azure.azcollection.azure_rm_aks module – Manage a managed Azure Container Service (AKS) instance
Note
This module is part of the azure.azcollection collection (version 3.1.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install azure.azcollection.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: azure.azcollection.azure_rm_aks.
New in azure.azcollection 0.1.2
Synopsis
Create, update and delete a managed Azure Container Service (AKS) instance.
You can only specify
identityorservice_principal, not both. If you don’t specify either it will default to identity->type->SystemAssigned.
Requirements
The below requirements are needed on the host that executes this module.
python >= 2.7
The host that executes this module must have the azure.azcollection collection installed via galaxy
All python packages listed in collection’s requirements.txt must be installed via pip on the host that executes modules from azure.azcollection
Full installation instructions may be found https://galaxy.ansible.com/azure/azcollection
Parameters
Parameter |
Comments |
|---|---|
Profile of Azure Active Directory configuration. |
|
AAD group object IDs that will have admin role of the cluster. |
|
The client AAD application ID. |
|
Whether to enable Azure RBAC for Kubernetes authorization. Choices:
|
|
Whether to enable managed AAD. Choices:
|
|
The server AAD application ID. |
|
The server AAD application secret. |
|
The AAD tenant ID to use for authentication. If not specified, will use the tenant of the deployment subscription. |
|
Active Directory username. Use when authenticating with an Active Directory user rather than service principal. |
|
Profile of managed cluster add-on. Key can be Value must be a dict contains a bool variable |
|
The HTTP application routing solution makes it easy to access applications that are deployed to your cluster. |
|
Whether the solution enabled. Choices:
|
|
It gives you performance visibility by collecting memory and processor metrics from controllers, nodes, and containers that are available in Kubernetes through the Metrics API. |
|
Whether the solution enabled. Choices:
|
|
Where to store the container metrics. |
|
With virtual nodes, you have quick provisioning of pods, and only pay per second for their execution time. You don’t need to wait for Kubernetes cluster autoscaler to deploy VM compute nodes to run the additional pods. |
|
Whether the solution enabled. Choices:
|
|
Subnet associated to the cluster. |
|
Azure AD authority url. Use when authenticating with Username/password, and has your own ADFS authority. |
|
The agent pool profile suboptions. |
|
Availability zones for nodes. Must use VirtualMachineScaleSets AgentPoolType. Choices:
|
|
Number of agents (VMs) to host docker containers. Allowed values must be in the range of |
|
DNS prefix specified when creating the managed cluster. |
|
To enable auto-scaling. Choices:
|
|
Maximum number of nodes for auto-scaling. Required if enable_auto_scaling=True. |
|
Maximum number of pods schedulable on nodes. |
|
Minmum number of nodes for auto-scaling. Required if enable_auto_scaling=True. |
|
AgentPoolMode represents mode of an agent pool. Possible values include System AgentPoolMode requires a minimum VM SKU of at least 2 vCPUs and 4GB memory. Choices:
|
|
Unique name of the agent pool profile in the context of the subscription and resource group. |
|
Agent pool node labels to be persisted across all nodes in agent pool. |
|
Version of kubernetes running on the node pool. |
|
Size of the OS disk. |
|
The operating system sku. Choices:
|
|
The operating system type. Choices:
|
|
List of the agent pool’s port. |
|
The security settings of an agent pool. |
|
Whether to disable or enabled the secure boot. Choices:
|
|
Whether to disable or enabled the vTPM. Choices:
|
|
Storage profile specifies what kind of storage used. Choices:
|
|
The tags to be persisted on the agent pool virtual machine scale set. |
|
AgentPoolType represents types of an agent pool. Possible values include Choices:
|
|
The VM Size of each of the Agent Pool VM’s (e.g. |
|
Specifies the VNet’s subnet identifier. |
|
Selects an API profile to use when communicating with Azure services. Default value of Default: |
|
Profile of API Access configuration. |
|
Authorized IP Ranges to kubernetes API server. Cannot be enabled when using private cluster |
|
Whether to create the cluster as a private cluster or not. Cannot be changed for an existing cluster. Choices:
|
|
Use to control if tags field is canonical or just appends to existing tags. When canonical, any tags not found in the tags parameter will be removed from the object’s metadata. Choices:
|
|
Controls the source of the credentials to use for authentication. Can also be set via the When set to When set to When set to When set to When set to The Choices:
|
|
Auto upgrade profile for a managed cluster. |
|
Manner in which the OS on your nodes is updated. Choices:
|
|
Setting the AKS cluster auto-upgrade channel. Choices:
|
|
Controls the certificate validation behavior for Azure endpoints. By default, all modules will validate the server certificate, but when an HTTPS proxy is in use, or against Azure Stack, it may be necessary to disable this behavior by passing Choices:
|
|
Azure client ID. Use when authenticating with a Service Principal or Managed Identity (msi). Can also be set via the |
|
For cloud environments other than the US public cloud, the environment name (as defined by Azure Python SDK, eg, Default: |
|
Determines whether or not instance discovery is performed when attempting to authenticate. Setting this to true will completely disable both instance discovery and authority validation. This functionality is intended for use in scenarios where the metadata endpoint cannot be reached such as in private clouds or Azure Stack. The process of instance discovery entails retrieving authority metadata from https://login.microsoft.com/ to validate the authority. By setting this to **True**, the validation of the authority is disabled. As a result, it is crucial to ensure that the configured authority host is valid and trustworthy. Set via credential file profile or the Choices:
|
|
If set to true, getting static credentials will be disabled for this cluster. This must only be used on Managed Clusters that are AAD enabled. Choices:
|
|
DNS prefix specified when creating the managed cluster. |
|
Enable RBAC. Existing non-RBAC enabled AKS clusters cannot currently be updated for RBAC use. Choices:
|
|
Identity for the Server. |
|
Type of the managed identity Choices:
|
|
User Assigned Managed Identity |
|
Version of Kubernetes specified when creating the managed cluster. |
|
The Linux profile suboptions. Optional, provide if you need an ssh access to the cluster nodes. |
|
The Admin Username for the cluster. |
|
The Public SSH Key used to access the cluster. |
|
Valid azure location. Defaults to location of the resource group. |
|
Parent argument. |
|
Parent argument. |
|
Name of the managed Azure Container Services (AKS) instance. |
|
Profile of network configuration. |
|
An IP address assigned to the Kubernetes DNS service. It must be within the Kubernetes service address range specified in serviceCidr. |
|
The load balancer sku for the managed cluster. Choices:
|
|
Network plugin used for building Kubernetes network. This property cannot been changed. With AKS features such as Virtual Nodes or network policies aren’t supported with
Choices:
|
|
Network plugin mode used for building the Kubernetes network. Choices:
|
|
Network policy used for building Kubernetes network. Choices:
|
|
How outbound traffic will be configured for a cluster. Choices:
|
|
A CIDR notation IP range from which to assign pod IPs when network_plugin=kubenet is used. It should be a large address space that isn’t in use elsewhere in your network environment. This address range must be large enough to accommodate the number of nodes that you expect to scale up to. |
|
A CIDR notation IP range from which to assign service cluster IPs. It must not overlap with any Subnet IP ranges. It should be the *.10 address of your service IP address range. |
|
Name of the resource group containing agent pool nodes. Unable to update. |
|
Active Directory user password. Use when authenticating with an Active Directory user rather than service principal. |
|
Config pod identities in managed Kubernetes cluster. |
|
Whether using Kubenet network plugin with AAD Pod Identity. Choices:
|
|
Whether the pod identity addon is enabled. Choices:
|
|
The pod identities to use in the cluster. |
|
The binding selector to use for the AzureIdentityBinding resource. |
|
The user assigned identity details. |
|
The client ID of the user assigned identity. |
|
The object ID of the user assigned identity. |
|
The resource ID of the user assigned identity. |
|
The name of the pod identity. |
|
The namespace of the pod identity. |
|
Security profile found in ~/.azure/credentials file. |
|
Name of a resource group where the managed Azure Container Services (AKS) exists or will be created. |
|
Azure client secret. Use when authenticating with a Service Principal. |
|
Security profile for the container service cluster. |
|
Azure Key Vault. See https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/ settings for the security profile. |
|
Whether to enable Azure Key Vault key management service. The default is Choices:
|
|
Identifier of Azure Key Vault key. |
|
Network access of key vault. Choices:
|
|
Resource ID of key vault. When key_vault_network_acces=Private, this field is required and must be a valid resource ID. When key_vault_network_acces=Public, leave the field empty. |
|
Microsoft Defender settings for the security profile. |
|
Resource ID of the Log Analytics workspace to be associated with Microsoft Defender. When Microsoft Defender is enabled, this field is required and must be a valid workspace resource ID. When Microsoft Defender is disabled, leave the field empty. |
|
Microsoft Defender threat detection for Cloud settings for the security profile. |
|
Whether to enable Defender threat detection. Choices:
|
|
Image Cleaner settings for the security profile. |
|
Whether to enable Image Cleaner on AKS cluster. Choices:
|
|
Image Cleaner scanning interval in hours. |
|
Workload identity settings for the security profile. Workload identity enables Kubernetes applications to access Azure cloud resources securely with Azure AD. See https://aka.ms/aks/wi for more details. |
|
Whether to enable workload identity. Choices:
|
|
The service principal suboptions. |
|
The ID for the Service Principal. |
|
The secret password associated with the service principal. |
|
Assert the state of the AKS. Use Choices:
|
|
Your Azure subscription Id. |
|
Dictionary of string:string pairs to assign as metadata to the object. Metadata tags on the object will be updated with any provided values. To remove tags set append_tags option to false. Currently, Azure DNS zones and Traffic Manager services also don’t allow the use of spaces in the tag. Azure Front Door doesn’t support the use of Azure Automation and Azure CDN only support 15 tags on resources. |
|
Azure tenant ID. Use when authenticating with a Service Principal. |
|
The thumbprint of the private key specified in x509_certificate_path. Use when authenticating with a Service Principal. Required if x509_certificate_path is defined. |
|
The Windows profile suboptions. |
|
The Admin password for the cluster. |
|
The Admin Username for the cluster. |
|
Path to the X509 certificate used to create the service principal in PEM format. The certificate must be appended to the private key. Use when authenticating with a Service Principal. |
Notes
Note
For authentication with Azure you can pass parameters, set environment variables, use a profile stored in ~/.azure/credentials, or log in before you run your tasks or playbook with
az login.Authentication is also possible using a service principal or Active Directory user.
To authenticate via service principal, pass subscription_id, client_id, secret and tenant or set environment variables AZURE_SUBSCRIPTION_ID, AZURE_CLIENT_ID, AZURE_SECRET and AZURE_TENANT.
To authenticate via Active Directory user, pass ad_user and password, or set AZURE_AD_USER and AZURE_PASSWORD in the environment.
Alternatively, credentials can be stored in ~/.azure/credentials. This is an ini file containing a [default] section and the following keys: subscription_id, client_id, secret and tenant or subscription_id, ad_user and password. It is also possible to add additional profiles. Specify the profile by passing profile or setting AZURE_PROFILE in the environment.
See Also
See also
- Sign in with Azure CLI
How to authenticate using the
az logincommand.
Examples
- name: Create an AKS instance With A System Node Pool & A User Node Pool
azure_rm_aks:
name: myAKS
resource_group: myResourceGroup
location: eastus
dns_prefix: akstest
kubernetes_version: 1.14.6
linux_profile:
admin_username: azureuser
ssh_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...
service_principal:
client_id: "cf72ca99-f6b9-4004-b0e0-bee10c521948"
client_secret: "Password1234!"
agent_pool_profiles:
- name: default
count: 1
vm_size: Standard_B2s
enable_auto_scaling: true
type: VirtualMachineScaleSets
mode: System
max_count: 3
min_count: 1
enable_rbac: true
tags:
key1: value1
- name: user
count: 1
vm_size: Standard_D2_v2
enable_auto_scaling: true
type: VirtualMachineScaleSets
mode: User
max_count: 3
min_count: 1
enable_rbac: true
- name: Create a managed Azure Container Services (AKS) instance
azure_rm_aks:
name: myAKS
location: eastus
resource_group: myResourceGroup
dns_prefix: akstest
kubernetes_version: 1.14.6
linux_profile:
admin_username: azureuser
ssh_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...
service_principal:
client_id: "cf72ca99-f6b9-4004-b0e0-bee10c521948"
client_secret: "Password123!"
agent_pool_profiles:
- name: default
count: 5
mode: System
vm_size: Standard_B2s
tags:
Environment: Production
- name: Use minimal parameters and system-assigned identity
azure_rm_aks:
name: myMinimalCluster
location: eastus
resource_group: myExistingResourceGroup
dns_prefix: akstest
agent_pool_profiles:
- name: default
count: 1
vm_size: Standard_D2_v2
- name: Create AKS with userDefinedRouting "Link:https://docs.microsoft.com/en-us/azure/aks/limit-egress-traffic#add-a-dnat-rule-to-azure-firewall"
azure_rm_aks:
name: "minimal{{ rpfx }}"
location: eastus
resource_group: "{{ resource_group }}"
kubernetes_version: "{{ versions.azure_aks_versions[0] }}"
dns_prefix: "aks{{ rpfx }}"
service_principal:
client_id: "{{ client_id }}"
client_secret: "{{ client_secret }}"
network_profile:
network_plugin: azure
load_balancer_sku: standard
outbound_type: userDefinedRouting
service_cidr: "10.41.0.0/16"
dns_service_ip: "10.41.0.10"
api_server_access_profile:
authorized_ip_ranges:
- "20.106.246.252/32"
enable_private_cluster: false
agent_pool_profiles:
- name: default
count: 1
vm_size: Standard_B2s
mode: System
vnet_subnet_id: "{{ output.subnets[0].id }}"
type: VirtualMachineScaleSets
enable_auto_scaling: false
- name: Create an AKS instance wit pod_identity_profile settings
azure_rm_aks:
name: "aks{{ rpfx }}"
resource_group: "{{ resource_group }}"
location: eastus
dns_prefix: "aks{{ rpfx }}"
kubernetes_version: "{{ versions.azure_aks_versions[0] }}"
service_principal:
client_id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
client_secret: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
linux_profile:
admin_username: azureuser
ssh_key: ssh-rsa AAAAB3Ip6***************
agent_pool_profiles:
- name: default
count: 1
vm_size: Standard_B2s
type: VirtualMachineScaleSets
mode: System
node_labels: {"release":"stable"}
max_pods: 42
availability_zones:
- 1
- 2
node_resource_group: "node{{ noderpfx }}"
enable_rbac: true
network_profile:
load_balancer_sku: standard
pod_identity_profile:
enabled: false
allow_network_plugin_kubenet: false
user_assigned_identities:
- name: fredtest
namespace: fredtest
binding_selector: test
identity:
client_id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
object_id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
- name: Create a kubernet service with I(os_type=Windows)
azure_rm_aks:
name: myaks02
location: eastus
resource_group: "{{ resource_group }}"
kubernetes_version: "{{ versions }}"
dns_prefix: "aks_dns"
enable_rbac: true
windows_profile:
admin_username: azureuser
admin_password: Password@0329
aad_profile:
managed: true
agent_pool_profiles:
- name: default
count: 1
vm_size: Standard_D8ds_v5
mode: System
os_type: Linux
os_sku: Ubuntu
- name: def
count: 1
vm_size: Standard_D2as_v4
mode: User
os_type: Windows
os_sku: Windows2022
api_server_access_profile:
authorized_ip_ranges:
- "192.0.2.0"
- "198.51.100.0"
- "203.0.113.0"
enable_private_cluster: false
network_profile:
load_balancer_sku: standard
network_plugin: azure
outbound_type: loadBalancer
- name: Remove a managed Azure Container Services (AKS) instance
azure_rm_aks:
name: myAKS
resource_group: myResourceGroup
state: absent
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key |
Description |
|---|---|
Current state of the Azure Container Service (AKS). Returned: always Sample: |