Ld5q1zR4OImySiYHRzNob6Q9f14MOTCu+JLbdONZLRAR83daw30fCL2V8NGqSVFAA/oRwarZpCZvrNJSCUUc6esDax36pEjx"
}
]
}
},
"windowsProfile": {
"adminUsername": "azureuser"
},
"servicePrincipalProfile": {
"clientId": "17915f2a-09da-4729-8f62-c7121f28a4f2"
},
"addonProfiles": {
"KubeDashboard": {
"enabled": true
}
},
"nodeResourceGroup": "[concat('MC_private-bdc-rg_', parameters('managedClusters_bdcaksprivatecluster_name'), '_northeurope')]",
"enableRBAC": true,
"networkProfile": {
"networkPlugin": "azure",
"loadBalancerSku": "Standard",
"serviceCidr": "10.3.0.0/24",
"dnsServiceIP": "10.3.0.10",
"dockerBridgeCidr": "172.17.0.1/16",
"outboundType": "userDefinedRouting"
},
"apiServerAccessProfile": {
"enablePrivateCluster": true
}
}
},
{
"type": "Microsoft.Network/routeTables/routes",
"apiVersion": "2020-05-01",
"name": "[concat(parameters('routeTables_bdcaks_rt_name'), '/bdcaksroute')]",
"dependsOn": [
"[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]"
],
"properties": {
"addressPrefix": "0.0.0.0/0",
"nextHopType": "VirtualAppliance",
"nextHopIpAddress": "10.2.0.4"
}
},
{
"type": "Microsoft.Network/routeTables/routes",
"apiVersion": "2020-05-01",
"name": "[concat(parameters('routeTables_bdcaks_rt_name'), '/bdcaksrouteinet')]",
"dependsOn": [
"[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]"
],
"properties": {
"addressPrefix": "51.104.159.190/32",
"nextHopType": "Internet"
}
},
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2020-05-01",
"name": "[parameters('virtualNetworks_bdc_vnet_name')]",
"location": "northeurope",
"dependsOn": [
"[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]"
],
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.0.0.0/8"
]
},
"dhcpOptions": {
"dnsServers": []
},
"subnets": [
{
"name": "AzureFirewallSubnet",
"properties": {
"addressPrefix": "10.2.0.0/24",
"delegations": [],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
},
{
"name": "aks-subnet",
"properties": {
"addressPrefix": "10.1.0.0/16",
"routeTable": {
"id": "[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]"
},
"delegations": [],
"privateEndpointNetworkPolicies": "Disabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
],
"virtualNetworkPeerings": [],
"enableDdosProtection": false,
"enableVmProtection": false
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2020-05-01",
"name": "[concat(parameters('virtualNetworks_bdc_vnet_name'), '/AzureFirewallSubnet')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworks_bdc_vnet_name'))]"
],
"properties": {
"addressPrefix": "10.2.0.0/24",
"delegations": [],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
},
{
"type": "Microsoft.ContainerService/managedClusters/agentPools",
"apiVersion": "2020-06-01",
"name": "[concat(parameters('managedClusters_bdcaksprivatecluster_name'), '/nodepool1')]",
"dependsOn": [
"[resourceId('Microsoft.ContainerService/managedClusters', parameters('managedClusters_bdcaksprivatecluster_name'))]",
"[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'aks-subnet')]"
],
"properties": {
"count": 2,
"vmSize": "Standard_D13_v2",
"osDiskSizeGB": 128,
"vnetSubnetID": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'aks-subnet')]",
"maxPods": 30,
"type": "VirtualMachineScaleSets",
"orchestratorVersion": "1.16.13",
"enableNodePublicIP": false,
"nodeLabels": {},
"mode": "System",
"osType": "Linux",
"nodeImageVersion": "AKSUbuntu-1604-2020.07.16"
}
},
{
"type": "Microsoft.Network/azureFirewalls",
"apiVersion": "2020-05-01",
"name": "[parameters('azureFirewalls_bdcaksazfw_name')]",
"location": "northeurope",
"name": "[parameters('azureFirewallName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_bdcaksazfw_ip_name'))]",
"[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'AzureFirewallSubnet')]"
"[resourceId('Microsoft.Network/publicIPAddresses', parameters('azureFirewallPublicIP'))]",
"[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), 'AzureFirewallSubnet')]"
],
"properties": {
"sku": {
@@ -263,13 +230,13 @@
},
"ipConfigurations": [
{
"name": "[concat(parameters('azureFirewalls_bdcaksazfw_name'), '-config')]",
"name": "[concat(parameters('azureFirewallName'), '-config')]",
"properties": {
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_bdcaksazfw_ip_name'))]"
"id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('azureFirewallPublicIP'))]"
},
"subnet": {
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'AzureFirewallSubnet')]"
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), 'AzureFirewallSubnet')]"
}
}
}
@@ -346,22 +313,97 @@
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2020-05-01",
"name": "[concat(parameters('virtualNetworks_bdc_vnet_name'), '/aks-subnet')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworks_bdc_vnet_name'))]",
"[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]"
"type": "Microsoft.Resources/deployments",
"apiVersion": "2019-10-01",
"name": "DeployPrivateAksCluster",
"dependsOn": [
"[variables('vnetSubnetID')]"
],
"resourceGroup": "[resourceGroup().name]",
"properties": {
"addressPrefix": "10.1.0.0/16",
"routeTable": {
"id": "[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]"
},
"delegations": [],
"privateEndpointNetworkPolicies": "Disabled",
"privateLinkServiceNetworkPolicies": "Enabled"
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.ContainerService/managedClusters",
"apiVersion": "2020-06-01",
"name": "[parameters('aksclusterName')]",
"location": "[parameters('location')]",
"dependsOn": [
"ClusterSubnetRoleAssignmentDeployment"
],
"sku": {
"name": "Basic",
"tier": "Free"
},
"properties": {
"kubernetesVersion": "[parameters('kubernetesVersion')]",
"dnsPrefix": "[parameters('dnsPrefix')]",
"agentPoolProfiles": [
{
"name": "nodepool",
"count": "[parameters('agentCount')]",
"vmSize": "[parameters('agentVMSize')]",
"osDiskSizeGB": 128,
"vnetSubnetID":"[variables('vnetSubnetID')]",
"maxPods": 30,
"type": "VirtualMachineScaleSets",
"orchestratorVersion": "[parameters('kubernetesVersion')]",
"enableNodePublicIP": false,
"mode": "System",
"osType": "Linux",
"nodeImageVersion": "AKSUbuntu-1604-2020.07.16"
}
],
"servicePrincipalProfile": {
"clientId": "[parameters('existingServicePrincipalClientId')]",
"secret": "[parameters('existingServicePrincipalClientSecret')]"
},
"networkProfile": {
"networkPlugin": "azure",
"loadBalancerSku": "Standard",
"serviceCidr": "[parameters('serviceCidr')]",
"dnsServiceIP": "[parameters('dnsServiceIP')]",
"dockerBridgeCidr": "[parameters('dockerBridgeCidr')]",
"outboundType": "userDefinedRouting"
},
"apiServerAccessProfile": {
"enablePrivateCluster": true
}
}
},
{
"type": "Microsoft.Resources/deployments",
"name": "ClusterSubnetRoleAssignmentDeployment",
"apiVersion": "2017-05-10",
"resourceGroup": "[resourceGroup().name]",
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "Microsoft.Network/virtualNetworks/providers/roleAssignments",
"apiVersion": "2017-05-01",
"name": "[concat(parameters('vnetName'),'/Microsoft.Authorization/', guid(resourceGroup().id, deployment().name))]",
"properties": {
"roleDefinitionId": "[variables('networkRoleDefinitionID')]",
"principalId": "[parameters('existingServicePrincipalObjectId')]",
"scope": "[resourceId(resourceGroup().name,'Microsoft.Network/virtualNetworks',parameters('vnetName'))]"
}
}
]
}
}
}
]
}
}
}
}
]
}
@@ -1,2 +1,10 @@
# Deploy BDC in private AKS cluster with User-defined Route (UDR)
This repository contains :
Bash Scripts :
- deploy-private-aks.sh
- deploy-private-aks-udr.sh
- deploy-private-bdc.sh