IMPORTANT NOTE: This site is not official Red Hat documentation and is provided for informational purposes only. These guides may be experimental, proof of concept, or early adoption. Officially supported documentation is available at docs.openshift.com and access.redhat.com.
Installing and Using the Azure Service Operator (ASO) in Azure Red Hat OpenShift (ARO)
Paul Czarkowski
last edit - 02/16/2022
The Azure Service Operator (ASO) provides Custom Resource Definitions (CRDs) for Azure resources that can be used to create, update, and delete Azure services from an OpenShift cluster.
Prerequisites
Prepare your Azure Account and ARO Cluster
-
Set the following environment variables:
Note: modify the cluster name, region and resource group to match your cluster
AZURE_TENANT_ID=$(az account show -o tsv --query tenantId) AZURE_SUBSCRIPTION_ID=$(az account show -o tsv --query id) CLUSTER_NAME="openshift" AZURE_RESOURCE_GROUP="openshift" AZURE_REGION="eastus"
-
Create a Service Principal with Contributor permissions to your subscription:
Note: You may want to lock this down to a specific resource group.
read -r ASO_USER ASO_PASS < <(az ad sp create-for-rbac -n "$CLUSTER_NAME-ASO" \ --role contributor --scopes /subscriptions/$AZURE_SUBSCRIPTION_ID -o tsv \ --query "[name,password]" | xargs)
-
Create a secret containing your Service Principal credentials:
cat <<EOF | oc apply -f - apiVersion: v1 kind: Secret metadata: name: azureoperatorsettings namespace: openshift-operators stringData: AZURE_TENANT_ID: $AZURE_TENANT_ID AZURE_SUBSCRIPTION_ID: $AZURE_SUBSCRIPTION_ID AZURE_CLIENT_ID: $ASO_USER AZURE_CLIENT_SECRET: $ASO_PASS AZURE_CLOUD_ENV: AzurePublicCloud EOF
-
Deploy the ASO Operator:
cat <<EOF | oc apply -f - apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: labels: operators.coreos.com/azure-service-operator.openshift-operators: "" name: azure-service-operator namespace: openshift-operators spec: channel: stable installPlanApproval: Automatic name: azure-service-operator source: community-operators sourceNamespace: openshift-marketplace startingCSV: azure-service-operator.v1.0.28631 EOF
Deploy an Azure PostgreSQL Server
-
Create a Project:
oc new-project redis-demo
-
Allow the redis app to run as any user:
oc adm policy add-scc-to-user anyuid -z default
-
Create a random string to use as the unique redis hostname:
REDIS_HOSTNAME=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1)
-
Deploy a Redis service using the ASO Operator and an example application
cat <<EOF | oc apply -f - apiVersion: azure.microsoft.com/v1alpha1 kind: RedisCache metadata: name: $REDIS_HOSTNAME spec: location: $AZURE_REGION resourceGroup: $AZURE_RESOURCE_GROUP properties: sku: name: Basic family: C capacity: 1 enableNonSslPort: true --- apiVersion: apps/v1 kind: Deployment metadata: name: azure-vote-front spec: replicas: 1 selector: matchLabels: app: azure-vote-front template: metadata: labels: app: azure-vote-front spec: containers: - name: azure-vote-front image: mcr.microsoft.com/azuredocs/azure-vote-front:v1 resources: requests: cpu: 100m memory: 128Mi limits: cpu: 250m memory: 256Mi ports: - containerPort: 80 env: - name: REDIS_NAME value: $REDIS_HOSTNAME - name: REDIS value: $REDIS_HOSTNAME.redis.cache.windows.net - name: REDIS_PWD valueFrom: secretKeyRef: name: rediscache-$REDIS_HOSTNAME key: primaryKey --- apiVersion: v1 kind: Service metadata: name: azure-vote-front spec: ports: - port: 80 selector: app: azure-vote-front --- apiVersion: route.openshift.io/v1 kind: Route metadata: name: azure-vote spec: port: targetPort: 80 tls: insecureEdgeTerminationPolicy: Redirect termination: edge to: kind: Service name: azure-vote-front EOF
-
Wait for Redis to be ready
This may take 10 to 15 minutes.
watch oc get rediscache $REDIS_HOSTNAME
the output should eventually show the following:
NAME PROVISIONED MESSAGE l67for49 true successfully provisioned
-
Get the URL of the example app
oc get route azure-vote
-
Browse to the URL provided by the previous command and validate that the app is working
Cleanup
-
Delete the project containing the demo app
oc delete project redis-demo