NOTE: Application Gateway for Containers has been released, which introduces numerous performance, resilience, and feature changes. Please consider leveraging Application Gateway for Containers for your next deployment.
This documents assumes you already have the following Azure tools and resources installed:
az CLI, kubectl, and helm installed. These tools are required for the commands below.Please use Greenfield Deployment to install nonexistents.
To use the new feature, make sure the AGIC version is at least at 1.2.0-rc3
bash helm install oci://mcr.microsoft.com/azure-application-gateway/charts/ingress-azure -f helm-config.yaml --version 1.7.5 --generate-name
The certificate below should only be used for testing purpose.
```bash appgwName="" resgp=""
generate certificate for testingopenssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -out test-cert.crt \ -keyout test-cert.key \ -subj "/CN=test"
openssl pkcs12 -export \ -in test-cert.crt \ -inkey test-cert.key \ -passout pass:test \ -out test-cert.pfx
configure certificate to app gatewayaz network application-gateway ssl-cert create \ --resource-group $resgp \ --gateway-name $appgwName \ -n mysslcert \ --cert-file test-cert.pfx \ --cert-password "test" ```
Configure certificate from Key Vault to AppGwTo configfure certificate from key vault to Application Gateway, an user-assigned managed identity will need to be created and assigned to AppGw, the managed identity will need to have GET secret access to KeyVault.
```bash
Configure your resourcesappgwName="" resgp="" vaultName="" location="" aksClusterName="" aksResourceGroupName="" appgwName=""
IMPORTANT: the following way to retrieve the object id of the AGIC managed identity only applies when AGIC is deployed via the AGIC addon for AKS get the resource group name of the AKS clusternrg=$(az aks show --name $aksClusterName --resource-group $aksResourceGroupName --query nodeResourceGroup --output tsv)
get principalId of the AGIC managed identityidentityName="ingressapplicationgateway-aksClusterName" agicIdentityPrincipalId=(az identity show --name $identityName --resource-group $nrg --query principalId --output tsv)
One time operation, create Azure key vault and certificate (can done through portal as well)az keyvault create -n $vaultName -g $resgp --enable-soft-delete -l $location
One time operation, create user-assigned managed identityaz identity create -n appgw-id -g $resgp -l location identityID=(az identity show -n appgw-id -g resgp -o tsv --query "id") identityPrincipal=(az identity show -n appgw-id -g $resgp -o tsv --query "principalId")
One time operation, assign AGIC identity to have operator access over AppGw identityaz role assignment create --role "Managed Identity Operator" --assignee $agicIdentityPrincipalId --scope $identityID
One time operation, assign the identity to Application Gatewayaz network application-gateway identity assign \ --gateway-name $appgwName \ --resource-group $resgp \ --identity $identityID
One time operation, assign the identity GET secret access to Azure Key Vaultaz keyvault set-policy \ -n $vaultName \ -g $resgp \ --object-id $identityPrincipal \ --secret-permissions get
For each new certificate, create a cert on keyvault and add unversioned secret id to Application Gatewayaz keyvault certificate create \ --vault-name vaultName \ -n mycert \ -p "(az keyvault certificate get-default-policy)" versionedSecretId=$(az keyvault certificate show -n mycert --vault-name vaultName --query "sid" -o tsv) unversionedSecretId=(echo $versionedSecretId | cut -d'/' -f-5) # remove the version from the url
For each new certificate, Add the certificate to AppGwaz network application-gateway ssl-cert create \ -n mykvsslcert \ --gateway-name $appgwName \ --resource-group $resgp \ --key-vault-secret-id $unversionedSecretId # ssl certificate with name "mykvsslcert" will be configured on AppGw ```
Testing the key vault certificate on IngressSince we have certificate from Key Vault configured in Application Gateway, we can then add the new annotation appgw.ingress.kubernetes.io/appgw-ssl-certificate: mykvsslcert in Kubernetes ingress to enable the feature.
```bash
install an appcat << EOF | kubectl apply -f - apiVersion: v1 kind: Pod metadata: name: aspnetapp labels: app: aspnetapp spec: containers: - image: "mcr.microsoft.com/dotnet/samples:aspnetapp" name: aspnetapp-image ports: - containerPort: 80 protocol: TCP
apiVersion: v1 kind: Service metadata: name: aspnetapp spec: selector: app: aspnetapp ports: - protocol: TCP port: 80 targetPort: 80
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: aspnetapp annotations: kubernetes.io/ingress.class: azure/application-gateway appgw.ingress.kubernetes.io/appgw-ssl-certificate: mykvsslcert spec: rules: - http: paths: - path: / backend: service: name: aspnetapp port: number: 80 pathType: Exact EOF ```
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4