AKS (Kubernetes)

# Install kubectl and kubelogin
az aks install-cli

# Create cluster (system node pool)
az aks create \
  --name myAKS \
  --resource-group myRG \
  --location eastus \
  --node-count 3 \
  --node-vm-size Standard_D4s_v5 \
  --enable-managed-identity \
  --enable-oidc-issuer \
  --enable-workload-identity \
  --network-plugin azure \
  --network-policy calico \
  --generate-ssh-keys

# Create with auto-scaling enabled
az aks create \
  --name myAKS -g myRG \
  --node-count 3 \
  --enable-cluster-autoscaler \
  --min-count 2 --max-count 10 \
  --node-vm-size Standard_D4s_v5 \
  --generate-ssh-keys

# Create in existing VNet
az aks create \
  --name myAKS -g myRG \
  --vnet-subnet-id /subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/aksSubnet \
  --network-plugin azure \
  --generate-ssh-keys

# Get credentials (updates ~/.kube/config)
az aks get-credentials --name myAKS -g myRG

# Verify
kubectl get nodes

# Add a user node pool
az aks nodepool add \
  --cluster-name myAKS -g myRG \
  --name gpupool \
  --node-count 2 \
  --node-vm-size Standard_NC6s_v3 \
  --node-taints sku=gpu:NoSchedule \
  --labels sku=gpu

# Scale a node pool
az aks nodepool scale \
  --cluster-name myAKS -g myRG \
  --name gpupool --node-count 4

# Enable autoscaler on a node pool
az aks nodepool update \
  --cluster-name myAKS -g myRG \
  --name nodepool1 \
  --enable-cluster-autoscaler \
  --min-count 2 --max-count 20

# List node pools
az aks nodepool list --cluster-name myAKS -g myRG -o table

# Delete a node pool
az aks nodepool delete --cluster-name myAKS -g myRG --name gpupool

# Create ACR
az acr create --name myACR -g myRG --sku Basic

# Attach to AKS (grants AcrPull role)
az aks update --name myAKS -g myRG --attach-acr myACR

# Build and push an image
az acr build --registry myACR --image myapp:v1 .

# Pull from ACR in a deployment
# image: myacr.azurecr.io/myapp:v1

# Apply a manifest
kubectl apply -f deployment.yaml

# Quick deployment
kubectl create deployment myapp \
  --image=myacr.azurecr.io/myapp:v1 \
  --replicas=3

# Expose as LoadBalancer
kubectl expose deployment myapp \
  --type=LoadBalancer --port=80 --target-port=3000

# Check rollout status
kubectl rollout status deployment/myapp

# Update image
kubectl set image deployment/myapp myapp=myacr.azurecr.io/myapp:v2

# Rollback
kubectl rollout undo deployment/myapp

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myacr.azurecr.io/myapp:v1
        ports:
        - containerPort: 3000
        resources:
          requests:
            cpu: "250m"
            memory: "256Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"
---
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 3000
  type: LoadBalancer

# Install NGINX ingress controller via Helm
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx --create-namespace \
  --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz

# Get ingress controller external IP
kubectl get svc -n ingress-nginx ingress-nginx-controller

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80

# Create a managed identity
az identity create --name myWorkloadId -g myRG

CLIENT_ID=$(az identity show --name myWorkloadId -g myRG --query clientId -o tsv)
OIDC_ISSUER=$(az aks show -n myAKS -g myRG --query oidcIssuerProfile.issuerUrl -o tsv)

# Federate the identity with a Kubernetes service account
az identity federated-credential create \
  --name myFederatedCred \
  --identity-name myWorkloadId -g myRG \
  --issuer "$OIDC_ISSUER" \
  --subject system:serviceaccount:default:myapp-sa \
  --audience api://AzureADTokenExchange

# Grant access to Key Vault
az keyvault set-policy --name myKV \
  --secret-permissions get list \
  --spn $CLIENT_ID

# Enable Azure Monitor (Container Insights)
az aks enable-addons \
  --name myAKS -g myRG \
  --addons monitoring \
  --workspace-resource-id /subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace

# Common kubectl monitoring
kubectl top nodes
kubectl top pods -A
kubectl get events --sort-by=.lastTimestamp -n default
kubectl describe pod <pod> | tail -20
kubectl logs <pod> --previous   # crashed container logs