AKS Deployment in Azure Stack Hub - Service principal identity (SPN) about aks-engine HOT 6 CLOSED

Hi, @zohebs341! Opening issues in this AKS Engine repo unfortunately will not get you any answers about deploying AKS in Azure Stack Hub. Please open an issue in the Azure Stack Docs repo https://github.com/MicrosoftDocs/azure-stack-docs/issues so that team can guide you in the right direction - thanks!

from aks-engine.

Hello @zohebs341, I can answer quickly.

How can I renew it in the future as the validation will be one year for that secret?

You can either execute aks-engine upgrade using the new secret, deploy a new cluster or manually update /etc/kubernetes/azure.json on each node.

If the secret is expired then the cluster will not be operational/functional.

True, operations that require K8s to CRUD IaaS resources will fail.

Or do I need to contact the Azure Stack Hub cloud operator to provide Service Principal name/secret details

You would need just a new secret for the SPN.

from aks-engine.

@jadarsie Thank you Javier.

If I use aks-engine upgrade command with new SPN client ID/client Secret. It will just upgrade existing cluster right? Rather than creating a new cluster. I mean to say, existing VMs/LoadBalncers/ deployed applications will remain unchanged.

New Client ID & Secret with below command is fine I guess?

aks-engine upgrade
--azure-env AzureStackCloud
--location xyz
--resource-group kube-rg
--subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
--api-model kube-rg/apimodel.json
--client-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
--client-secret xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
--force

from aks-engine.

I would also update servicePrincipalProfile just in case.

existing VMs/LoadBalncers/ deployed applications will remain unchanged

VMs will be recreated and pods moved around, storage is something else to consider, please read this.

Depending on your capacity/networking constraints and/or the type of deployed applications, it may be worthwhile considering a cluster upgrade process that consists of creating new clusters instead of upgrading existing ones.

from aks-engine.

@jadarsie Hi Javier.

For secrets, we can create an SPN first and then create a secret with an expiry of 2 years right? at least, in this case, the secret expiry will be for two years rather than one year.

from aks-engine.

yes you can

from aks-engine.