From 31731966befa069d426ad309eccc2e9f8bc5680f Mon Sep 17 00:00:00 2001 From: cloudmelon Date: Fri, 14 Aug 2020 00:08:28 +0100 Subject: [PATCH] update templates --- .../private-bdc/ARMtemplates/template.json | 464 ++++++++++-------- .../private-bdc/README.md | 8 + 2 files changed, 261 insertions(+), 211 deletions(-) diff --git a/samples/features/sql-big-data-cluster/private-bdc/ARMtemplates/template.json b/samples/features/sql-big-data-cluster/private-bdc/ARMtemplates/template.json index 8b208b3c..317f6d6b 100644 --- a/samples/features/sql-big-data-cluster/private-bdc/ARMtemplates/template.json +++ b/samples/features/sql-big-data-cluster/private-bdc/ARMtemplates/template.json @@ -2,34 +2,176 @@ "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { - "routeTables_bdcaks_rt_name": { + "aksclusterName": { + "type": "string", + "metadata": { + "description": "The name of the AKS Managed Cluster resource." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The Azure location of the AKS resource." + } + }, + "dnsPrefix": { + "type": "string", + "metadata": { + "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." + } + }, + "agentCount": { + "defaultValue": 3, + "minValue": 1, + "maxValue": 50, + "type": "int", + "metadata": { + "description": "The number of agent nodes for the cluster. Production workloads have a recommended minimum of 3." + } + }, + "agentVMSize": { + "defaultValue": "Standard_D13_v2", + "type": "string", + "metadata": { + "description": "The recommended size of the Virtual Machine." + } + }, + "existingServicePrincipalObjectId": { + "type": "string", + "metadata": { + "description": "Object ID against which the Network Contributor roles will be assigned on the subnet" + } + }, + "existingServicePrincipalClientId": { + "type": "string", + "metadata": { + "description": "Client ID (used by cloudprovider)" + } + }, + "existingServicePrincipalClientSecret": { + "type": "securestring", + "metadata": { + "description": "The Service Principal Client Secret." + } + }, + "kubernetesVersion": { + "defaultValue": "1.16.13", + "type": "string", + "metadata": { + "description": "The version of Kubernetes." + } + }, + "serviceCidr": { + "type": "string", + "defaultValue": "10.3.0.0/24", + "metadata": { + "description": "A CIDR notation IP range from which to assign service cluster IPs." + } + }, + "dnsServiceIP": { + "type": "string", + "defaultValue": "10.3.0.10", + "metadata": { + "description": "Containers DNS server IP address." + } + }, + "dockerBridgeCidr": { + "type": "string", + "defaultValue": "172.17.0.1/16", + "metadata": { + "description": "A CIDR notation IP for Docker bridge." + } + }, + "routetableName": { "defaultValue": "bdcaks-rt", "type": "String" }, - "virtualNetworks_bdc_vnet_name": { - "defaultValue": "bdc-vnet", + "vnetName": { + "defaultValue": "bdcaks-vnet", "type": "String" }, - "azureFirewalls_bdcaksazfw_name": { + "subnetName": { + "defaultValue": "bdcaks-subnet", + "type": "String" + }, + "azureFirewallName": { "defaultValue": "bdcaksazfw", "type": "String" }, - "publicIPAddresses_bdcaksazfw_ip_name": { + "azureFirewallPublicIP": { "defaultValue": "bdcaksazfw-ip", "type": "String" - }, - "managedClusters_bdcaksprivatecluster_name": { - "defaultValue": "bdcaksprivatecluster", - "type": "String" - } + } + }, + "variables": { + "networkRoleDefinitionID":"[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "vnetSubnetID":"[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnetName'))]" }, - "variables": {}, "resources": [ + { + "type": "Microsoft.Network/virtualNetworks", + "apiVersion": "2020-05-01", + "name": "[parameters('vnetName')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.Network/routeTables', parameters('routetableName'))]" + ], + "properties": { + "addressSpace": { + "addressPrefixes": [ + "10.0.0.0/8" + ] + }, + "dhcpOptions": { + "dnsServers": [] + }, + "virtualNetworkPeerings": [], + "enableDdosProtection": false, + "enableVmProtection": false + }, + "resources": [ + { + "type": "subnets", + "apiVersion": "2020-05-01", + "location": "[parameters('location')]", + "name": "AzureFirewallSubnet", + "dependsOn": [ + "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + ], + "properties": { + "addressPrefix": "10.2.0.0/24", + "delegations": [], + "privateEndpointNetworkPolicies": "Enabled", + "privateLinkServiceNetworkPolicies": "Enabled" + } + }, + { + "type": "subnets", + "apiVersion": "2020-05-01", + "location": "[parameters('location')]", + "name": "[parameters('subnetName')]", + "dependsOn": [ + "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]", + "[resourceId('Microsoft.Network/routeTables', parameters('routetableName'))]" + ], + "properties": { + "addressPrefix": "10.1.0.0/16", + "routeTable": { + "id": "[resourceId('Microsoft.Network/routeTables', parameters('routetableName'))]" + }, + "delegations": [], + "privateEndpointNetworkPolicies": "Disabled", + "privateLinkServiceNetworkPolicies": "Enabled" + } + } + ] + }, { "type": "Microsoft.Network/publicIPAddresses", "apiVersion": "2020-05-01", - "name": "[parameters('publicIPAddresses_bdcaksazfw_ip_name')]", - "location": "northeurope", + "name": "[parameters('azureFirewallPublicIP')]", + "location": "[parameters('location')]", "sku": { "name": "Standard" }, @@ -44,8 +186,8 @@ { "type": "Microsoft.Network/routeTables", "apiVersion": "2020-05-01", - "name": "[parameters('routeTables_bdcaks_rt_name')]", - "location": "northeurope", + "name": "[parameters('routetableName')]", + "location": "[parameters('location')]", "properties": { "disableBgpRoutePropagation": false, "routes": [ @@ -67,189 +209,14 @@ ] } }, - { - "type": "Microsoft.ContainerService/managedClusters", - "apiVersion": "2020-06-01", - "name": "[parameters('managedClusters_bdcaksprivatecluster_name')]", - "location": "northeurope", - "dependsOn": [ - "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'aks-subnet')]" - ], - "sku": { - "name": "Basic", - "tier": "Free" - }, - "properties": { - "kubernetesVersion": "1.16.13", - "dnsPrefix": "bdcakspriv-private-bdc-rg-a00fa0", - "agentPoolProfiles": [ - { - "name": "nodepool1", - "count": 2, - "vmSize": "Standard_D13_v2", - "osDiskSizeGB": 128, - "vnetSubnetID": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'aks-subnet')]", - "maxPods": 30, - "type": "VirtualMachineScaleSets", - "orchestratorVersion": "1.16.13", - "enableNodePublicIP": false, - "nodeLabels": {}, - "mode": "System", - "osType": "Linux", - "nodeImageVersion": "AKSUbuntu-1604-2020.07.16" - } - ], - "linuxProfile": { - "adminUsername": "azureuser", - "ssh": { - "publicKeys": [ - { - "keyData": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+2Ev5GnLtDTsb/xnYFVFqyJejTQy+tH9Z5jhh4h+h1zDLZESubjzKkSIcBaUq1BDypC2HWY3GojxOW8QSKtlxdZNMBoX2/POsc+XeU/iPPYi243wMCBKOyIS5iLrT+86sDCDSVScmaFiA7fGSQOp3ghYY+517s1yWFWdbbChVP0OWjPDa8CeiMPDJFraT5stcFuEJ/ef1qidz48bvJJJKiKQ+7VS4VjqKFsM+n7uvKC0V5hZZ6WH7Ld5q1zR4OImySiYHRzNob6Q9f14MOTCu+JLbdONZLRAR83daw30fCL2V8NGqSVFAA/oRwarZpCZvrNJSCUUc6esDax36pEjx" - } - ] - } - }, - "windowsProfile": { - "adminUsername": "azureuser" - }, - "servicePrincipalProfile": { - "clientId": "17915f2a-09da-4729-8f62-c7121f28a4f2" - }, - "addonProfiles": { - "KubeDashboard": { - "enabled": true - } - }, - "nodeResourceGroup": "[concat('MC_private-bdc-rg_', parameters('managedClusters_bdcaksprivatecluster_name'), '_northeurope')]", - "enableRBAC": true, - "networkProfile": { - "networkPlugin": "azure", - "loadBalancerSku": "Standard", - "serviceCidr": "10.3.0.0/24", - "dnsServiceIP": "10.3.0.10", - "dockerBridgeCidr": "172.17.0.1/16", - "outboundType": "userDefinedRouting" - }, - "apiServerAccessProfile": { - "enablePrivateCluster": true - } - } - }, - { - "type": "Microsoft.Network/routeTables/routes", - "apiVersion": "2020-05-01", - "name": "[concat(parameters('routeTables_bdcaks_rt_name'), '/bdcaksroute')]", - "dependsOn": [ - "[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]" - ], - "properties": { - "addressPrefix": "0.0.0.0/0", - "nextHopType": "VirtualAppliance", - "nextHopIpAddress": "10.2.0.4" - } - }, - { - "type": "Microsoft.Network/routeTables/routes", - "apiVersion": "2020-05-01", - "name": "[concat(parameters('routeTables_bdcaks_rt_name'), '/bdcaksrouteinet')]", - "dependsOn": [ - "[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]" - ], - "properties": { - "addressPrefix": "51.104.159.190/32", - "nextHopType": "Internet" - } - }, - { - "type": "Microsoft.Network/virtualNetworks", - "apiVersion": "2020-05-01", - "name": "[parameters('virtualNetworks_bdc_vnet_name')]", - "location": "northeurope", - "dependsOn": [ - "[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]" - ], - "properties": { - "addressSpace": { - "addressPrefixes": [ - "10.0.0.0/8" - ] - }, - "dhcpOptions": { - "dnsServers": [] - }, - "subnets": [ - { - "name": "AzureFirewallSubnet", - "properties": { - "addressPrefix": "10.2.0.0/24", - "delegations": [], - "privateEndpointNetworkPolicies": "Enabled", - "privateLinkServiceNetworkPolicies": "Enabled" - } - }, - { - "name": "aks-subnet", - "properties": { - "addressPrefix": "10.1.0.0/16", - "routeTable": { - "id": "[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]" - }, - "delegations": [], - "privateEndpointNetworkPolicies": "Disabled", - "privateLinkServiceNetworkPolicies": "Enabled" - } - } - ], - "virtualNetworkPeerings": [], - "enableDdosProtection": false, - "enableVmProtection": false - } - }, - { - "type": "Microsoft.Network/virtualNetworks/subnets", - "apiVersion": "2020-05-01", - "name": "[concat(parameters('virtualNetworks_bdc_vnet_name'), '/AzureFirewallSubnet')]", - "dependsOn": [ - "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworks_bdc_vnet_name'))]" - ], - "properties": { - "addressPrefix": "10.2.0.0/24", - "delegations": [], - "privateEndpointNetworkPolicies": "Enabled", - "privateLinkServiceNetworkPolicies": "Enabled" - } - }, - { - "type": "Microsoft.ContainerService/managedClusters/agentPools", - "apiVersion": "2020-06-01", - "name": "[concat(parameters('managedClusters_bdcaksprivatecluster_name'), '/nodepool1')]", - "dependsOn": [ - "[resourceId('Microsoft.ContainerService/managedClusters', parameters('managedClusters_bdcaksprivatecluster_name'))]", - "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'aks-subnet')]" - ], - "properties": { - "count": 2, - "vmSize": "Standard_D13_v2", - "osDiskSizeGB": 128, - "vnetSubnetID": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'aks-subnet')]", - "maxPods": 30, - "type": "VirtualMachineScaleSets", - "orchestratorVersion": "1.16.13", - "enableNodePublicIP": false, - "nodeLabels": {}, - "mode": "System", - "osType": "Linux", - "nodeImageVersion": "AKSUbuntu-1604-2020.07.16" - } - }, { "type": "Microsoft.Network/azureFirewalls", "apiVersion": "2020-05-01", - "name": "[parameters('azureFirewalls_bdcaksazfw_name')]", - "location": "northeurope", + "name": "[parameters('azureFirewallName')]", + "location": "[parameters('location')]", "dependsOn": [ - "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_bdcaksazfw_ip_name'))]", - "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'AzureFirewallSubnet')]" + "[resourceId('Microsoft.Network/publicIPAddresses', parameters('azureFirewallPublicIP'))]", + "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), 'AzureFirewallSubnet')]" ], "properties": { "sku": { @@ -263,13 +230,13 @@ }, "ipConfigurations": [ { - "name": "[concat(parameters('azureFirewalls_bdcaksazfw_name'), '-config')]", + "name": "[concat(parameters('azureFirewallName'), '-config')]", "properties": { "publicIPAddress": { - "id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_bdcaksazfw_ip_name'))]" + "id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('azureFirewallPublicIP'))]" }, "subnet": { - "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_bdc_vnet_name'), 'AzureFirewallSubnet')]" + "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), 'AzureFirewallSubnet')]" } } } @@ -346,22 +313,97 @@ } }, { - "type": "Microsoft.Network/virtualNetworks/subnets", - "apiVersion": "2020-05-01", - "name": "[concat(parameters('virtualNetworks_bdc_vnet_name'), '/aks-subnet')]", - "dependsOn": [ - "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworks_bdc_vnet_name'))]", - "[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]" + "type": "Microsoft.Resources/deployments", + "apiVersion": "2019-10-01", + "name": "DeployPrivateAksCluster", + "dependsOn": [ + "[variables('vnetSubnetID')]" ], + "resourceGroup": "[resourceGroup().name]", "properties": { - "addressPrefix": "10.1.0.0/16", - "routeTable": { - "id": "[resourceId('Microsoft.Network/routeTables', parameters('routeTables_bdcaks_rt_name'))]" - }, - "delegations": [], - "privateEndpointNetworkPolicies": "Disabled", - "privateLinkServiceNetworkPolicies": "Enabled" + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [ + { + "type": "Microsoft.ContainerService/managedClusters", + "apiVersion": "2020-06-01", + "name": "[parameters('aksclusterName')]", + "location": "[parameters('location')]", + "dependsOn": [ + "ClusterSubnetRoleAssignmentDeployment" + ], + "sku": { + "name": "Basic", + "tier": "Free" + }, + "properties": { + "kubernetesVersion": "[parameters('kubernetesVersion')]", + "dnsPrefix": "[parameters('dnsPrefix')]", + "agentPoolProfiles": [ + { + "name": "nodepool", + "count": "[parameters('agentCount')]", + "vmSize": "[parameters('agentVMSize')]", + "osDiskSizeGB": 128, + "vnetSubnetID":"[variables('vnetSubnetID')]", + "maxPods": 30, + "type": "VirtualMachineScaleSets", + "orchestratorVersion": "[parameters('kubernetesVersion')]", + "enableNodePublicIP": false, + "mode": "System", + "osType": "Linux", + "nodeImageVersion": "AKSUbuntu-1604-2020.07.16" + } + ], + "servicePrincipalProfile": { + "clientId": "[parameters('existingServicePrincipalClientId')]", + "secret": "[parameters('existingServicePrincipalClientSecret')]" + }, + "networkProfile": { + "networkPlugin": "azure", + "loadBalancerSku": "Standard", + "serviceCidr": "[parameters('serviceCidr')]", + "dnsServiceIP": "[parameters('dnsServiceIP')]", + "dockerBridgeCidr": "[parameters('dockerBridgeCidr')]", + "outboundType": "userDefinedRouting" + }, + "apiServerAccessProfile": { + "enablePrivateCluster": true + } + } + }, + { + "type": "Microsoft.Resources/deployments", + "name": "ClusterSubnetRoleAssignmentDeployment", + "apiVersion": "2017-05-10", + "resourceGroup": "[resourceGroup().name]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Network/virtualNetworks/providers/roleAssignments", + "apiVersion": "2017-05-01", + "name": "[concat(parameters('vnetName'),'/Microsoft.Authorization/', guid(resourceGroup().id, deployment().name))]", + "properties": { + "roleDefinitionId": "[variables('networkRoleDefinitionID')]", + "principalId": "[parameters('existingServicePrincipalObjectId')]", + "scope": "[resourceId(resourceGroup().name,'Microsoft.Network/virtualNetworks',parameters('vnetName'))]" + } + } + ] + } + } + } + ] + } + } } - } ] } \ No newline at end of file diff --git a/samples/features/sql-big-data-cluster/private-bdc/README.md b/samples/features/sql-big-data-cluster/private-bdc/README.md index 692e1049..ed33546d 100644 --- a/samples/features/sql-big-data-cluster/private-bdc/README.md +++ b/samples/features/sql-big-data-cluster/private-bdc/README.md @@ -1,2 +1,10 @@ # Deploy BDC in private AKS cluster with User-defined Route (UDR) +This repository contains : + +Bash Scripts : +- deploy-private-aks.sh +- deploy-private-aks-udr.sh +- deploy-private-bdc.sh + +