azuredeploy.json

{
	"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
	"contentVersion": "1.0.0.0",
	"parameters": {
		"_artifactsLocation": {
			"type": "string",
			"metadata": {
				"description": "The base URI where artifacts required by this template are located. For example, if stored on a public GitHub repo, you'd use the following URI: https://raw.githubusercontent.com/bacongobbler/krustlet-on-azure/main/."
			},
			"defaultValue": "https://raw.githubusercontent.com/bacongobbler/krustlet-on-azure/main/"
		},
		"_artifactsLocationSasToken": {
			"type": "securestring",
			"defaultValue": "",
			"metadata": {
				"description": "The sasToken required to access _artifactsLocation.  If your artifacts are stored on a public repo or public storage account you can leave this blank."
			}
		},
		"location": {
			"type": "string",
			"defaultValue": "[resourceGroup().location]",
			"metadata": {
				"description": "The region where the cluster will be deployed."
			}
		},
		"adminUsername": {
			"type": "string",
			"defaultValue": "krustlet",
			"metadata": {
				"description": "The administrator username you will use to log on to the virtual machines."
			}
		},
		"sshPublicKey": {
			"type": "securestring",
			"metadata": {
				"description": "SSH public key for SSH'ing into the virtual machines."
			}
		},
		"kubernetesVersion": {
			"defaultValue": "1.17.11",
			"type": "string",
			"metadata": {
				"description": "Determines which version of Kubernetes will be deployed."
			}
		},
		"krustletURL": {
			"type": "string",
			"defaultValue": "https://krustlet.blob.core.windows.net/releases/krustlet-v0.5.0-linux-amd64.tar.gz",
			"metadata": {
				"description": "URL to a Krustlet release archive."
			}
		},
		"servicePrincipalClientId": {
			"type": "securestring",
			"metadata": {
				"description": "Client ID (used by cloudprovider)"
			}
		},
		"servicePrincipalClientSecret": {
			"type": "securestring",
			"metadata": {
				"description": "The Service Principal Client Secret."
			}
		},
		"virtualMachineSize": {
			"type": "string",
			"defaultValue": "Standard_DS2_v2",
			"metadata": {
				"description": "This is the Azure Virtual Machine size, and will affect the cost. If you don't know, just leave the default value."
			}
		}
	},
	"variables": {
		"contributorRoleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
		"listClusterUserCredentialRoleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '4abbcc35-e782-43d8-92c5-2d3f1bd2253f')]",
		"clusterName": "krustlet",
		"imageOffer": "UbuntuServer",
		"imagePublisher": "Canonical",
		"linuxConfiguration": {
			"disablePasswordAuthentication": true,
			"ssh": {
				"publicKeys": [
					{
						"keyData": "[parameters('sshPublicKey')]",
						"path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]"
					}
				]
			}
		},
		"msiName": "krustletmsi",
		"nicName": "krustletVMNic",
		"nsgName": "krustletNSG",
		"publicIPAddressName": "[uniqueString(resourceGroup().id)]",
		"contributorRoleAssignmentId": "[guid(concat(resourceGroup().id, variables('msiName'), 'contributor'))]",
		"listClusterUserCredentialRoleAssignmentId": "[guid(concat(resourceGroup().id, variables('msiName'), 'listClusterUserCredential'))]",
		"routeTableName": "aks-routetable",
		"subnetName": "aks-subnet",
		"subnetPrefix": "10.240.0.0/16",
		"ubuntuOSVersion": "18.04-LTS",
		"virtualNetworkName": "aks-vnet",
		"vmName": "krustlet-wasi"
	},
	"resources": [
		{
			"name": "[concat(variables('vmName'),'/newuserscript')]",
			"type": "Microsoft.Compute/virtualMachines/extensions",
			"apiVersion": "2018-06-01",
			"location": "[parameters('location')]",
			"dependsOn": [
				"[resourceId('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
			],
			"properties": {
				"publisher": "Microsoft.Azure.Extensions",
				"type": "CustomScript",
				"typeHandlerVersion": "2.0",
				"autoUpgradeMinorVersion": true,
				"settings": {
					"fileUris": [
						"[uri(parameters('_artifactsLocation'), concat('install_krustlet.sh', parameters('_artifactsLocationSasToken')))]"
					],
					"commandToExecute": "[concat('bash install_krustlet.sh', ' ', parameters('krustletURL'), ' ', variables('clusterName'), ' ', resourceGroup().name, ' ', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('msiName')), ' ', parameters('kubernetesVersion'))]"
				}
			}
		},
		{
			"type": "Microsoft.ManagedIdentity/userAssignedIdentities",
			"name": "[variables('msiName')]",
			"apiVersion": "2018-11-30",
			"location": "[parameters('location')]"
		},
		{
			"type": "Microsoft.Authorization/roleAssignments",
			"name": "[variables('contributorRoleAssignmentId')]",
			"apiVersion": "2020-04-01-preview",
			"dependsOn": [
				"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('msiName'))]"
			],
			"properties": {
				"roleDefinitionId": "[variables('contributorRoleDefinitionId')]",
				"principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('msiName')), '2018-11-30').principalId]",
				"scope": "[resourceGroup().id]",
				"principalType": "ServicePrincipal"
			}
		},
		{
			"type": "Microsoft.Authorization/roleAssignments",
			"name": "[variables('listClusterUserCredentialRoleAssignmentId')]",
			"apiVersion": "2020-04-01-preview",
			"dependsOn": [
				"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('msiName'))]"
			],
			"properties": {
				"roleDefinitionId": "[variables('listClusterUserCredentialRoleDefinitionId')]",
				"principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('msiName')), '2018-11-30').principalId]",
				"scope": "[resourceGroup().id]",
				"principalType": "ServicePrincipal"
			}
		},
		{
			"name": "[variables('vmName')]",
			"type": "Microsoft.Compute/virtualMachines",
			"apiVersion": "2018-06-01",
			"location": "[parameters('location')]",
			"dependsOn": [
				"[resourceId('Microsoft.ContainerService/managedClusters', variables('clusterName'))]",
				"[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]",
				"[resourceId('Microsoft.Authorization/roleAssignments', variables('listClusterUserCredentialRoleAssignmentId'))]"
			],
			"identity": {
				"type": "UserAssigned",
				"userAssignedIdentities": {
					"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('msiName'))]": {}
				}
			},
			"properties": {
				"hardwareProfile": {
					"vmSize": "[parameters('virtualMachineSize')]"
				},
				"osProfile": {
					"computerName": "[variables('vmName')]",
					"adminUsername": "[parameters('adminUsername')]",
					"linuxConfiguration": "[variables('linuxConfiguration')]"
				},
				"storageProfile": {
					"imageReference": {
						"publisher": "[variables('imagePublisher')]",
						"offer": "[variables('imageOffer')]",
						"sku": "[variables('ubuntuOSVersion')]",
						"version": "latest"
					},
					"osDisk": {
						"caching": "ReadWrite",
						"createOption": "FromImage",
						"diskSizeGB": 100
					}
				},
				"networkProfile": {
					"networkInterfaces": [
						{
							"id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]"
						}
					]
				}
			}
		},
		{
			"type": "Microsoft.ContainerService/managedClusters",
			"apiVersion": "2020-09-01",
			"name": "[variables('clusterName')]",
			"location": "[parameters('location')]",
			"dependsOn": [
				"[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
			],
			"properties": {
				"kubernetesVersion": "[parameters('kubernetesVersion')]",
				"dnsPrefix": "[uniqueString(resourceGroup().id)]",
				"agentPoolProfiles": [
					{
						"name": "nodepool1",
						"count": 3,
						"vmSize": "[parameters('virtualMachineSize')]",
						"osDiskSizeGB": 128,
						"osDiskType": "Managed",
						"vnetSubnetID": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]",
						"maxPods": 110,
						"type": "VirtualMachineScaleSets",
						"orchestratorVersion": "[parameters('kubernetesVersion')]",
						"enableNodePublicIP": false,
						"nodeLabels": {},
						"mode": "System",
						"osType": "Linux"
					}
				],
				"linuxProfile": {
					"adminUsername": "[parameters('adminUsername')]",
					"ssh": "[variables('linuxConfiguration').ssh]"
				},
				"networkProfile": {
					"networkPlugin": "kubenet",
					"loadBalancerSku": "standard",
					"loadBalancerProfile": {
						"managedOutboundIPs": {
							"count": 1
						},
						"effectiveOutboundIPs": [
							{
								"id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]"
							}
						]
					},
					"podCidr": "10.244.0.0/16",
					"serviceCidr": "10.0.0.0/16",
					"dnsServiceIP": "10.0.0.10",
					"dockerBridgeCidr": "172.17.0.1/16",
					"outboundType": "loadBalancer"
				},
				"servicePrincipalProfile": {
					"clientId": "[parameters('servicePrincipalClientId')]",
					"secret": "[parameters('servicePrincipalClientSecret')]"
				}
			}
		},
		{
			"type": "Microsoft.Network/networkInterfaces",
			"apiVersion": "2020-05-01",
			"name": "[variables('nicName')]",
			"location": "[parameters('location')]",
			"dependsOn": [
				"[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
			],
			"properties": {
				"ipConfigurations": [
					{
						"name": "ipconfigkrustlet",
						"properties": {
							"privateIPAllocationMethod": "Dynamic",
							"subnet": {
								"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]"
							},
							"primary": true,
							"privateIPAddressVersion": "IPv4"
						}
					}
				],
				"dnsSettings": {
					"dnsServers": []
				},
				"enableAcceleratedNetworking": false,
				"enableIPForwarding": false,
				"networkSecurityGroup": {
					"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
				}
			}
		},
		{
			"type": "Microsoft.Network/networkSecurityGroups",
			"apiVersion": "2020-05-01",
			"name": "[variables('nsgName')]",
			"location": "[parameters('location')]",
			"properties": {
				"securityRules": [
					{
						"name": "default-allow-ssh",
						"properties": {
							"protocol": "Tcp",
							"sourcePortRange": "*",
							"destinationPortRange": "22",
							"sourceAddressPrefix": "*",
							"destinationAddressPrefix": "*",
							"access": "Allow",
							"priority": 1000,
							"direction": "Inbound",
							"sourcePortRanges": [],
							"destinationPortRanges": [],
							"sourceAddressPrefixes": [],
							"destinationAddressPrefixes": []
						}
					}
				]
			}
		},
		{
			"type": "Microsoft.Network/virtualNetworks",
			"apiVersion": "2020-05-01",
			"name": "[variables('virtualNetworkName')]",
			"location": "[parameters('location')]",
			"dependsOn": [
				"[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
			],
			"properties": {
				"addressSpace": {
					"addressPrefixes": [
						"10.0.0.0/8"
					]
				},
				"subnets": [
					{
						"name": "[variables('subnetName')]",
						"properties": {
							"addressPrefix": "[variables('subnetPrefix')]",
							"networkSecurityGroup": {
								"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
							},
							"serviceEndpoints": [],
							"delegations": [],
							"privateEndpointNetworkPolicies": "Enabled",
							"privateLinkServiceNetworkPolicies": "Enabled"
						}
					}
				],
				"virtualNetworkPeerings": [],
				"enableDdosProtection": false,
				"enableVmProtection": false
			}
		},
		{
			"type": "Microsoft.Network/publicIPAddresses",
			"apiVersion": "2020-05-01",
			"name": "[variables('publicIPAddressName')]",
			"location": "[parameters('location')]",
			"tags": {
				"owner": "kubernetes",
				"type": "aks-slb-managed-outbound-ip"
			},
			"sku": {
				"name": "Standard"
			},
			"properties": {
				"publicIPAllocationMethod": "Static"
			}
		}
	]
}