Skip to content

Commit 4ece2d7

Browse files
author
Melony QIN
authored
Add automation scripts for BDC to deploy in AKS private cluster (microsoft#804)
* add bdc private cluster sample * update templates * update scripts * add details for scripts * adjust upon suggestions * adjustment * adjustment * add space * add params * add chagnes
1 parent f666b30 commit 4ece2d7

File tree

5 files changed

+328
-1
lines changed

5 files changed

+328
-1
lines changed

‎samples/features/sql-big-data-cluster/deployment/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,9 @@ Using the sample Python script in **aks** folder, you will deploy a Kubernetes c
1313

1414
## __[Push SQL Server big data cluster images to your own private Docker repository](offline/)__
1515

16-
Using the sample Python script in **offline** folder, you will push the necessary images required for the deployment to your own repository.
16+
Using the sample Python script in **offline** folder, you will push the necessary images required for the deployment to your own repository.
17+
18+
## __[Deploy SQL Server big data clusters (BDC) with Azure Kubernetes service (AKS) private cluster](private-aks/)__
19+
20+
Using the sample Python script in **private-aks** folder, you will Deploy SQL Server big data cluster in in your private network with Azure Kubernetes service (AKS) private cluster.
21+

‎samples/features/sql-big-data-cluster/deployment/private-aks/README.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Deploy BDC in private AKS cluster with User-defined Route (UDR)
2+
3+
This repository contains the scripts that you can use to deploy a BDC cluster in Azure Kubernetes Service (AKS) private cluster with advanced networking ( CNI ).
4+
5+
This repository contains 3 bash scripts :
6+
- **deploy-private-aks.sh** : You can use it to deploy private AKS cluster with private endpoint, it fits the use case that you need to deploy BDC with a private endpoint with AKS private cluster.
7+
- **deploy-private-aks-udr.sh** : You can use it to deploy private AKS cluster with private endpoint, it fits the use case that you need to deploy BDC with a private endpoint with AKS private cluster and limit egress traffic with UDR ( User-defined Routes ).
8+
- **deploy-bdc.sh** : You can use it to deploy Big Data Clusters ( BDC ) in private deployment mode on private AKS cluster with or without User-defined routes based on your project requirements.
9+
10+
11+
## Prerequisites
12+
13+
You can run those scripts on the following client envionrment with Linux OS or WSL/WSL2.
14+
15+
The following table link listed common big data cluster tools and how to install them:
16+
17+
https://docs.microsoft.com/en-us/sql/big-data-cluster/deploy-big-data-tools?view=sql-server-ver15
18+
19+
20+
## Instructions
21+
22+
### deploy-private-aks.sh
23+
24+
1. Download the script on the location that you are planning to use for the deployment
25+
26+
``` bash
27+
curl --output setup-bdc.sh https://raw.githubusercontent.com/microsoft/sql-server-samples/master/samples/features/sql-big-data-cluster/deployment/private-aks/scripts/deploy-private-aks.sh
28+
```
29+
30+
2. Make the script executable
31+
32+
``` bash
33+
chmod +x deploy-private-aks.sh
34+
```
35+
36+
3. Run the script (make sure you are running with sudo)
37+
38+
``` bash
39+
sudo ./deploy-private-aks.sh
40+
```
41+
42+
### deploy-private-aks-udr.sh
43+
44+
1. Download the script on the location that you are planning to use for the deployment
45+
46+
``` bash
47+
curl --output setup-bdc.sh https://raw.githubusercontent.com/microsoft/sql-server-samples/master/samples/features/sql-big-data-cluster/deployment/private-aks/scripts/deploy-private-aks-udr.sh
48+
```
49+
50+
2. Make the script executable
51+
52+
``` bash
53+
chmod +x deploy-private-aks-udr.sh
54+
```
55+
56+
3. Run the script (make sure you are running with sudo)
57+
58+
``` bash
59+
sudo ./deploy-private-aks-udr.sh
60+
```
61+
62+
### deploy-bdc.sh
63+
64+
1. Download the script on the location that you are planning to use for the deployment
65+
66+
``` bash
67+
curl --output setup-bdc.sh https://raw.githubusercontent.com/microsoft/sql-server-samples/master/samples/features/sql-big-data-cluster/deployment/private-aks/scripts/deploy-bdc.sh
68+
```
69+
70+
2. Make the script executable
71+
72+
``` bash
73+
chmod +x deploy-bdc.sh
74+
```
75+
76+
3. Run the script (make sure you are running with sudo)
77+
78+
``` bash
79+
sudo ./deploy-bdc.sh
80+
```
81+

‎samples/features/sql-big-data-cluster/deployment/private-aks/scripts/deploy-bdc.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/bin/bash
2+
3+
#Get password as input. It is used as default for controller, SQL Server Master instance (sa account) and Knox.
4+
#
5+
while true; do
6+
read -s -p "Create Admin username for Big Data Cluster: " bdcadmin
7+
echo
8+
read -s -p "Create Password for Big Data Cluster: " password
9+
echo
10+
read -s -p "Confirm your Password: " password2
11+
echo
12+
[ "$password" = "$password2" ] && break
13+
echo "Password mismatch. Please try again."
14+
done
15+
16+
17+
#Create BDC custom profile
18+
azdata bdc config init --source aks-dev-test --target private-bdc-aks --force
19+
20+
#Configurations for BDC deployment
21+
azdata bdc config replace -c private-bdc-aks/control.json -j "$.spec.docker.imageTag=2019-CU6-ubuntu-16.04"
22+
azdata bdc config replace -c private-bdc-aks/control.json -j "$.spec.storage.data.className=default"
23+
azdata bdc config replace -c private-bdc-aks/control.json -j "$.spec.storage.logs.className=default"
24+
25+
azdata bdc config replace -c private-bdc-aks/control.json -j "$.spec.endpoints[0].serviceType=NodePort"
26+
azdata bdc config replace -c private-bdc-aks/control.json -j "$.spec.endpoints[1].serviceType=NodePort"
27+
28+
azdata bdc config replace -c private-bdc-aks /bdc.json -j "$.spec.resources.master.spec.endpoints[0].serviceType=NodePort"
29+
azdata bdc config replace -c private-bdc-aks /bdc.json -j "$.spec.resources.gateway.spec.endpoints[0].serviceType=NodePort"
30+
azdata bdc config replace -c private-bdc-aks /bdc.json -j "$.spec.resources.appproxy.spec.endpoints[0].serviceType=NodePort"
31+
32+
#In case you're deploying BDC in HA mode ( aks-dev-test-ha profile ) please also use the following command
33+
#azdata bdc config replace -c private-bdc-aks /bdc.json -j "$.spec.resources.master.spec.endpoints[1].serviceType=NodePort"
34+
export AZDATA_USERNAME=$bdcadmin
35+
export AZDATA_PASSWORD=$password
36+
37+
azdata bdc create --config-profile private-bdc-aks --accept-eula yes
38+
39+
#Login and get endpoint list for the cluster.
40+
#
41+
azdata login -n mssql-cluster
42+
43+
azdata bdc endpoint list --output table

‎samples/features/sql-big-data-cluster/deployment/private-aks/scripts/deploy-private-aks-udr.sh‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
#!/bin/bash
2+
#Get Subscription ID and Azure service principal as input. It is used as default for controller, SQL Server Master instance (sa account) and Knox.
3+
#
4+
while true; do
5+
read -s -p "Your Azure Subscription: " subscription
6+
echo
7+
read -s -p "Your Resource Group Name: " resourcegroup
8+
echo
9+
read -s -p "In which region you're deploying: " region
10+
echo
11+
read -s -p "Your Azure service principal ID: " sp_id
12+
echo
13+
read -s -p "Your Azure service principal Password: " sp_pwd
14+
done
15+
16+
#Define a set of environment variables to be used in resource creations.
17+
export SUBID=$subscription
18+
19+
export REGION_NAME=$region
20+
export RESOURCE_GROUP=$resourcegroup
21+
export SUBNET_NAME=aks-subnet
22+
export VNET_NAME=bdc-vnet
23+
export AKS_NAME=bdcaksprivatecluster
24+
export FWNAME=bdcaksazfw
25+
export FWPUBIP=$FWNAME-ip
26+
export FWIPCONFIG_NAME=$FWNAME-config
27+
28+
export FWROUTE_TABLE_NAME=bdcaks-rt
29+
export FWROUTE_NAME=bdcaksroute
30+
export FWROUTE_NAME_INTERNET=bdcaksrouteinet
31+
32+
#Set Azure subscription current in use
33+
az account set --subscription $subscription
34+
35+
#Create Azure Resource Group
36+
az group create -n $RESOURCE_GROUP -l $REGION_NAME
37+
38+
#Create Azure Virtual Network to host your AKS cluster
39+
az network vnet create \
40+
--resource-group $RESOURCE_GROUP \
41+
--location $REGION_NAME \
42+
--name $VNET_NAME \
43+
--address-prefixes 10.0.0.0/8 \
44+
--subnet-name $SUBNET_NAME \
45+
--subnet-prefix 10.1.0.0/16
46+
47+
48+
SUBNET_ID=$(az network vnet subnet show \
49+
--resource-group $RESOURCE_GROUP \
50+
--vnet-name $VNET_NAME \
51+
--name $SUBNET_NAME \
52+
--query id -o tsv)
53+
54+
55+
#Add Azure firewall extension
56+
az extension add --name azure-firewall
57+
58+
#Dedicated subnet for Azure Firewall (Firewall name cannot be changed)
59+
az network vnet subnet create \
60+
--resource-group $RESOURCE_GROUP \
61+
--vnet-name $VNET_NAME \
62+
--name AzureFirewallSubnet \
63+
--address-prefix 10.2.0.0/24
64+
65+
#Create Azure firewall
66+
az network firewall create -g $RESOURCE_GROUP -n $FWNAME -l $REGION_NAME --enable-dns-proxy true
67+
68+
#Create public IP for Azure Firewall
69+
az network public-ip create -g $RESOURCE_GROUP -n $FWPUBIP -l $REGION_NAME --sku "Standard"
70+
71+
#Create IP configurations for Azure Firewall
72+
az network firewall ip-config create -g $RESOURCE_GROUP -f $FWNAME -n $FWIPCONFIG_NAME --public-ip-address $FWPUBIP --vnet-name $VNET_NAME
73+
74+
75+
#Getting public and private IP addresses for Azure Firewall
76+
export FWPUBLIC_IP=$(az network public-ip show -g $RESOURCE_GROUP -n $FWPUBIP --query "ipAddress" -o tsv)
77+
export FWPRIVATE_IP=$(az network firewall show -g $RESOURCE_GROUP -n $FWNAME --query "ipConfigurations[0].privateIpAddress" -o tsv)
78+
79+
#Create an User defined route table
80+
az network route-table create -g $RESOURCE_GROUP --name $FWROUTE_TABLE_NAME
81+
82+
#Create User defined routes
83+
az network route-table route create -g $RESOURCE_GROUP --name $FWROUTE_NAME --route-table-name $FWROUTE_TABLE_NAME --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address $FWPRIVATE_IP --subscription $SUBID
84+
85+
az network route-table route create -g $RESOURCE_GROUP --name $FWROUTE_NAME_INTERNET --route-table-name $FWROUTE_TABLE_NAME --address-prefix $FWPUBLIC_IP/32 --next-hop-type Internet
86+
87+
88+
#Add FW Network Rules
89+
az network firewall network-rule create -g $RESOURCE_GROUP -f $FWNAME --collection-name 'aksfwnr' -n 'apiudp' --protocols 'UDP' --source-addresses '*' --destination-addresses "AzureCloud.$REGION_NAME" --destination-ports 1194 --action allow --priority 100
90+
az network firewall network-rule create -g $RESOURCE_GROUP -f $FWNAME --collection-name 'aksfwnr' -n 'apitcp' --protocols 'TCP' --source-addresses '*' --destination-addresses "AzureCloud.$REGION_NAME" --destination-ports 9000
91+
az network firewall network-rule create -g $RESOURCE_GROUP -f $FWNAME --collection-name 'aksfwnr' -n 'time' --protocols 'UDP' --source-addresses '*' --destination-fqdns 'ntp.ubuntu.com' --destination-ports 123
92+
93+
#Add FW Application Rules
94+
az network firewall application-rule create -g $RESOURCE_GROUP -f $FWNAME --collection-name 'aksfwar' -n 'fqdn' --source-addresses '*' --protocols 'http=80' 'https=443' --fqdn-tags "AzureKubernetesService" --action allow --priority 100
95+
96+
#Associate User defined route table (UDR) to AKS cluster where deployed BDC previsouly
97+
az network vnet subnet update -g $RESOURCE_GROUP --vnet-name $VNET_NAME --name $SUBNET_NAME --route-table $FWROUTE_TABLE_NAME
98+
99+
100+
101+
102+
103+
#Create SP and Assign Permission to Virtual Network
104+
az ad sp create-for-rbac -n "bdcaks-sp" --skip-assignment
105+
106+
export APPID=$sp_id
107+
export PASSWORD=$sp_pwd
108+
export VNETID=$(az network vnet show -g $RESOURCE_GROUP --name $VNET_NAME --query id -o tsv)
109+
110+
#Assign SP Permission to VNET
111+
az role assignment create --assignee $APPID --scope $VNETID --role "Network Contributor"
112+
113+
#Assign SP Permission to route table
114+
export RTID=$(az network route-table show -g $RESOURCE_GROUP -n $FWROUTE_TABLE_NAME --query id -o tsv)
115+
az role assignment create --assignee $APPID --scope $RTID --role "Network Contributor"
116+
117+
118+
#Create AKS Cluster
119+
az aks create \
120+
--resource-group $RESOURCE_GROUP \
121+
--location $REGION_NAME \
122+
--name $AKS_NAME \
123+
--load-balancer-sku standard \
124+
--outbound-type userDefinedRouting \
125+
--enable-private-cluster \
126+
--network-plugin azure \
127+
--vnet-subnet-id $SUBNET_ID \
128+
--docker-bridge-address 172.17.0.1/16 \
129+
--dns-service-ip 10.2.0.10 \
130+
--service-cidr 10.2.0.0/24 \
131+
--service-principal $APPID \
132+
--client-secret $PASSWORD \
133+
--node-vm-size Standard_D13_v2 \
134+
--node-count 2 \
135+
--generate-ssh-keys
136+
137+
138+

‎samples/features/sql-big-data-cluster/deployment/private-aks/scripts/deploy-private-aks.sh‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/bin/bash
2+
#Define a set of environment variables to be used in resource creations.
3+
#
4+
5+
#!/bin/bash
6+
#Get Subscription ID and resource groups. It is used as default for controller, SQL Server Master instance (sa account) and Knox.
7+
#
8+
while true; do
9+
read -s -p "Your Azure Subscription: " subscription
10+
echo
11+
read -s -p "Your Resource Group Name: " resourcegroup
12+
echo
13+
read -s -p "In which region you're deploying " region
14+
echo
15+
done
16+
17+
#Define a set of environment variables to be used in resource creations.
18+
export SUBID=$subscription
19+
20+
export REGION_NAME=$region
21+
export RESOURCE_GROUP=$resourcegroup
22+
export SUBNET_NAME=aks-subnet
23+
export VNET_NAME=bdc-vnet
24+
export AKS_NAME=bdcaksprivatecluster
25+
26+
#Set Azure subscription current in use
27+
az account set --subscription $subscription
28+
29+
#Create Azure Resource Group
30+
az group create -n $RESOURCE_GROUP -l $REGION_NAME
31+
32+
#Create Azure Virtual Network to host your AKS clus
33+
az network vnet create \
34+
--resource-group $RESOURCE_GROUP \
35+
--location $REGION_NAME \
36+
--name $VNET_NAME \
37+
--address-prefixes 10.0.0.0/8 \
38+
--subnet-name $SUBNET_NAME \
39+
--subnet-prefix 10.1.0.0/16
40+
41+
SUBNET_ID=$(az network vnet subnet show \
42+
--resource-group $RESOURCE_GROUP \
43+
--vnet-name $VNET_NAME \
44+
--name $SUBNET_NAME \
45+
--query id -o tsv)
46+
47+
#Create AKS Cluster
48+
az aks create \
49+
--resource-group $RESOURCE_GROUP \
50+
--name $AKS_NAME \
51+
--load-balancer-sku standard \
52+
--enable-private-cluster \
53+
--network-plugin azure \
54+
--vnet-subnet-id $SUBNET_ID \
55+
--docker-bridge-address 172.17.0.1/16 \
56+
--dns-service-ip 10.2.0.10 \
57+
--service-cidr 10.2.0.0/24 \
58+
--node-vm-size Standard_D13_v2 \
59+
--node-count 2 \
60+
--generate-ssh-keys

0 commit comments

Comments
 (0)