Quickstart: Deploy an Azure Container Linux (ACL) Azure Kubernetes Service (AKS) cluster using the Azure CLI

In this quickstart, you use the Azure CLI to create an Azure Kubernetes Service (AKS) cluster that runs Azure Container Linux (ACL) as the node operating system (OS). After deploying the cluster, you connect to it using kubectl and verify that the ACL nodes are running as expected.

Considerations and limitations

Before you begin, review the following considerations and limitations for ACL:

• ACL is generally available starting AKS v1.34.
• ACL requires Trusted Launch with Secure Boot and vTPM. Non-Trusted Launch variants are not available.
• ACL on Arm64 requires Cobalt-based (v6) SKUs to enable Trusted Launch compatibility.
• NodeImage and None are the only supported OS upgrade channels. Unmanaged and SecurityPatch are incompatible with ACL due to the immutable /usr directory.
• Artifact Streaming isn't supported.
• Pod Sandboxing isn't supported.
• Confidential Virtual Machines (CVMs) aren't supported.
• Generation 1 VMs aren't supported.
• FIPS-enabled nodes aren't supported yet.

Prerequisites

Note

You can use either Azure Cloud Shell or a local installation of the Azure CLI to run the commands in this quickstart.

• If you're running the Azure CLI locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.
• If you're using a local installation, sign in to the Azure CLI using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.
• If you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.
• Use the az version command to find the Azure CLI version and dependent libraries that are installed. Azure Container Linux requires Azure CLI version 2.86.0 or higher. To upgrade to the latest version, use the az upgrade command.
• If needed, register the Microsoft.ContainerService resource provider in your Azure subscription.

Register the Microsoft.ContainerService resource provider

You might need to register resource providers in your Azure subscription. Check the registration status using the az provider show command.

az provider show --namespace Microsoft.ContainerService --query registrationState

If necessary, register the resource provider using the az provider register command.

az provider register --namespace Microsoft.ContainerService

Create a resource group

An Azure resource group is a logical group in which Azure resources are deployed and managed. When creating a resource group, you need to specify a location. This location is:

• The storage location of your resource group metadata.
• Where your resources will run in Azure if you don't specify another region when creating a resource.

Create a resource group using the az group create command. The following example sets environment variables for the resource group name, region, and AKS cluster name, then creates a resource group in the specified location. You can replace the values of the environment variables with your own preferred names and region.

export MY_RESOURCE_GROUP_NAME="myACLResourceGroup"
export REGION="westus"
export MY_AKS_CLUSTER_NAME="myACLCluster"

az group create --name $MY_RESOURCE_GROUP_NAME --location $REGION

Example output:

{
  "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myACLResourceGroup",
  "location": "westus",
  "managedBy": null,
  "name": "myACLResourceGroup",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

Create an ACL cluster

Create an AKS cluster using the az aks create command with the --os-sku AzureContainerLinux parameter to provision the AKS cluster with an ACL image.

az aks create \
  --resource-group $MY_RESOURCE_GROUP_NAME \
  --name $MY_AKS_CLUSTER_NAME \
  --os-sku AzureContainerLinux \
  --node-count 3 \
  --generate-ssh-keys

After a few minutes, the command completes and returns JSON-formatted information about the cluster.

Connect to the cluster

To manage a Kubernetes cluster, use the Kubernetes command-line client, kubectl. kubectl is already installed if you use Azure Cloud Shell. To install kubectl locally, use the az aks install-cli command.

1. Configure kubectl to connect to your Kubernetes cluster using the az aks get-credentials command. This command downloads credentials and configures the Kubernetes CLI to use them.

   az aks get-credentials --resource-group $MY_RESOURCE_GROUP_NAME --name $MY_AKS_CLUSTER_NAME
   

2. Verify the connection to your cluster using the kubectl get command. This command returns a list of the cluster nodes.

   kubectl get nodes
   

Deploy the application

To deploy the application, you use a manifest file to create all the objects required to run the AKS Store application. A Kubernetes manifest file defines a cluster's desired state, such as which container images to run. The manifest includes the following Kubernetes deployments and services:

• Store front: Web application for customers to view products and place orders.
• Product service: Shows product information.
• Order service: Places orders.
• Rabbit MQ: Message queue for an order queue.

Note

We don't recommend running stateful containers, such as Rabbit MQ, without persistent storage for production. These are used here for simplicity, but we recommend using managed services, such as Azure Cosmos DB or Azure Service Bus.

1. Create a file named aks-store-quickstart.yaml and copy in the following manifest:

   apiVersion: apps/v1
   kind: StatefulSet
   metadata:
     name: rabbitmq
   spec:
     serviceName: rabbitmq
     replicas: 1
     selector:
       matchLabels:
         app: rabbitmq
     template:
       metadata:
         labels:
           app: rabbitmq
       spec:
         nodeSelector:
           "kubernetes.io/os": linux
         containers:
         - name: rabbitmq
           image: mcr.microsoft.com/mirror/docker/library/rabbitmq:3.10-management-alpine
           ports:
           - containerPort: 5672
             name: rabbitmq-amqp
           - containerPort: 15672
             name: rabbitmq-http
           env:
           - name: RABBITMQ_DEFAULT_USER
             value: "username"
           - name: RABBITMQ_DEFAULT_PASS
             value: "password"
           resources:
             requests:
               cpu: 10m
               memory: 128Mi
             limits:
               cpu: 250m
               memory: 256Mi
           volumeMounts:
           - name: rabbitmq-enabled-plugins
             mountPath: /etc/rabbitmq/enabled_plugins
             subPath: enabled_plugins
         volumes:
         - name: rabbitmq-enabled-plugins
           configMap:
             name: rabbitmq-enabled-plugins
             items:
             - key: rabbitmq_enabled_plugins
               path: enabled_plugins
   ---
   apiVersion: v1
   data:
     rabbitmq_enabled_plugins: |
       [rabbitmq_management,rabbitmq_prometheus,rabbitmq_amqp1_0].
   kind: ConfigMap
   metadata:
     name: rabbitmq-enabled-plugins
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: rabbitmq
   spec:
     selector:
       app: rabbitmq
     ports:
       - name: rabbitmq-amqp
         port: 5672
         targetPort: 5672
       - name: rabbitmq-http
         port: 15672
         targetPort: 15672
     type: ClusterIP
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: order-service
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: order-service
     template:
       metadata:
         labels:
           app: order-service
       spec:
         nodeSelector:
           "kubernetes.io/os": linux
         containers:
         - name: order-service
           image: ghcr.io/azure-samples/aks-store-demo/order-service:latest
           ports:
           - containerPort: 3000
           env:
           - name: ORDER_QUEUE_HOSTNAME
             value: "rabbitmq"
           - name: ORDER_QUEUE_PORT
             value: "5672"
           - name: ORDER_QUEUE_USERNAME
             value: "username"
           - name: ORDER_QUEUE_PASSWORD
             value: "password"
           - name: ORDER_QUEUE_NAME
             value: "orders"
           - name: FASTIFY_ADDRESS
             value: "0.0.0.0"
           resources:
             requests:
               cpu: 1m
               memory: 50Mi
             limits:
               cpu: 75m
               memory: 128Mi
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: order-service
   spec:
     type: ClusterIP
     ports:
     - name: http
       port: 3000
       targetPort: 3000
     selector:
       app: order-service
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: product-service
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: product-service
     template:
       metadata:
         labels:
           app: product-service
       spec:
         nodeSelector:
           "kubernetes.io/os": linux
         containers:
         - name: product-service
           image: ghcr.io/azure-samples/aks-store-demo/product-service:latest
           ports:
           - containerPort: 3002
           resources:
             requests:
               cpu: 1m
               memory: 1Mi
             limits:
               cpu: 1m
               memory: 7Mi
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: product-service
   spec:
     type: ClusterIP
     ports:
     - name: http
       port: 3002
       targetPort: 3002
     selector:
       app: product-service
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: store-front
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: store-front
     template:
       metadata:
         labels:
           app: store-front
       spec:
         nodeSelector:
           "kubernetes.io/os": linux
         containers:
         - name: store-front
           image: ghcr.io/azure-samples/aks-store-demo/store-front:latest
           ports:
           - containerPort: 8080
             name: store-front
           env:
           - name: VUE_APP_ORDER_SERVICE_URL
             value: "http://order-service:3000/"
           - name: VUE_APP_PRODUCT_SERVICE_URL
             value: "http://product-service:3002/"
           resources:
             requests:
               cpu: 1m
               memory: 200Mi
             limits:
               cpu: 1000m
               memory: 512Mi
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: store-front
   spec:
     ports:
     - port: 80
       targetPort: 8080
     selector:
       app: store-front
     type: LoadBalancer
   

2. Deploy the application using the kubectl apply command and specify the name of your YAML manifest.

   kubectl apply -f aks-store-quickstart.yaml
   

Test the application

You can validate that the application is running by visiting the public IP address or the application URL.

Get the application URL using the following commands:

runtime="5 minutes"
endtime=$(date -ud "$runtime" +%s)
while [[ $(date -u +%s) -le $endtime ]]
do
   STATUS=$(kubectl get pods -l app=store-front -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}')
   echo "Status: $STATUS"
   if [ "$STATUS" == 'True' ]
   then
      export IP_ADDRESS=$(kubectl get service store-front --output 'jsonpath={..status.loadBalancer.ingress[0].ip}')
      echo "Service IP Address: $IP_ADDRESS"
      break
   else
      sleep 10
   fi
done

echo "http://$IP_ADDRESS"

Delete the cluster

If you don't plan on going through the tutorials, clean up unnecessary resources to avoid Azure charges.

Remove the resource group, container service, and all related resources using the az group delete command.

az group delete --name $MY_RESOURCE_GROUP_NAME --yes --no-wait

Related content

To learn more about ACL for AKS, see What is Azure Container Linux (ACL) for Azure Kubernetes Service (AKS)?