Microsoft Azure

This guide walks through deploying NKP on Microsoft Azure with nic (the Nebari Infrastructure Core CLI), from an Azure subscription to a running cluster you can manage and tear down.

What your team gets

When nic deploy finishes, your team will have:

• A managed Kubernetes cluster ready for workloads (Azure Kubernetes Service, or AKS).
• NKP running on the cluster, with single sign-on, routing, TLS, and GitOps.

Not yet available on Azure

• Longhorn backups
• Enterprise TLS trust bundles on nodes

Prerequisites

Azure subscription

You'll need an Azure subscription and an account with the Owner role on it, or Contributor plus User Access Administrator. AKS and its virtual machines bill from the moment they're created.

Install nic and the Azure CLI

1. Follow the Install NIC guide to install the nic CLI.
2. Install the Azure CLI. nic uses it to sign in to Azure, so keep it installed for every deploy and destroy.

GitOps repository

See GitOps repository in the Prepare to deploy guide.

Secrets and credentials

To let nic create resources in your subscription, sign in with the Azure CLI:

az login

In CI, where no one can run az login, set AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET instead.

Then, from inside your GitOps repo clone, download the template:

cd /path/to/your-gitops-repo
curl -o .env https://raw.githubusercontent.com/nebari-dev/nebari-infrastructure-core/main/.env.example

Then edit .env so the Azure and GitOps lines look like this:

# Leave these three commented unless you sign in from CI:
# AZURE_CLIENT_ID=your_client_id
# AZURE_CLIENT_SECRET=your_client_secret
# AZURE_TENANT_ID=your_tenant_id

AZURE_SUBSCRIPTION_ID=<your-subscription-id>   # required

GIT_TOKEN=github_pat_...
ARGOCD_GIT_TOKEN=github_pat_...   # optional

For .gitignore setup and GitOps token configuration, see Secrets and credentials in the Prepare to deploy guide.

To find your subscription ID, run:

az account show --query id --output tsv

Cost considerations

A NKP deployment provisions several Azure resources that bill from day one. Check the Azure pricing pages for current rates in your region.

• AKS cluster management: free on the Free tier, which nic uses by default. Azure recommends the Free tier only for development and testing. For production, set sku_tier: Standard, which adds an hourly charge per cluster and an uptime SLA.
• Virtual machines in your node groups: per-hour billing for each running node.
• Managed disks: the OS disk on each node.
• Load balancer and public IP addresses: one IP for the cluster's outbound traffic, and one for incoming traffic to your apps.
• Storage account: stores a record of what nic deployed, so it can update or remove it later.

Configuration

Download the starter config into the directory you'll deploy from:

curl -O https://raw.githubusercontent.com/nebari-dev/nebari-infrastructure-core/main/examples/azure-config.yaml

At minimum, edit these fields, and replace the starter's ssh block with token:

project_name: my-cluster  # letters, digits and hyphens; becomes the AKS DNS prefix
domain: nebari.example.com  # a hostname you own

certificate:
  acme:
    email: you@example.com  # required for Let's Encrypt; renewal notices go here

repository:
  existing:
    url: "https://github.com/<your-org>/<your-gitops-repo>.git"
    branch: main
    path: clusters/my-cluster  # subdirectory in the repo; conventionally matches project_name
    auth:
      # ssh:                        # comment out the starter's ssh block
      #   env: GIT_SSH_PRIVATE_KEY
      token:
        env: GIT_TOKEN  # matches the GIT_TOKEN set in .env

cluster:
  azure:
    region: eastus  # an Azure region where AKS is available

For every Azure option, such as private clusters, existing virtual networks, and node group labels and taints, see the Azure configuration reference.

Deploy and verify

Follow Deploy a cluster to deploy and verify, using azure-config.yaml as the config file.

After deploy, point your domain at the cluster. Cloudflare DNS shows how to have nic create the DNS records, or how to add them manually with any DNS provider.

First sign-in

See Keycloak authentication for first sign-in.

Update an existing deployment

To change something about a running cluster, such as the size of a node group, edit your config and re-run the deploy commands as described in Update a cluster.

Upgrade Kubernetes version

Set kubernetes_version under cluster.azure in your config, as "1.34" or "1.34.0". AKS can't skip minor versions, so to go from 1.32 to 1.34, upgrade to 1.33 first.

Then follow Upgrade Kubernetes version.

Destroy

Run the destroy commands as described in Destroy a cluster.

nic destroy removes the resources it created for the cluster, but it may leave some behind. To clean them up, run az resource delete --ids <resource-ids> with the IDs from the nic destroy output.