使用 Azure Active Directory 将 Kubernetes 部署到 Azure Stack HubDeploy Kubernetes to Azure Stack Hub using Azure Active Directory

备注

仅使用 Kubernetes Azure Stack 市场项将部署群集作为概念证明。Only use the Kubernetes Azure Stack Marketplace item to deploy clusters as a proof-of-concept. 有关 Azure Stack 上支持的 Kubernetes 群集,请使用 AKS 引擎For supported Kubernetes clusters on Azure Stack, use the AKS engine.

在单个协调操作中使用 Azure Active Directory (Azure AD) 作为标识管理服务时,可以按照本文中的步骤部署和设置 Kubernetes 的资源。You can follow the steps in this article to deploy and set up the resources for Kubernetes, when using Azure Active Directory (Azure AD) as your identity management service, in a single, coordinated operation.

先决条件Prerequisites

开始之前,请确保你有适当的权限且 Azure Stack Hub 已就绪。To get started, make sure you have the right permissions and that your Azure Stack Hub is ready.

  1. 验证是否可以在 Azure Active Directory (Azure AD) 租户中创建应用程序。Verify that you can create applications in your Azure Active Directory (Azure AD) tenant. 需要这些权限才能进行 Kubernetes 部署。You need these permissions for the Kubernetes deployment.

    有关如何检查权限的说明,请参阅检查 Azure Active Directory 权限For instructions on checking your permissions, see Check Azure Active Directory permissions.

  2. 生成一个 SSH 公钥和私钥对,用于登录到 Azure Stack Hub 上的 Linux VM。Generate an SSH public and private key pair to sign in to the Linux VM on Azure Stack Hub. 在创建群集时需要此公钥。You will need the public key when creating the cluster.

    有关如何生成密钥的说明,请参阅 SSH 密钥生成For instructions on generating a key, see SSH Key Generation.

  3. 检查你在 Azure Stack Hub 租户门户中是否有有效的订阅,以及是否有足够的公共 IP 地址来添加新的应用程序。Check that you have a valid subscription in your Azure Stack Hub tenant portal, and that you have enough public IP addresses available to add new applications.

    此群集不能部署到 Azure Stack Hub“管理员”订阅。The cluster cannot be deployed to an Azure Stack Hub Administrator subscription. 必须使用用户订阅。You must use a User subscription.

  4. 如果你的市场中没有 Kubernetes 群集,请联系 Azure Stack Hub 管理员。If you do not have Kubernetes Cluster in your marketplace, talk to your Azure Stack Hub administrator.

创建服务主体Create a service principal

在 Azure 中设置服务主体。Set up a service principal in Azure. 借助服务主体,应用程序可以访问 Azure Stack Hub 资源。The service principal gives your application access to Azure Stack Hub resources.

  1. 登录到全球 Azure 门户Sign in to the global Azure portal.

  2. 检查是否已使用与 Azure Stack Hub 实例关联的 Azure AD 租户登录。Check that you signed in using the Azure AD tenant associated with the Azure Stack Hub instance. 可以通过单击 Azure 工具栏上的筛选器图标切换你的登录。You can switch your sign-in by clicking the filter icon in the Azure toolbar.

    选择你的 AD 租户

  3. 创建 Azure AD 应用程序。Create an Azure AD application.

    a.a. 通过 Azure 门户登录到 Azure 帐户。Sign in to your Azure Account through the Azure portal.
    b.b. 选择“Azure Active Directory” > “应用注册” > “新建注册”。 Select Azure Active Directory > App registrations > New registration.
    c.c. 为应用提供名称和 URL。Provide a name and URL for the application.
    d.d. 选择“支持的帐户类型”。Select the Supported account types.
    e.e. 为应用程序的 URI 添加 http://localhostAdd http://localhost for the URI for the application. 选择“Web”作为要创建的应用程序的类型。Select Web for the type of application you want to create. 设置这些值后,选择“注册”。After setting the values, select Register.

  4. 记下“应用程序 ID”。Make note of the Application ID. 在创建群集时需要此 ID。You will need the ID when creating the cluster. 此 ID 称为“服务主体客户端 ID”。The ID is referenced as Service Principal Client ID.

  5. 在服务主体的边栏选项卡中,选择“新客户端机密”。In the blade for the service principle, select New client secret. “设置” > “密钥” 。Settings > Keys. 需要为服务主体生成身份验证密钥。You need to generate an authentication key for the service principle.

    a.a. 输入“说明”。Enter the Description.

    b.b. 对于“过期”这一项,请选择“永不过期”。 Select Never expires for Expires.

    c.c. 选择“添加” 。Select Add. 记下密钥字符串。Make note the key string. 在创建群集时需要此密钥字符串。You will need the key string when creating the cluster. 此密钥称为“服务主体客户端机密”。The key is referenced as the Service Principal Client Secret.

为服务主体提供访问权限Give the service principal access

为服务主体提供对订阅的访问权限,使该主体能够创建资源。Give the service principal access to your subscription so that the principal can create resources.

  1. 登录到 Azure Stack Hub 门户 https://portal.local.azurestack.external/Sign in to the Azure Stack Hub portal https://portal.local.azurestack.external/.

  2. 选择“所有服务” > “订阅”。 Select All services > Subscriptions.

  3. 选择你的操作员创建的用于使用 Kubernetes 群集的订阅。Select the subscription created by your operator for using the Kubernetes Cluster.

  4. 选择“访问控制(IAM)”> 选择“添加角色分配” 。Select Access control (IAM) > Select Add role assignment.

  5. 选择“参与者”角色。Select the Contributor role.

  6. 选择为服务主体创建的应用程序名称。Select the application name created for your service principal. 可能需要在搜索框中键入名称。You may have to type the name in the search box.

  7. 单击“保存” 。Click Save.

部署 KubernetesDeploy Kubernetes

  1. 打开 Azure Stack Hub 门户 https://portal.local.azurestack.externalOpen the Azure Stack Hub portal https://portal.local.azurestack.external.

  2. 选择“+ 创建资源” > “计算” > “Kubernetes 群集”。Select + Create a resource > Compute > Kubernetes Cluster. 单击创建Click Create.

    部署解决方案模板

1.基础知识1. Basics

  1. 在“创建 Kubernetes 群集”中选择“基本信息”。Select Basics in Create Kubernetes Cluster.

    部署解决方案模板

  2. 选择订阅 ID。Select your Subscription ID.

  3. 输入新资源组的名称,或者选择现有资源组。Enter the name of a new resource group or select an existing resource group. 资源名称必须为字母数字,且必须小写。The resource name needs to be alphanumeric and lowercase.

  4. 选择资源组的“位置”。Select the Location of the resource group. 这是为 Azure Stack Hub 安装选择的区域。This is the region you choose for your Azure Stack Hub installation.

2.Kubernetes 群集设置2. Kubernetes Cluster Settings

  1. 在“创建 Kubernetes 群集”中选择“Kubernetes 群集设置”。Select Kubernetes Cluster Settings in Create Kubernetes Cluster.

    部署解决方案模板

  2. 输入 Linux VM 管理员用户名。Enter the Linux VM admin username. 构成 Kubernetes 群集和 DVM 的 Linux 虚拟机的用户名。User name for the Linux Virtual Machines that are part of the Kubernetes cluster and DVM.

  3. 输入 SSH 公钥,用于向所有作为 Kubernetes 群集和 DVM 的一部分创建的 Linux 计算机授权。Enter the SSH Public Key used for authorization to all Linux machines created as part of the Kubernetes cluster and DVM.

  4. 输入特定于区域的主配置文件 DNS 前缀Enter the Master Profile DNS Prefix that is unique to the region. 这必须是特定于区域的名称,例如 k8s-12345This must be a region-unique name, such as k8s-12345. 最佳做法是尝试选择与资源组名称相同的名称。Try to chose it same as the resource group name as best practice.

    备注

    为每个群集使用新且唯一的主配置文件 DNS 前缀。For each cluster, use a new and unique master profile DNS prefix.

  5. 选择“Kubernetes 主池配置文件计数”。Select the Kubernetes master pool profile count. 此计数包含主池中的节点数。The count contains the number of nodes in the master pool. 其范围为 1 到 7。There can be from 1 to 7. 此值应当为奇数。This value should be an odd number.

  6. 选择“Kubernetes 主 VM 的 VMSize”。Select The VMSize of the Kubernetes master VMs. 这指定 Kubernetes 主 VM 的 VM 大小。This specifies the VM Size of Kubernetes master VMs.

  7. 选择“Kubernetes 节点池配置文件计数”。Select the Kubernetes node pool profile count. 此计数包含群集中的代理数。The count contains the number of agents in the cluster.

  8. 选择“Kubernetes 节点 VM 的 VMSize”。Select the VMSize of the Kubernetes node VMs. 这指定 Kubernetes 节点 VM 的 VM 大小。This specifies the VM Size of Kubernetes node VMs.

  9. 对于 Azure Stack Hub 安装,为“Azure Stack Hub 标识系统”选择 Azure AD 。Select Azure AD for the Azure Stack Hub identity system for your Azure Stack Hub installation.

  10. 输入“服务主体 ClientId”,供 Kubernetes Azure 云提供程序使用。Enter the Service principal clientId This is used by the Kubernetes Azure cloud provider. Azure Stack Hub 管理员创建服务主体时标识为应用程序 ID 的客户端 ID。The Client ID identified as the Application ID when your Azure Stack Hub administrator created the service principal.

  11. 输入“服务主体客户端机密”。Enter the Service principal client secret. 这是在创建服务时设置的客户端机密。This is the client secret you set up when creating your service.

  12. 输入“Kubernetes 版本”。Enter the Kubernetes version. 这是 Kubernetes Azure 提供程序的版本。This is the version for the Kubernetes Azure provider. Azure Stack Hub 为每个 Azure Stack Hub 版本发布一个自定义 Kubernetes 内部版本。Azure Stack Hub releases a custom Kubernetes build for each Azure Stack Hub version.

3.摘要3. Summary

  1. 选择“摘要”。Select Summary. 此边栏选项卡显示针对 Kubernetes 群集配置设置的验证消息。The blade displays a validation message for your Kubernetes Cluster configurations settings.

    部署解决方案模板

  2. 复查你的设置。Review your settings.

  3. 选择“确定”以部署群集。Select OK to deploy your cluster.

提示

如果对你的部署有疑问,可以在 Azure Stack Hub 论坛发布问题或查看是否已经有人回答了该问题。If you have questions about your deployment, you can post your question or see if someone has already answered the question in the Azure Stack Hub Forum.

后续步骤Next steps

连接到群集Connect to your cluster

启用 Kubernetes 仪表板Enable the Kubernetes Dashboard