IMPORTANT NOTE: This site is not official Red Hat documentation and is provided for informational purposes only. These guides may be experimental, proof of concept, or early adoption. Officially supported documentation is available at docs.openshift.com and access.redhat.com.

Installing and Using the Azure Service Operator (ASO) in Azure Red Hat OpenShift (ARO)

Paul Czarkowski

last edit - 02/16/2022

The Azure Service Operator (ASO) provides Custom Resource Definitions (CRDs) for Azure resources that can be used to create, update, and delete Azure services from an OpenShift cluster.

Prerequisites

Prepare your Azure Account and ARO Cluster

Set the following environment variables:

Note: modify the cluster name, region and resource group to match your cluster

AZURE_TENANT_ID=$(az account show -o tsv --query tenantId)
AZURE_SUBSCRIPTION_ID=$(az account show -o tsv --query id)
CLUSTER_NAME="openshift"
AZURE_RESOURCE_GROUP="openshift"
AZURE_REGION="eastus"

Create a Service Principal with Contributor permissions to your subscription:

Note: You may want to lock this down to a specific resource group.

read -r ASO_USER ASO_PASS < <(az ad sp create-for-rbac -n "$CLUSTER_NAME-ASO" \
  --role contributor --scopes /subscriptions/$AZURE_SUBSCRIPTION_ID -o tsv \
  --query "[name,password]" | xargs)

Create a secret containing your Service Principal credentials:

cat <<EOF | oc apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: azureoperatorsettings
  namespace: openshift-operators
stringData:
  AZURE_TENANT_ID: $AZURE_TENANT_ID
  AZURE_SUBSCRIPTION_ID: $AZURE_SUBSCRIPTION_ID
  AZURE_CLIENT_ID: $ASO_USER
  AZURE_CLIENT_SECRET: $ASO_PASS
  AZURE_CLOUD_ENV: AzurePublicCloud
EOF

Deploy the ASO Operator:

cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  labels:
 operators.coreos.com/azure-service-operator.openshift-operators: ""
  name: azure-service-operator
  namespace: openshift-operators
spec:
  channel: stable
  installPlanApproval: Automatic
  name: azure-service-operator
  source: community-operators
  sourceNamespace: openshift-marketplace
  startingCSV: azure-service-operator.v1.0.28631
EOF

Deploy an Azure PostgreSQL Server

Create a Project:
```
oc new-project redis-demo
```

Allow the redis app to run as any user:

oc adm policy add-scc-to-user anyuid -z default

Create a random string to use as the unique redis hostname:

REDIS_HOSTNAME=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1)

Deploy a Redis service using the ASO Operator and an example application

cat <<EOF | oc apply -f -
apiVersion: azure.microsoft.com/v1alpha1
kind: RedisCache
metadata:
  name: $REDIS_HOSTNAME
spec:
  location: $AZURE_REGION
  resourceGroup: $AZURE_RESOURCE_GROUP
  properties:
 sku:
   name: Basic
   family: C
   capacity: 1
 enableNonSslPort: true
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: azure-vote-front
spec:
  replicas: 1
  selector:
 matchLabels:
   app: azure-vote-front
  template:
 metadata:
   labels:
     app: azure-vote-front
 spec:
   containers:
   - name: azure-vote-front
     image: mcr.microsoft.com/azuredocs/azure-vote-front:v1
     resources:
       requests:
         cpu: 100m
         memory: 128Mi
       limits:
         cpu: 250m
         memory: 256Mi
     ports:
     - containerPort: 80
     env:
     - name: REDIS_NAME
       value: $REDIS_HOSTNAME
     - name: REDIS
       value: $REDIS_HOSTNAME.redis.cache.windows.net
     - name: REDIS_PWD
       valueFrom:
         secretKeyRef:
           name: rediscache-$REDIS_HOSTNAME
           key: primaryKey
---
apiVersion: v1
kind: Service
metadata:
  name: azure-vote-front
spec:
  ports:
         - port: 80
  selector:
 app: azure-vote-front
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: azure-vote
spec:
  port:
 targetPort: 80
  tls:
 insecureEdgeTerminationPolicy: Redirect
 termination: edge
  to:
 kind: Service
 name: azure-vote-front
EOF

Wait for Redis to be ready

This may take 10 to 15 minutes.

 watch oc get rediscache $REDIS_HOSTNAME

the output should eventually show the following:

 NAME       PROVISIONED   MESSAGE
 l67for49   true          successfully provisioned

Get the URL of the example app
```
 oc get route azure-vote
```
Browse to the URL provided by the previous command and validate that the app is working

screenshot of voting app

Cleanup

Delete the project containing the demo app
```
 oc delete project redis-demo
```