Azure AKS Deployment Guide

Prerequisites

Before deploying to Azure Kubernetes Service (AKS), ensure you have:

• Azure CLI installed and configured
• Kubernetes CLI (kubectl) installed
• Helm 3.x installed

Cluster Setup

1. Create a resource group:

az group create --name prime-edm-rg --location eastus

2. Create an AKS cluster:

az aks create \
  --resource-group prime-edm-rg \
  --name prime-edm-cluster \
  --node-count 3 \
  --enable-addons monitoring \
  --generate-ssh-keys

3. Get credentials:

az aks get-credentials --resource-group prime-edm-rg --name prime-edm-cluster

Installing Prime EDM Charts

1. Add the Helm repository:

helm repo add prime-edm https://charts.acx-sandbox.net --username $USER --password $PASSWORD
helm repo update

2. Create Azure-specific values:

# azure-values.yaml
global:
  provider: azure
  location: eastus

storage:
  class: managed-premium
  
serviceAccount:
  annotations:
    azure.workload.identity/client-id: CLIENT_ID

ingress:
  annotations:
    kubernetes.io/ingress.class: nginx

3. Install the chart:

helm install prime-edm prime-edm/prime-edm -f azure-values.yaml

Azure-Specific Configuration

Storage Classes

AKS provides several storage options:

storage:
  # Premium SSD
  class: managed-premium
  
  # Standard SSD
  # class: managed-standard
  
  # Standard HDD
  # class: managed-standard-hdd

Load Balancer

Using Azure Load Balancer:

service:
  type: LoadBalancer
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: "false"

Identity Management

Configure managed identities:

podIdentity:
  enabled: true
  userAssignedIdentityID: /subscriptions/SUB_ID/resourcegroups/RG_NAME/providers/Microsoft.ManagedIdentity/userAssignedIdentities/IDENTITY_NAME

Secrets Management

Azure Key Vault Setup

1. Create Key Vault:

az keyvault create \
  --name prime-edm-kv \
  --resource-group prime-edm-rg \
  --location eastus

2. Enable Managed Identity:

az aks update \
  --name prime-edm-cluster \
  --resource-group prime-edm-rg \
  --enable-managed-identity

3. Create role assignment:

az role assignment create \
  --role "Key Vault Secrets User" \
  --assignee $(az aks show -g prime-edm-rg -n prime-edm-cluster --query identityProfile.kubeletidentity.clientId -o tsv) \
  --scope $(az keyvault show --name prime-edm-kv --resource-group prime-edm-rg --query id -o tsv)

4. Install External Secrets Operator:

helm repo add external-secrets https://charts.external-secrets.io
helm repo update

helm install external-secrets \
  external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace \
  --set installCRDs=true

5. Create SecretStore:

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: azure-backend
spec:
  provider:
    azurekv:
      tenantId: "$(az account show --query tenantId -o tsv)"
      vaultUrl: "https://prime-edm-kv.vault.azure.net"
      authType: ManagedIdentity

6. Create ExternalSecret:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: azure-backend
    kind: SecretStore
  target:
    name: db-credentials
  data:
  - secretKey: username
    remoteRef:
      key: database-username
  - secretKey: password
    remoteRef:
      key: database-password

Monitoring

Azure Monitor Integration

Enable Azure Monitor:

monitoring:
  azureMonitor:
    enabled: true
    workspaceId: WORKSPACE_ID

Best Practices

1. Use node selectors:

nodeSelector:
  agentpool: prime-edm-pool

2. Configure resource limits:

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: 500m
    memory: 1Gi

3. Enable auto-scaling:

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

Troubleshooting

Common issues and solutions:

1. Storage provisioning:

   • Verify storage class exists
   • Check PVC status
   • Validate permissions

2. Network connectivity:

   • Review NSG rules
   • Check VNET configuration
   • Validate DNS settings

3. Identity issues:

   • Verify managed identity setup
   • Check role assignments
   • Validate pod identity configuration