使用 Azure Active Directory 将 Kubernetes 部署到 Azure Stack 中心Deploy Kubernetes to Azure Stack Hub using Azure Active Directory

备注

仅使用 Kubernetes Azure Stack Marketplace 项将群集部署为概念证明。Only use the Kubernetes Azure Stack Marketplace item to deploy clusters as a proof-of-concept. 有关 Azure Stack 上支持的 Kubernetes 群集,请使用AKS 引擎For supported Kubernetes clusters on Azure Stack, use the AKS engine.

使用 Azure Active Directory (Azure AD)作为标识管理服务时,你可以按照本文中的步骤为 Kubernetes 部署和设置资源,只需要一个协调的操作即可。You can follow the steps in this article to deploy and set up the resources for Kubernetes, when using Azure Active Directory (Azure AD) as your identity management service, in a single, coordinated operation.

必备组件Prerequisites

若要开始,请确保具有适当的权限,并且 Azure Stack 中心已准备就绪。To get started, make sure you have the right permissions and that your Azure Stack Hub is ready.

  1. 验证是否可以在 Azure Active Directory (Azure AD)租户中创建应用程序。Verify that you can create applications in your Azure Active Directory (Azure AD) tenant. 对于 Kubernetes 部署,你需要这些权限。You need these permissions for the Kubernetes deployment.

    有关检查权限的说明,请参阅检查 Azure Active Directory 权限For instructions on checking your permissions, see Check Azure Active Directory permissions.

  2. 生成 SSH 公钥和私钥对,用于登录到 Azure Stack 集线器上的 Linux VM。Generate an SSH public and private key pair to sign in to the Linux VM on Azure Stack Hub. 创建群集时需要公钥。You will need the public key when creating the cluster.

    有关生成密钥的说明,请参阅SSH 密钥生成For instructions on generating a key, see SSH Key Generation.

  3. 请检查 Azure Stack 中心租户门户中是否有有效的订阅,以及是否有足够的公共 IP 地址可用于添加新的应用程序。Check that you have a valid subscription in your Azure Stack Hub tenant portal, and that you have enough public IP addresses available to add new applications.

    无法将群集部署到 Azure Stack 中心管理员订阅。The cluster cannot be deployed to an Azure Stack Hub Administrator subscription. 必须使用用户订阅。You must use a User subscription.

  4. 如果 marketplace 中没有 Kubernetes 群集,请向 Azure Stack 中心管理员咨询。If you do not have Kubernetes Cluster in your marketplace, talk to your Azure Stack Hub administrator.

创建服务主体Create a service principal

在 Azure 中设置服务主体。Set up a service principal in Azure. 服务主体允许应用程序访问 Azure Stack 集线器资源。The service principal gives your application access to Azure Stack Hub resources.

  1. 登录到全局Azure 门户Sign in to the global Azure portal.

  2. 检查是否已使用与 Azure Stack 中心实例关联的 Azure AD 租户登录。Check that you signed in using the Azure AD tenant associated with the Azure Stack Hub instance. 可以通过单击 Azure 工具栏中的 "筛选器" 图标来切换登录。You can switch your sign-in by clicking the filter icon in the Azure toolbar.

    选择 AD 租户

  3. 创建 Azure AD 应用程序。Create an Azure AD application.

    a.在“解决方案资源管理器”中,右键单击项目文件夹下的“引用”文件夹,然后单击“添加引用”。a. 通过 Azure 门户登录到 Azure 帐户。Sign in to your Azure Account through the Azure portal.
    b.保留“数据库类型”设置,即设置为“共享”。b. 选择 " Azure Active Directory > 应用注册" > "新注册"。Select Azure Active Directory > App registrations > New registration.
    c.c. 为应用提供名称和 URL。Provide a name and URL for the application.
    d.单击“下一步”。d. 选择支持的帐户类型Select the Supported account types.
    e.在“新建 MySQL 数据库”边栏选项卡中,接受法律条款,然后单击“确定”。e. 添加应用程序的 URI http://localhostAdd http://localhost for the URI for the application. 选择要创建的应用程序类型的 " Web "。Select Web for the type of application you want to create. 设置值后,选择 "注册"。After setting the values, select Register.

  4. 请记下应用程序 IDMake note of the Application ID. 创建群集时,你将需要 ID。You will need the ID when creating the cluster. 该 ID 被称为 "服务主体客户端 ID"。The ID is referenced as Service Principal Client ID.

  5. 在服务主体的边栏选项卡中,选择 "新建客户端密码"。In the blade for the service principle, select New client secret. 设置 > Settings > Keys. 需要为服务主体生成身份验证密钥。You need to generate an authentication key for the service principle.

    a.在“解决方案资源管理器”中,右键单击项目文件夹下的“引用”文件夹,然后单击“添加引用”。a. 输入“说明”。Enter the Description.

    b.保留“数据库类型”设置,即设置为“共享”。b. 对于“过期”这一项,请选择“永不过期”。Select Never expires for Expires.

    c.c. 选择 添加Select Add. 记下密钥字符串。Make note the key string. 创建群集时,需要密钥字符串。You will need the key string when creating the cluster. 密钥被称为服务主体客户端机密The key is referenced as the Service Principal Client Secret.

为服务主体提供访问权限Give the service principal access

向服务主体授予对订阅的访问权限,以便主体能够创建资源。Give the service principal access to your subscription so that the principal can create resources.

  1. 登录到Azure Stack 中心门户Sign in to the Azure Stack Hub portal.

  2. 选择 "所有服务" > 订阅Select All services > Subscriptions.

  3. 选择操作员为使用 Kubernetes 群集创建的订阅。Select the subscription created by your operator for using the Kubernetes Cluster.

  4. 选择 "访问控制(IAM) " > 选择 "添加角色分配"。Select Access control (IAM) > Select Add role assignment.

  5. 选择 "参与者" 角色。Select the Contributor role.

  6. 选择为服务主体创建的应用程序名称。Select the application name created for your service principal. 可能需要在搜索框中键入名称。You may have to type the name in the search box.

  7. 单击“ 保存”。Click Save.

部署 KubernetesDeploy Kubernetes

  1. 打开Azure Stack 集线器门户Open the Azure Stack Hub portal.

  2. 选择 " + 创建资源" > 计算 > Kubernetes 群集"。Select + Create a resource > Compute > Kubernetes Cluster. 单击“创建”。Click Create.

    部署解决方案模板

1. 基础知识1. Basics

  1. 选择创建 Kubernetes 群集中的基础知识Select Basics in Create Kubernetes Cluster.

    部署解决方案模板

  2. 选择订阅ID。Select your Subscription ID.

  3. 输入新资源组的名称,或者选择现有资源组。Enter the name of a new resource group or select an existing resource group. 资源名称必须为字母数字,且必须小写。The resource name needs to be alphanumeric and lowercase.

  4. 选择资源组的“位置”。Select the Location of the resource group. 这是你为 Azure Stack 集线器安装选择的区域。This is the region you choose for your Azure Stack Hub installation.

2. Kubernetes 群集设置2. Kubernetes Cluster Settings

  1. 选择 "创建 Kubernetes 群集中的Kubernetes 群集设置"。Select Kubernetes Cluster Settings in Create Kubernetes Cluster.

    部署解决方案模板

  2. 输入LINUX VM 管理员用户名Enter the Linux VM admin username. 构成 Kubernetes 群集和 DVM 的 Linux 虚拟机的用户名。User name for the Linux Virtual Machines that are part of the Kubernetes cluster and DVM.

  3. 输入 SSH 公钥,用于向所有作为 Kubernetes 群集和 DVM 的一部分创建的 Linux 计算机授权。Enter the SSH Public Key used for authorization to all Linux machines created as part of the Kubernetes cluster and DVM.

  4. 输入特定于区域的主配置文件 DNS 前缀Enter the Master Profile DNS Prefix that is unique to the region. 此名称必须是区域唯一名称,如 k8s-12345This must be a region-unique name, such as k8s-12345. 尝试选择与资源组名称相同的最佳实践。Try to chose it same as the resource group name as best practice.

    备注

    为每个群集使用新且唯一的主配置文件 DNS 前缀。For each cluster, use a new and unique master profile DNS prefix.

  5. 选择Kubernetes 主池配置文件计数Select the Kubernetes master pool profile count. 计数包含主池中的节点数。The count contains the number of nodes in the master pool. 可能有1到7之间。There can be from 1 to 7. 此值应为奇数。This value should be an odd number.

  6. 选择Kubernetes 主 vm 的 VMSizeSelect The VMSize of the Kubernetes master VMs. 这将指定 Kubernetes 主 Vm 的 VM 大小。This specifies the VM Size of Kubernetes master VMs.

  7. 选择Kubernetes 节点池配置文件计数Select the Kubernetes node pool profile count. 此计数包含群集中的代理数。The count contains the number of agents in the cluster.

  8. 选择Kubernetes 节点 vm 的 VMSizeSelect the VMSize of the Kubernetes node VMs. 这将指定 Kubernetes 节点 Vm 的 VM 大小。This specifies the VM Size of Kubernetes node VMs.

  9. 为 Azure Stack Hub 安装选择Azure Stack 集线器标识系统 Azure ADSelect Azure AD for the Azure Stack Hub identity system for your Azure Stack Hub installation.

  10. 输入服务主体 clientId这由 Kubernetes Azure 云提供程序使用。Enter the Service principal clientId This is used by the Kubernetes Azure cloud provider. Azure Stack 中心管理员创建服务主体时标识为应用程序 ID 的客户端 ID。The Client ID identified as the Application ID when your Azure Stack Hub administrator created the service principal.

  11. 输入服务主体客户端机密Enter the Service principal client secret. 这是你在创建服务时设置的客户端密码。This is the client secret you set up when creating your service.

  12. 输入Kubernetes 版本Enter the Kubernetes version. 这是 Kubernetes Azure 提供程序的版本。This is the version for the Kubernetes Azure provider. Azure Stack 中心为每个 Azure Stack 中心版本发布自定义 Kubernetes 生成。Azure Stack Hub releases a custom Kubernetes build for each Azure Stack Hub version.

3. 摘要3. Summary

  1. 选择 "摘要"。Select Summary. 边栏选项卡会显示 Kubernetes 群集配置设置的验证消息。The blade displays a validation message for your Kubernetes Cluster configurations settings.

    部署解决方案模板

  2. 检查设置。Review your settings.

  3. 选择 "确定" 以部署群集。Select OK to deploy your cluster.

提示

如果你对部署有任何疑问,则可以发布问题,或者查看是否有人在Azure Stack 中心论坛中回答了问题。If you have questions about your deployment, you can post your question or see if someone has already answered the question in the Azure Stack Hub Forum.

后续步骤Next steps

连接到群集Connect to your cluster

启用 Kubernetes 仪表板Enable the Kubernetes Dashboard