diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 9ec6bffa..51c4bd9d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -111,7 +111,7 @@ Assert-PSRule -Module 'PSRule.Rules.Azure' -InputPath $paramPath -Format File -o The [configuration experience](https://azure.github.io/AKS-Construction/) is hosted in GitHub pages. It's a static web app, written in NodeJS using [FluentUI](https://developer.microsoft.com/en-us/fluentui). -For a deep dive into contributing to the Wizard Web App, please see this [document](docs/ContributingWizard.md). +For a deep dive into contributing to the Wizard Web App, please see this [document](docs/ContributingHelper.md). #### Playwright tests diff --git a/README.md b/README.md index 95f7e2ec..2dee0179 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ -# AKS Accelerator +# AKS Construction -Building a complete Kubernetes operational environment is hard work! __AKS Accelerator__ dramatically speeds up this work by providing the templates and deployment scripts to quickly create a __fully configured__, Kubernetes environment, tailored to meet your operational and security needs, ready to run your workloads in production. +Building a complete Kubernetes operational environment is hard work! __AKS Construction__ dramatically accelerates this work by providing the templates and deployment scripts to quickly create a __fully configured__, Kubernetes environment, tailored to meet your operational and security needs, ready to run your workloads in production. ![animated preview of AKS Construction Helper](docs/images/animgif.gif) @@ -12,7 +12,7 @@ Building a complete Kubernetes operational environment is hard work! __AKS Accel * #### **Step 2** Select your Requirements (optional) Select your base `Operational` and `Security` Principles using the presets that have been designed from our field experience - ![](docs/images/helper-presets.jpg) + ![presets](docs/images/helper-presets.jpg)
> **Note** > If following Azure's **Landing Zone** methodology, select `Enterprise Scale` from the dropdown, then select your environment type @@ -20,11 +20,11 @@ Building a complete Kubernetes operational environment is hard work! __AKS Accel * #### **Step 3** Fine tune (optional) Use the tabs to fine tune your cluster requirements - ![](docs/images/helper-tabs.jpg) + ![fine tune](docs/images/helper-tabs.jpg) * #### **Step 4** Deploy In the `Deploy` tab, choose how you will deploy your new cluster, and follow the instructions - ![](docs/images/helper-deploy.jpg) + ![deploy](docs/images/helper-deploy.jpg) ## Advanced Scenarios @@ -57,9 +57,9 @@ For a more in depth look at the GitHub Actions used in this project, which steps ## Background -This project unifies guidance provided by the [AKS Secure Baseline](https://docs.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks), [Well Architected Framework](https://docs.microsoft.com/azure/architecture/framework/), [Cloud Adoption Framework](https://azure.microsoft.com/cloud-adoption-framework/) and [Enterprise-Scale](https://github.com/Azure/Enterprise-Scale) by providing tangible artifacts to deploy Azure resources from CLI or CI/CD systems. +This project unifies guidance provided by the [AKS Secure Baseline](https://docs.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks), [Well Architected Framework](https://docs.microsoft.com/azure/architecture/framework/), [Cloud Adoption Framework](https://azure.microsoft.com/cloud-adoption-framework/) and [Azure Landing Zones](https://github.com/Azure/Enterprise-Scale) by providing tangible artifacts to deploy Azure resources from CLI or CI/CD systems. -This project is part of the official [AKS Landing Zone Accelerator (Enterprise Scale)](https://github.com/Azure/AKS-Landing-Zone-Accelerator) architectural approach. To read more about this project and how the it fits with Enterprise Scale and the AKS Secure Baseline, look [here](referencearchs.md). +This project is part of the official [AKS Landing Zone Accelerator (Azure Landing Zones)](https://github.com/Azure/AKS-Landing-Zone-Accelerator) architectural approach. To read more about this project and how the it fits with Azure Landing Zones and the AKS Secure Baseline, look [here](referencearchs.md). ## Project Principals diff --git a/bicep/main.bicep b/bicep/main.bicep index 190e4ab6..3d85bbc0 100644 --- a/bicep/main.bicep +++ b/bicep/main.bicep @@ -17,6 +17,7 @@ Resource sections 6. Application Gateway 7. AKS 8. Monitoring / Log Analytics +9. Deployment for telemetry */ @@ -832,7 +833,7 @@ output ApplicationGatewayName string = deployAppGw ? appgw.name : '' param dnsPrefix string = '${resourceName}-dns' @description('Kubernetes Version') -param kubernetesVersion string = '1.23.8' +param kubernetesVersion string = '1.23.12' @description('Enable Azure AD integration on AKS') param enable_aad bool = false @@ -1159,12 +1160,11 @@ var aks_addons1 = ingressApplicationGateway ? union(aks_addons, deployAppGw ? { enabled: true config: { applicationGatewayName: appgwName - subnetCIDR: '10.2.0.0/16' + subnetCIDR: '10.225.0.0/16' } } }) : aks_addons - var aks_identity = { type: 'UserAssigned' userAssignedIdentities: { @@ -1176,7 +1176,6 @@ var aks_identity = { var aksPrivateDnsZone = privateClusterDnsMethod=='privateDnsZone' ? (!empty(dnsApiPrivateZoneId) ? dnsApiPrivateZoneId : 'system') : privateClusterDnsMethod output aksPrivateDnsZone string = aksPrivateDnsZone - @description('Needing to seperately declare and union this because of https://github.com/Azure/AKS-Construction/issues/344') var managedNATGatewayProfile = { natGatewayProfile : { @@ -1287,7 +1286,12 @@ output aksOidcFedIdentityProperties object = { subject: 'system:serviceaccount:ns:svcaccount' } +@description('The name of the managed resource group AKS uses') output aksNodeResourceGroup string = aks.properties.nodeResourceGroup + +@description('The Azure resource id for the AKS cluster') +output aksResourceId string = aks.id + //output aksNodePools array = [for nodepool in agentPoolProfiles: name] @description('Not giving Rbac at the vnet level when using private dns results in ReconcilePrivateDNS. Therefore we need to upgrade the scope when private dns is being used, because it wants to set up the dns->vnet integration.') @@ -1536,5 +1540,29 @@ resource eventGridDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-previe } } +@description('Enable usage and telemetry feedback to Microsoft.') +param enableTelemetry bool = true + +var telemetryId = '3c1e2fc6-1c4b-44f9-8694-25d00ae30a3a-${location}' + +/*.___________. _______ __ _______ .___ ___. _______ .___________..______ ____ ____ _______ _______ .______ __ ______ ____ ____ .___ ___. _______ .__ __. .___________. +| || ____|| | | ____|| \/ | | ____|| || _ \ \ \ / / | \ | ____|| _ \ | | / __ \ \ \ / / | \/ | | ____|| \ | | | | +`---| |----`| |__ | | | |__ | \ / | | |__ `---| |----`| |_) | \ \/ / | .--. || |__ | |_) | | | | | | | \ \/ / | \ / | | |__ | \| | `---| |----` + | | | __| | | | __| | |\/| | | __| | | | / \_ _/ | | | || __| | ___/ | | | | | | \_ _/ | |\/| | | __| | . ` | | | + | | | |____ | `----.| |____ | | | | | |____ | | | |\ \----. | | | '--' || |____ | | | `----.| `--' | | | | | | | | |____ | |\ | | | + |__| |_______||_______||_______||__| |__| |_______| |__| | _| `._____| |__| |_______/ |_______|| _| |_______| \______/ |__| |__| |__| |_______||__| \__| |__| */ + +// Telemetry Deployment +resource telemetrydeployment 'Microsoft.Resources/deployments@2021-04-01' = if (enableTelemetry) { + name: telemetryId + properties: { + mode: 'Incremental' + template: { + '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#' + contentVersion: '1.0.0.0' + resources: {} + } + } +} //ACSCII Art link : https://textkool.com/en/ascii-art-generator?hl=default&vl=default&font=Star%20Wars&text=changeme diff --git a/helper/src/components/addonsTab.js b/helper/src/components/addonsTab.js index 1b2b7c60..413cfc30 100644 --- a/helper/src/components/addonsTab.js +++ b/helper/src/components/addonsTab.js @@ -384,18 +384,16 @@ export default function ({ tabValues, updateFn, featureFlag, invalidArray }) { updateFn("openServiceMeshAddon", v)} label="Install the Open Service Mesh AddOn" /> - { wiFeatureFlag && - <> - + - - - updateFn("workloadIdentity", v)} label="Install Workload Identity" /> - - } + + + updateFn("workloadIdentity", v)} label="Install Workload Identity" /> + diff --git a/helper/src/components/deployTab.js b/helper/src/components/deployTab.js index b60eec66..871fb419 100644 --- a/helper/src/components/deployTab.js +++ b/helper/src/components/deployTab.js @@ -63,6 +63,7 @@ export default function DeployTab({ defaults, updateFn, tabValues, invalidArray, ...(addons.csisecret === 'akvNew' && deploy.keyVaultIPAllowlist && apiips_array.length > 0 && {keyVaultIPAllowlist: apiips_array }), ...(defaults.net.privateLinkSubnetAddressPrefix !== net.privateLinkSubnetAddressPrefix && {privateLinkSubnetAddressPrefix: net.privateLinkSubnetAddressPrefix}), }), + ...(deploy.enableTelemetry !== defaults.deploy.enableTelemetry && {enableTelemetry: deploy.enableTelemetry }), ...(addons.monitor === "aci" && { omsagent: true, retentionInDays: addons.retentionInDays, ...( addons.createAksMetricAlerts !== defaults.addons.createAksMetricAlerts && {createAksMetricAlerts: addons.createAksMetricAlerts }) }), ...(addons.networkPolicy !== "none" && { networkPolicy: addons.networkPolicy }), ...(defaults.addons.openServiceMeshAddon !== addons.openServiceMeshAddon && {openServiceMeshAddon: addons.openServiceMeshAddon }), @@ -128,7 +129,7 @@ export default function DeployTab({ defaults, updateFn, tabValues, invalidArray, }), ...(defaults.addons.kedaAddon !== addons.kedaAddon && {kedaAddon: addons.kedaAddon }), ...(defaults.addons.blobCSIAddon !== addons.blobCSIAddon && {blobCSIAddon: addons.blobCSIAddon }), - ...(defaults.addons.workloadIdentity !== addons.workloadIdentity && {workloadIdentity: addons.workloadIdentity }), + ...(defaults.addons.workloadIdentity !== addons.workloadIdentity && {oidcIssuer: true, workloadIdentity: addons.workloadIdentity }), ...(net.networkPlugin === 'azure' && net.networkPluginMode && {networkPluginMode: 'Overlay'}), ...(urlParams.getAll('feature').includes('defender') && cluster.DefenderForContainers !== defaults.cluster.DefenderForContainers && { DefenderForContainers: cluster.DefenderForContainers }) } @@ -351,7 +352,6 @@ az role assignment create --role "Managed Identity Operator" --assignee-principa updateFn("apiips", val)} value={deploy.apiips || ''} required={cluster.apisecurity === "whitelist"} /> - updateFn("clusterAdminRole", v)} label="Assign deployment user 'ClusterAdmin'" /> @@ -364,11 +364,14 @@ az role assignment create --role "Managed Identity Operator" --assignee-principa - updateFn("kvCertSecretRole", v)} label="Assign deployment user Certificate and Secret Officer" /> - updateFn("keyVaultIPAllowlist", v)} label="Add current IP to KeyVault firewall (applicable to private link)" /> + updateFn("kvCertSecretRole", v)} label="Assign deployment user Certificate and Secret Officer" /> + updateFn("keyVaultIPAllowlist", v)} label="Add current IP to KeyVault firewall (applicable to private link)" /> { deploy.keyVaultIPAllowlist && net.vnetprivateend && "Add current IP to KeyVault firewall" will enable KeyVaults PublicNetworkAccess property } + + updateFn("enableTelemetry", v)} label="Enable telemetry feedback to Microsoft" /> + @@ -418,7 +421,7 @@ az role assignment create --role "Managed Identity Operator" --assignee-principa { urlParams.toString() !== "" && - Not ready to deploy? Bookmark your configuration : here + Not ready to deploy? Bookmark your configuration by copying this link } diff --git a/helper/src/components/portalnav.js b/helper/src/components/portalnav.js index 3c79d19c..5bd4bbaa 100644 --- a/helper/src/components/portalnav.js +++ b/helper/src/components/portalnav.js @@ -4,7 +4,7 @@ import { CommandBarButton, Image, ThemeProvider, Link, Toggle, TooltipHost, Pivo import { AzureThemeLight, AzureThemeDark } from '@fluentui/azure-themes'; import { mergeStyles, mergeStyleSets } from '@fluentui/merge-styles'; -import {Presets, SeparatorStyle} from './presets' +import { Presets, SeparatorStyle } from './presets' import NetworkTab from './networkTab' import AddonsTab from './addonsTab' @@ -38,16 +38,16 @@ function Header({ presets, setPresets, selectedPreset, featureFlag }) { return ( -