Skip to content

Commit ffaac02

Browse files
infbaseytsarev
infbase
and
ytsarev
authored
Documented Azure DNS deployment (k8gb-io#1525)
* Updated Helm chart, docs and examples for connecting to Azure Public DNS service. Signed-off-by: Nuno Guedes <[email protected]> * Bug fixing the Windows DNS example Signed-off-by: Nuno Guedes <[email protected]> --------- Signed-off-by: Nuno Guedes <[email protected]> Signed-off-by: Yury Tsarev <[email protected]> Co-authored-by: Yury Tsarev <[email protected]>
1 parent d660caa commit ffaac02

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+938
-419
lines changed

‎chart/k8gb/templates/_helpers.tpl‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ Create the name of the service account to use
7272
{{- if .Values.rfc2136.enabled }}
7373
{{- print "rfc2136" -}}
7474
{{- end -}}
75+
{{- if .Values.azuredns.enabled }}
76+
{{- print "azure-dns" -}}
77+
{{- end -}}
7578
{{- if .Values.cloudflare.enabled }}
7679
{{- print "cloudflare" -}}
7780
{{- end -}}
@@ -108,6 +111,9 @@ k8gb-{{ .Values.k8gb.dnsZone }}-{{ .Values.k8gb.clusterGeoTag }}
108111
name: ns1
109112
key: apiKey
110113
{{- end }}
114+
{{- if .Values.azuredns.enabled -}}
115+
- --azure-resource-group={{ .Values.azuredns.resourceGroup }}
116+
{{- end }}
111117
{{- if and (eq .Values.rfc2136.enabled true) (eq .Values.rfc2136.rfc2136auth.insecure.enabled true) -}}
112118
- --rfc2136-insecure
113119
{{- end -}}
@@ -156,3 +162,24 @@ k8gb-{{ .Values.k8gb.dnsZone }}-{{ .Values.k8gb.clusterGeoTag }}
156162
{{- define "k8gb.metrics_port" -}}
157163
{{ print (split ":" .Values.k8gb.metricsAddress)._1 }}
158164
{{- end -}}
165+
166+
{{- define "external-dns.azure-credentials" -}}
167+
{{- if .Values.azuredns.enabled -}}
168+
{
169+
"tenantId": "{{ .Values.azuredns.tenantId }}",
170+
"subscriptionId": "{{ .Values.azuredns.subscriptionId }}",
171+
"resourceGroup": "{{ .Values.azuredns.resourceGroup }}",
172+
{{- if .Values.azuredns.aadClientId -}}
173+
"aadClientId": "{{ .Values.azuredns.aadClientId }}",
174+
{{- end -}}
175+
{{- if .Values.azuredns.aadClientSecret -}}
176+
"aadClientSecret": "{{ .Values.azuredns.aadClientSecret }}",
177+
{{- end -}}
178+
"useManagedIdentityExtension": {{ .Values.azuredns.useManagedIdentityExtension | default false }},
179+
{{- if .Values.azuredns.userAssignedIdentityID -}}
180+
"userAssignedIdentityID": "{{ .Values.azuredns.userAssignedIdentityID }}",
181+
{{- end -}}
182+
"useWorkloadIdentityExtension": {{ .Values.azuredns.useWorkloadIdentityExtension | default false }}
183+
}
184+
{{- end -}}
185+
{{- end -}}

‎chart/k8gb/templates/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ spec:
9898
name: infoblox
9999
key: INFOBLOX_WAPI_PASSWORD
100100
{{- end }}
101-
{{- if or .Values.route53.enabled .Values.ns1.enabled .Values.rfc2136.enabled .Values.cloudflare.enabled }}
101+
{{- if or .Values.route53.enabled .Values.ns1.enabled .Values.rfc2136.enabled .Values.azuredns.enabled .Values.cloudflare.enabled }}
102102
- name: EXTDNS_ENABLED
103103
value: "true"
104104
{{- end }}

‎chart/k8gb/templates/external-dns/external-dns-azure-auth.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- if and .Values.azuredns.enabled .Values.azuredns.createAuthSecret }}
2+
apiVersion: v1
3+
kind: Secret
4+
type: Opaque
5+
metadata:
6+
name: {{ .Values.azuredns.authSecretName | default "external-dns-secret-azure" }}
7+
data:
8+
azure.json: {{ include "external-dns.azure-credentials" . | b64enc }}
9+
{{- end }}

‎chart/k8gb/templates/external-dns/external-dns.yaml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if or .Values.ns1.enabled .Values.route53.enabled .Values.rfc2136.enabled .Values.cloudflare.enabled }}
1+
{{- if or .Values.ns1.enabled .Values.route53.enabled .Values.rfc2136.enabled .Values.azuredns.enabled .Values.cloudflare.enabled }}
22
apiVersion: apps/v1
33
kind: Deployment
44
metadata:
@@ -88,5 +88,14 @@ spec:
8888
{{- toYaml . | nindent 8 }}
8989
{{- end }}
9090
{{- end }}
91-
91+
{{- if .Values.azuredns.enabled }}
92+
volumeMounts:
93+
- name: azure-config-file
94+
mountPath: /etc/kubernetes/
95+
readOnly: true
96+
volumes:
97+
- name: azure-config-file
98+
secret:
99+
secretName: {{ .Values.azuredns.authSecretName | default "external-dns-secret-azure" }}
100+
{{- end }}
92101
{{- end }}

‎chart/k8gb/templates/external-dns/rbac.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if or .Values.ns1.enabled .Values.route53.enabled .Values.rfc2136.enabled .Values.cloudflare.enabled }}
1+
{{- if or .Values.ns1.enabled .Values.route53.enabled .Values.rfc2136.enabled .Values.azuredns.enabled .Values.cloudflare.enabled }}
22
---
33
apiVersion: rbac.authorization.k8s.io/v1
44
kind: ClusterRole

‎chart/k8gb/values.schema.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
"rfc2136": {
3131
"$ref": "#/definitions/Rfc2136"
3232
},
33+
"azuredns": {
34+
"$ref": "#/definitions/AzureDNS"
35+
},
3336
"cloudflare": {
3437
"$ref": "#/definitions/Cloudflare"
3538
},
@@ -612,6 +615,58 @@
612615
],
613616
"title": "Route53"
614617
},
618+
"AzureDNS": {
619+
"type": "object",
620+
"additionalProperties": false,
621+
"properties": {
622+
"enabled": {
623+
"type": "boolean"
624+
},
625+
"createAuthSecret": {
626+
"type": "boolean",
627+
"default": true
628+
},
629+
"authSecretName": {
630+
"type": "string",
631+
"default": "external-dns-secret-azure"
632+
},
633+
"tenantId": {
634+
"type": "string",
635+
"minLength": 1
636+
},
637+
"subscriptionId": {
638+
"type": "string",
639+
"minLength": 1
640+
},
641+
"resourceGroup": {
642+
"type": "string",
643+
"minLength": 1
644+
},
645+
"aadClientId": {
646+
"type": "string"
647+
},
648+
"aadClientSecret": {
649+
"type": "string"
650+
},
651+
"useManagedIdentityExtension": {
652+
"type": "boolean",
653+
"default": false
654+
},
655+
"userAssignedIdentityID": {
656+
"type": "string"
657+
},
658+
"useWorkloadIdentityExtension": {
659+
"type": "boolean",
660+
"default": false
661+
}
662+
},
663+
"required": [
664+
"tenantId",
665+
"subscriptionId",
666+
"resourceGroup"
667+
],
668+
"title": "azuredns"
669+
},
615670
"Cloudflare": {
616671
"type": "object",
617672
"additionalProperties": false,

‎chart/k8gb/values.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,18 @@ rfc2136:
151151
- kerberos-password: ad-user-pass
152152
- kerberos-realm: ad-domain-realm
153153

154+
azuredns:
155+
enabled: false
156+
# -- Create an authentication secret for Azure DNS based on the values below
157+
# alternatively, you can create the secret manually and pass its name in the `authSecretName` value
158+
createAuthSecret: true
159+
# -- Azure tenant ID which holds the managed identity
160+
tenantId: myTenantId
161+
# -- subscription id which holds the Azure DNS zone
162+
subscriptionId: mySubscriptionId
163+
# -- Azure Resource Group which holds the Azure DNS Zone (which is defined as 'edgeDNSZone')
164+
resourceGroup: myDnsResourceGroup
165+
154166
cloudflare:
155167
# -- Enable Cloudflare provider
156168
enabled: false

‎docs/deploy_azuredns.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<h1 align="center" style="margin-top: 0;">Using Azure Public DNS provider</h1>
2+
3+
This document outlines how to configure k8gb to use the Azure Public DNS provider. Azure Private DNS is not supported as it does not support NS records at this time. For private DNS scenarios in Azure, please refer to the [Windows DNS](deploy_azuredns.md) documentation and consider implementing it using VM-based DNS services such as Windows DNS or BIND.
4+
5+
### external-dns credentials for Azure DNS
6+
7+
In this example, we will use a registered app in Microsoft Entra ID and it's corresponding Client ID / Client Secret to authenticate with the Azure DNS zone. All of the [supported authentication fields supported by external-dns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/azure.md#configuration-file) are supported by k8gb and can be used in the `azuredns` section of the `k8gb` Helm chart values.yaml file.
8+
9+
## Sample solution
10+
11+
In this sample solution we will deploy two private AKS clusters in different regions. A workload will be deployed to both clusters and exposed to the internet with the help of k8gb and Azure Public DNS.
12+
13+
## Reference Setup
14+
15+
The reference setup includes two private AKS clusters that can be deployed on two different regions for load balancing or to provide a failover solution.
16+
17+
Configurable resources:
18+
19+
* Resource groups
20+
* VNet and subnets
21+
* Managed Identity
22+
* Clusters
23+
24+
## Run the sample
25+
26+
* To run the provided sample, please use the provided Makefile [here](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/azuredns/).
27+
* Deploys all the required infrastructure and configurations
28+
* Before executing, please fill all the local variables in the scripts with the correct naming for the resources in order to avoid having problems with your Azure policies
29+
* Scripts will use Az CLI, please ensure that it is installed and logged when trying to execute the command
30+
* [Microsoft Learn](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli "Install Az CLI")
31+
32+
### Deploy infrastructure
33+
34+
This action will create resource groups, vnets and private AKS clusters to run all required workloads
35+
36+
```sh
37+
make deploy-infra
38+
```
39+
40+
### Setup clusters
41+
42+
Install required Ingress controller in both clusters in order to deploy K8GB and demo application
43+
44+
```sh
45+
make setup-clusters
46+
```
47+
48+
### Install K8gb
49+
50+
This action will install K8gb in both clusters using the provided [sample](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/azuredns/k8gb/) values.yaml for each cluster. Please ensure that the are correctly updated before execution
51+
52+
```sh
53+
make deploy-k8gb
54+
```
55+
56+
### Install demo app
57+
58+
Deploys the sample Podinfo workload with failover GLSB configured using annotations in the Ingress resource [samples](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/azuredns/demo/).
59+
Ensure that the hosts on the samples are correctly updated before execution
60+
61+
```sh
62+
make deploy-demo
63+
```
64+
65+
### Destroy lab
66+
67+
* Destroys the lab environment created for this sample
68+
69+
```sh
70+
make destroy-infra
71+
```

‎docs/deploy_windowsdns.md‎

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,18 @@
1-
<h1 align="center" style="margin-top: 0;">Using K8GB on Azure</h1>
1+
<h1 align="center" style="margin-top: 0;">Using K8GB with a GSS-TSIG compatible DNS provider</h1>
22

3-
## Sample solution
3+
## Sample solution: Azure based private deployment with Windows DNS integration
44

5-
Sample solution will create a common hub and spoke architecture with two AKS clusters in different regions
6-
7-
![GLSB with K8gb on Azure](/docs/examples/azure/images/k8gb_solution.png?raw=true "GLSB with K8gb on Azure")
8-
9-
# Azure based deployment with Windows DNS integration
5+
In this sample solution we will create a common hub and spoke architecture with two private AKS clusters in different regions. The same pattern can be used with any other Kubernetes distribution and any other DNS provider that supports GSS-TSIG.
106

117
Here we provide an example of k8gb deployment in Azure environment with Windows DNS as edgeDNS provider.
128

139
## Reference Setup
1410

15-
The reference setup includes two AKS clusters that can deployed on two different regions for load balancing or provide a failover solution.
11+
The reference setup includes two private AKS clusters that can be deployed on two different regions for load balancing or to provide a failover solution.
1612

17-
The solution design can be found [here](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/azure/).
13+
![GLSB with K8gb on Windows DNS](/docs/examples/windowsdns/images/k8gb_solution.png?raw=true "GLSB with K8gb on Windows DNS")
14+
15+
The solution design can be found [here](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/windowsdns/).
1816

1917
Configurable resources:
2018

@@ -30,15 +28,15 @@ Configurable resources:
3028
* There are several tutorials available online, but this Microsoft Learn article will probably help you out
3129
* [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-active-directory-domain-services--level-100- "Install Active Directory")
3230

33-
* To run the provided sample, please use the provided Makefile [here](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/azure/).
31+
* To run the provided sample, please use the provided Makefile [here](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/windowsdns/).
3432
* Deploys all the required infrastructure and configurations
35-
* Before execute, please fill all the local variables in the scripts with the correct naming for the resources in order to avoid having problems with your azure policies
36-
* Scripts will use AZ CLI, ensure that is installed and logged when trying to execute the command
37-
* [Microsoft Learn](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli "Install AZ CLI")
33+
* Before executing, please fill all the local variables in the scripts with the correct naming for the resources in order to avoid having problems with your Azure policies
34+
* Scripts will use Az CLI, please ensure that it is installed and logged when trying to execute the command
35+
* [Microsoft Learn](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli "Install Az CLI")
3836

39-
### Deploy infrastructure
37+
### Deploy infrastructure
4038

41-
This action will create resource groups, vnets, peering between vnets and AKS clusters to run all required workloads
39+
This action will create resource groups, vnets, peering between vnets and private AKS clusters to run all required workloads
4240

4341
```sh
4442
make deploy-infra
@@ -54,19 +52,21 @@ make setup-clusters
5452

5553
### Configure GSS-TSIG authentication for DNS updates
5654

57-
Before deploying K8GB and the demo workload, ensure required configurations on Windows DNS
55+
Before deploying K8GB and the demo workload, ensure required configurations on Windows DNS
5856

5957
#### Domain Controller config
6058

6159
* Ensure that the Network Security is configured only for AES256
6260

63-
![Network Policy - Kerberos auth](/docs/examples/azure/images/LocalSecuryPolicyNetworkKerberos.png?raw=true "Network Policy - Kerberos auth")
61+
![Network Policy - Kerberos auth](/docs/examples/windowsdns/images/LocalSecuryPolicyNetworkKerberos.png?raw=true "Network Policy - Kerberos auth")
62+
6463
* Ensure that the DNS Zone has only Secure updates option enabled
6564

66-
![DNS Secure Updates](/docs/examples/azure/images/DNSSecureUpdates.png "DNS Secure Updates")
65+
![DNS Secure Updates](/docs/examples/windowsdns/images/DNSSecureUpdates.png "DNS Secure Updates")
66+
6767
* Ensure that the DNS Zone has the option "Allow zone transfers" check with the option "To any server" under the tab Zone Transfers on the zone properties
6868

69-
![DNS Zone Transfers](/docs/examples/azure/images/DNSZoneTransfers.png "DNS Zone Transfers")
69+
![DNS Zone Transfers](/docs/examples/windowsdns/images/DNSZoneTransfers.png "DNS Zone Transfers")
7070

7171
* Create a new Active Directory user
7272
* The user should be created with "Encryptions options" for Kerberos AES256 encryption
@@ -78,7 +78,7 @@ Before deploying K8GB and the demo workload, ensure required configurations on W
7878
* ExternalDNS configuration
7979
* For communication with WindowsDNS, ExternalDNS should be configured with the RFC2136 provider with GSS-TSIG option
8080
* [External DNS - RFC2126](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/rfc2136.md "RFC2136 documentation")
81-
* A sample values.yaml for K8GB configuration can be found [here](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/azure/k8gb/).
81+
* A sample values.yaml for K8GB configuration can be found [here](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/windowsdns/k8gb/).
8282
* Ensure that the following properties are updated with your values:
8383
* dnsZone
8484
* edgeDNSZone
@@ -87,12 +87,13 @@ Before deploying K8GB and the demo workload, ensure required configurations on W
8787
* kerberos-username
8888
* kerberos-password
8989
* kerberos-realm
90-
* At this moment ExternalDNS doesn't provide a way to use secrets as the source for the kerberos-password setting, so if you store the manifest in a git repo, please ensure that only required persons can access it
90+
* At this moment ExternalDNS doesn't provide a way to use secrets as the source for the kerberos-password setting, so you must ensure this is stored in a secure way
91+
9192
```yaml
9293
rfc2136:
9394
enabled: true
9495
rfc2136Opts:
95-
- host: AD-DC.mbcpk8gb.local #when using gssTsig, use the FQDN of the host, not an IP
96+
- host: AD-DC.k8gb.local #when using gssTsig, use the FQDN of the host, not an IP
9697
- port: 53
9798
rfc2136auth:
9899
insecure:
@@ -107,28 +108,30 @@ rfc2136:
107108
gssTsigCreds:
108109
- kerberos-username: ad-user-account
109110
- kerberos-password: ad-user-account-password
110-
- kerberos-realm: mbcpcloud.lab
111+
- kerberos-realm: cloud.lab
111112
```
112113
113114
### Install K8gb
114115
115-
This action will install K8gb in both clusters using the provided [sample](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/azure/k8gb/) values.yaml for each cluster. Please ensure that the are correctly updated before execution
116+
This action will install K8gb in both clusters using the provided [sample](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/windowsdns/k8gb/) values.yaml for each cluster. Please ensure that the are correctly updated before execution
116117
117118
```sh
118119
make deploy-k8gb
119120
```
120121

121122
### Install demo app
122123

123-
Deploys the sample Podinfo workload with failover GLSB configured using annotations in the Ingress resource [samples](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/azure/demo/).
124+
Deploys the sample Podinfo workload with failover GLSB configured using annotations in the Ingress resource [samples](https://github.com/k8gb-io/k8gb/tree/master/docs/examples/windowsdns/demo/).
124125
Ensure that the hosts on the samples are correctly updated before execution
125126

126127
```sh
127128
make deploy-demo
128129
```
129130

130131
### Destroy lab
132+
131133
* Destroys the lab environment created for this sample
134+
132135
```sh
133136
make destroy-infra
134137
```

‎docs/examples/azure/demo/aks1-podinfo-values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ui:
2+
message: aks1

0 commit comments

Comments
 (0)