Connect with RDP to Azure Kubernetes Service (AKS) cluster Windows Server nodes for maintenance or troubleshooting

This article assumes that you have an existing AKS cluster with a Windows Server node. If you need an AKS cluster, see the article on creating an AKS cluster with a Windows container using the Azure CLI. You need the Windows administrator username and password for the Windows Server node you want to troubleshoot. You also need an RDP client such as Microsoft Remote Desktop.

If you need to reset the password, use az aks update to change the password.

az aks update --resource-group myResourceGroup --name myAKSCluster --windows-admin-password $WINDOWS_ADMIN_PASSWORD

If you need to reset the username and password, see Reset Remote Desktop Services or its administrator password in a Windows VM.

You also need the Azure CLI version 2.0.61 or later installed and configured. Run az --version to find the version. If you need to install or upgrade, see Install Azure CLI.

This article assumes that you have an existing AKS cluster with a Windows Server node. If you need an AKS cluster, see the article on creating an AKS cluster with a Windows container using the Azure PowerShell. You need the Windows administrator username and password for the Windows Server node you want to troubleshoot. You also need an RDP client such as Microsoft Remote Desktop.

If you need to reset the password, use Set-AzAksCluster to change the password.

$cluster = Get-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster
$cluster.WindowsProfile.AdminPassword = $WINDOWS_ADMIN_PASSWORD
$cluster | Set-AzAksCluster

If you need to reset the username and password, see Reset Remote Desktop Services or its administrator password in a Windows VM .

You also need the Azure PowerShell version 7.5.0 or later installed and configured. Run Get-InstalledModule -Name Az to find the version. If you need to install or upgrade, see Install Azure PowerShell.

You need to get the subnet ID used by your Windows Server node pool and query for:

• The cluster's node resource group
• The virtual network
• The subnet's name
• The subnet ID

CLUSTER_RG=$(az aks show --resource-group myResourceGroup --name myAKSCluster --query nodeResourceGroup -o tsv)
VNET_NAME=$(az network vnet list --resource-group $CLUSTER_RG --query [0].name -o tsv)
SUBNET_NAME=$(az network vnet subnet list --resource-group $CLUSTER_RG --vnet-name $VNET_NAME --query [0].name -o tsv)
SUBNET_ID=$(az network vnet subnet show --resource-group $CLUSTER_RG --vnet-name $VNET_NAME --name $SUBNET_NAME --query id -o tsv)

Now that you've the SUBNET_ID, run the following command in the same Azure CLI console to create the VM:

PUBLIC_IP_ADDRESS="myVMPublicIP"

az vm create \
    --resource-group myResourceGroup \
    --name myVM \
    --image win2019datacenter \
    --admin-username azureuser \
    --admin-password {admin-password} \
    --subnet $SUBNET_ID \
    --nic-delete-option delete \
    --os-disk-delete-option delete \
    --nsg "" \
    --public-ip-address $PUBLIC_IP_ADDRESS \
    --query publicIpAddress -o tsv

The following example output shows the VM has been successfully created and displays the public IP address of the virtual machine.

13.62.204.18

Record the public IP address of the virtual machine. You'll use this address in a later step.

You'll need to get the subnet ID used by your Windows Server node pool and query for:

• The cluster's node resource group
• The virtual network
• The subnet's name and address prefix
• The subnet ID

$CLUSTER_RG = (Get-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster).nodeResourceGroup
$VNET_NAME = (Get-AzVirtualNetwork -ResourceGroupName $CLUSTER_RG).Name
$ADDRESS_PREFIX = (Get-AzVirtualNetwork -ResourceGroupName $CLUSTER_RG).AddressSpace | Select-Object -ExpandProperty AddressPrefixes
$SUBNET_NAME = (Get-AzVirtualNetwork -ResourceGroupName $CLUSTER_RG).Subnets[0].Name
$SUBNET_ADDRESS_PREFIX = (Get-AzVirtualNetwork -ResourceGroupName $CLUSTER_RG).Subnets[0] | Select-Object -ExpandProperty AddressPrefix

Now that you have the VNet and subnet details, run the following commands in the same Azure Powershell window to create the public IP address and VM:

$ipParams = @{
    Name              = 'myPublicIP'
    ResourceGroupName = 'myResourceGroup'
    Location          = 'chinaeast2'
    AllocationMethod  = 'Dynamic'
    IpAddressVersion  = 'IPv4'
}
New-AzPublicIpAddress @ipParams

$vmParams = @{
    ResourceGroupName            = 'myResourceGroup'
    Name                         = 'myVM'
    Image                        = 'win2019datacenter'
    Credential                   = Get-Credential azureuser
    VirtualNetworkName           = $VNET_NAME
    AddressPrefix                = $ADDRESS_PREFIX
    SubnetName                   = $SUBNET_NAME
    SubnetAddressPrefix          = $SUBNET_ADDRESS_PREFIX
    PublicIpAddressName          = 'myPublicIP'
    OSDiskDeleteOption           = 'Delete'
    NetworkInterfaceDeleteOption = 'Delete'
    DataDiskDeleteOption         = 'Delete'
}
New-AzVM @vmParams

(Get-AzPublicIpAddress -ResourceGroupName myResourceGroup -Name myPublicIP).IpAddress

The following example output shows the VM has been successfully created and displays the public IP address of the virtual machine.

13.62.204.18

Record the public IP address of the virtual machine and use the address in a later step.

First, get the resource group and name of the NSG to add the rule to:

CLUSTER_RG=$(az aks show --resource-group myResourceGroup --name myAKSCluster --query nodeResourceGroup -o tsv)
NSG_NAME=$(az network nsg list --resource-group $CLUSTER_RG --query [].name -o tsv)

Then, create the NSG rule:

az network nsg rule create \
 --name tempRDPAccess \
 --resource-group $CLUSTER_RG \
 --nsg-name $NSG_NAME \
 --priority 100 \
 --destination-port-range 3389 \
 --protocol Tcp \
 --description "Temporary RDP access to Windows nodes"

First, get the resource group and name of the NSG to add the rule to:

$CLUSTER_RG = (Get-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster).nodeResourceGroup
$NSG_NAME = (Get-AzNetworkSecurityGroup -ResourceGroupName $CLUSTER_RG).Name

Then, create the NSG rule:

$nsgRuleParams = @{
    Name                     = 'tempRDPAccess'
    Access                   = 'Allow'
    Direction                = 'Inbound'
    Priority                 = 100
    SourceAddressPrefix      = 'Internet'
    SourcePortRange          = '*'
    DestinationAddressPrefix = '*'
    DestinationPortRange     = '3389'
    Protocol                 = 'Tcp'
    Description              = 'Temporary RDP access to Windows nodes'
}
Get-AzNetworkSecurityGroup -Name $NSG_NAME -ResourceGroupName $CLUSTER_RG | Add-AzNetworkSecurityRuleConfig @nsgRuleParams | Set-AzNetworkSecurityGroup

To manage a Kubernetes cluster, you use kubectl, the Kubernetes command-line client. To install kubectl locally, use the az aks install-cli command:

az aks install-cli

To configure kubectl to connect to your Kubernetes cluster, use the az aks get-credentials command. This command downloads credentials and configures the Kubernetes CLI to use them.

az aks get-credentials --resource-group myResourceGroup --name myAKSCluster

To manage a Kubernetes cluster, you use kubectl, the Kubernetes command-line client. To install kubectl locally, use the Install-AzAksKubectl cmdlet:

Install-AzAksKubectl

To configure kubectl to connect to your Kubernetes cluster, use the Import-AzAksCredential cmdlet. This command downloads credentials and configures the Kubernetes CLI to use them.

Import-AzAksCredential -ResourceGroupName myResourceGroup -Name myAKSCluster

When done, exit the RDP connection to the Windows Server node then exit the RDP session to the virtual machine. After you exit both RDP sessions, delete the virtual machine with the az vm delete command:

# Delete the virtual machine
az vm delete \
 --resource-group myResourceGroup \
 --name myVM

Delete the public IP associated with the virtual machine:

az network public-ip delete \
 --resource-group myResourceGroup \
 --name $PUBLIC_IP_ADDRESS

Delete the NSG rule:

CLUSTER_RG=$(az aks show --resource-group myResourceGroup --name myAKSCluster --query nodeResourceGroup -o tsv)
NSG_NAME=$(az network nsg list --resource-group $CLUSTER_RG --query [].name -o tsv)
az network nsg rule delete \
 --resource-group $CLUSTER_RG \
 --nsg-name $NSG_NAME \
 --name tempRDPAccess

When done, exit the RDP connection to the Windows Server node then exit the RDP session to the virtual machine. After you exit both RDP sessions, delete the virtual machine with the Remove-AzVM command:

Remove-AzVM -ResourceGroupName myResourceGroup -Name myVM

Delete the public IP associated with the virtual machine:

Remove-AzPublicIpAddress -ResourceGroupName myResourceGroup -Name myPublicIP

Delete the NSG rule:

$CLUSTER_RG = (Get-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster).nodeResourceGroup
$NSG_NAME = (Get-AzNetworkSecurityGroup -ResourceGroupName $CLUSTER_RG).Name

Get-AzNetworkSecurityGroup -Name $NSG_NAME -ResourceGroupName $CLUSTER_RG | Remove-AzNetworkSecurityRuleConfig -Name tempRDPAccess | Set-AzNetworkSecurityGroup

Delete the NSG created by default from New-AzVM:

Remove-AzNetworkSecurityGroup -ResourceGroupName myResourceGroup -Name myVM

az aks show --name myAKSCluster --resource-group myResourceGroup --query 'nodeResourceGroup' -o tsv

(Get-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster).nodeResourceGroup