kubectl get constrainttemplate not returning value (was: AKS managed Internal load balancer is not getting created in cluster version 1.18.8)

[nitinkhandelwal26]

Hello Team,

After successful previous deployment in 1.17 v of aks cluster, i tried reploying the cluster with newer templates with version 1.18.8 given in template.
But in new template AKS managed internal loadbalancer is not getting created.

Can you please check this issue.

[ckittel]

Hey there @nitinkhandelwal26 -- interesting, we didn't observe any end-to-end issues when testing.

Just so I can be on the lookout for specifics. Can you share exactly where this trips you up along the way. I want to make sure I can see the failure mode at the same place you're seeing the failure. Obviously, I can simply look for the existence or non-existence of the azure resource -- but would prefer to have a specific place that you see the failure happen documented as it relates to this guidance. Thanks!

[nitinkhandelwal26]

Thanks @ckittel for your reply,

I have deleted the previous deployment and redeploying the whole deployment again,
Please give me sometime, i will update here if i am again facing this issue or another issue,
Using manual approach not inner loop scripts.

Regards,

[ckittel]

Understood. The documented "manual" approach (following the steps listed) are the primary way most folks interact with this content (and how we do a bulk of our testing), so if that flow is broken that's a priority change for us, no doubt. Let us know what you find.

Also, just as an FYI, the other methods are available (various inner-loop script styles), and we want to make sure they work, but are less of a priority -- a best effort + community approach on them.

[nitinkhandelwal26]

one another thing not related to this issue:
While using inner loop script on Bash on VS code with windows machine. I encountered below errors:
Script : aks-secure-baseline/inner-loop-scripts/shell/1-cluster-stamp.sh
Code : # App Gateway Certificate
openssl req -x509 -nodes -days 365 -newkey rsa:2048
-out appgw.crt
-keyout appgw.key
-subj "/CN=bicycle.contoso.com/O=Contoso Bicycle"
openssl pkcs12 -export -out appgw.pfx -in appgw.crt -inkey appgw.key -passout pass:

Is not working.
I also tried on azure devops windows agent with Bash task, that was also giving same error.

But when i used Ubuntu 18.04 LTS to deploy these scripts, there were working fine, same with Azure DevOps agent.

again, Just wanted to report, not related to this issue.

[ckittel]

Thanks for that report, opened a issue for this to not cross the streams here. #92

[nitinkhandelwal26]

Hello @ckittel this time Azure ILB was created but i got Azure policy issue.
https://github.com/mspnp/aks-secure-baseline/blob/main/07-workload-prerequisites.md

Check Azure Policies are in place

Confirm policies are applied to the AKS cluster

kubectl get constrainttemplate

Output:
No resource found.

PFA attached images

[ckittel]

Did kubectl get constrainttemplate eventually return anything? Or even now does that return an empty list?

[nitinkhandelwal26]

Hello @ckittel, i have removed the deployment yesterday after running that due to high Azure Firewall price.
Will update when retry.

[ckittel]

Understood. Well, on that topic of high price for azure firewall. If you happen to know that you're working on something today, that you'll likely also want to work on tomorrow but don't want to incur that firewall cost but want to start working right away the next day, here is a tip.

At the end of the day:

$azfw = Get-AzFirewall -Name "fw-eastus2-hub" -ResourceGroupName "rg-enterprise-networking-hubs"
$azfw.Deallocate()
Set-AzFirewall -AzureFirewall $azfw

At the start of the next day:

$azfw = Get-AzFirewall -Name "fw-eastus2-hub" -ResourceGroupName "rg-enterprise-networking-hubs"
$vnet = Get-AzVirtualNetwork -Name "vnet-eastus2-hub" -ResourceGroupName "rg-enterprise-networking-hubs"
$pip = Get-AzPublicIpAddress -Name "pip-fw-eastus2-default" -ResourceGroupName "rg-enterprise-networking-hubs"
$azfw.Allocate($vnet,$pip)

Set-AzFirewall -AzureFirewall $azfw

Obviously update the values above to whatever names you used.

This will stop all egress traffic and put the FW in a "deallocated" state which does not, itself, incur billing. :)

[nitinkhandelwal26]

Thank you so much @ckittel for this tip..It's very useful.

[ckittel]

I'm gonig to go ahead and close this issue. I know we bounced around topics a bit. If you want to open a new issue, or continue this one, that's fine. Cheers, have a great weekend!