Skip to content

Latest commit

 

History

History
136 lines (99 loc) · 5.04 KB

deploy.md

File metadata and controls

136 lines (99 loc) · 5.04 KB
Raw

Deployment

Overview

It is possible to deploy the solution

  1. As a normal ARM template deployment
  2. As a catalog managed application
  3. As a marketplace managed application

Whilst the goal is to deploy as a marketplace application, it is usually more convenient to test using the other two approaches. Testing a marketplace application involves a publishing step which takes a few hours, even for preview. Reserve marketplace testing for a final step.

Pre-reqs

You will need your own copy of this repo to complete all the steps as you need to create GitHub action secrets for your deployment. I would recommend either forking or duplicating this repo now.

Before any deployment the following resources must exist in the publisher tenant:

  • A Key vault (KV) resource
  • An Container registry (ACR) resource

  1. Create a new resource group called managed-app-aks-publisher-source to host these resources

    • If you pick a different name, make sure you update it in the command below and the main Bicep template

  2. The following Azure CLI command will create the resources

    az deployment group create \
--name 'prereqs' \
--resource-group 'managed-app-aks-publisher-source' \
--template-file './bicep/prereqs.bicep' \
--parameters \
kvname='[INSERT UNIQUE NAME FOR THE KEY VAULT]' \
objectId='[INSERT THE OBJECT ID OF YOUR USER IDENTITY]'

  3. You can use az ad signed-in-user show --query id to get your objectId

  4. You will be prompted for the securestring values:

    1. backgroundColor - set this to a valid HTML color name eg 'MediumSeaGreen'
    2. infoMessage - set this to any string eg 'Hello!'
    3. acrToken - set this to any empty string for now

  5. Update the Bicep template bicep/mainTemplate.bicep - change the default values of:

    • vaultName from 'kv-managedapps' to whatever you named your KV above
    • vaultResourceGroupName if you didn't use ManagedAppsSource
    • vaultSubscriptionId from '' to the subscription ID where the KV resides

  6. Save mainTemplate.bicep

Configuration

ACR resource

  1. Pull the latest Inspector Gadget image

    docker pull jelledruyts/inspectorgadget

  1. Tag the image

    docker tag jelledruyts/inspectorgadget <acrname>.azurecr.io/inspectorgadget

  1. Authenticate with the container registry

    • You will need the username and password for the container registry
    • You will find these on the Access Keys blade of the portal
    • Enable Admin user to reveal the username & password
    docker login <acrname>.azurecr.io

  1. Push the image to your registry eg

    docker push <acrname>.azurecr.io/inspectorgadget
  1. Capture the credentials

    1. The login process creates / updates a config.json file with an auth token

    2. View the config file

      cat ~/.docker/config.json

    3. The output should look similar to this

      {
    "auths": {
            "<acrname>.azurecr.io": {
                    "auth": "bWVvY...."
            }
    }
}

    4. Make sure you have an entry for the correct container registry (and no other entries)

    5. base64 encode the contents of the file

      base64 ~/.docker/config.json

    6. Carefully copy the output to be stored in the acr-token in the next step

      • You may find that the output includes CR/LF characters. This will break things
      • Delete any CR/LF characters before copying the base64 encoded string

This docker image will be pulled by the AKS cluster pods.

For more details see Pull an Image from a Private Registry in the Kuberetes documentation.

KV resource

  1. Create three secrets
    • acr-token paste in the base64 secret you generated in the previous step
    • Set the Content type for acr-token secret to base64
  2. On the Access control (IAM) blade
    • Add a role assignment
    • Assign the Contributor role to the Appliance Resource Provider user at the key vault scope

The acr-token is used to authenticate with ACR to pull the private image. info-message will be displayed on the inspector gadget site and the background will be set to background-color.

For more details see Access Key Vault secret when deploying Azure Managed Applications

Choose deployment method

Choose your path (ordered quickest / simplest first)