On-boarding K8S cluster to AzureArc

RamNad 20

I am trying to connect my internal K8S cluster using AzureArc. I've completed the required steps, such as installing the extensions, registering the providers, and connecting the cluster. In the azurearc it's showing as connected but I cannot see the namespaces or workloads, always getting the below error. It's due to the missing sign-in token, as I haven't created a serviceaccount to connect. Do you have any idea how to enter this in the portal?

Unable to reach the api server or api server is too busy to respond. {"message":"Failed to fetch","stack":"TypeError: Failed to fetch\n at https://portal.azure.com/Content/Dynamic/UvHUDvXWE-oN.js:113:24067","isError":true}

Rahul Podila 1,070 Reputation points Microsoft Vendor

2024-10-16T02:29:48.0566667+00:00

Hi @RamNad
Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.
Create a service principal: In your Azure AD tenant, go to Azure Active Directory > App Registrations. Select your registered application. Under Certificates & secrets, click New client secret. Give it a description and set an expiration date. Click Add. Note down the client secret value.

Generate a token: Use a tool like Azure CLI, PowerShell, or a REST API to obtain an access token using the service principal's client ID, client secret, and tenant ID.

Configure Azure Arc: In the Azure Arc portal, navigate to your connected K8S cluster. Under Connectivity, click Configure authentication. Select Azure AD.

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
RamNad 20 Reputation points

2024-10-16T03:20:15.8933333+00:00

Thanks, Rahul for responding. I am not sure, why do I need to create a service principle? I was thinking, I should create a service account, secret, and tokens in my k8s to grant cluster-admin access and use this to sign-in from AzureArc Kubernetes cluster.

Configure Azure Arc: In the Azure Arc portal, navigate to your connected K8S cluster. Under Connectivity, click Configure authentication. Select Azure AD.

I couldn't find the connectivity option either. Not sure, what am I missing.
Rahul Podila 1,070 Reputation points Microsoft Vendor

2024-10-16T08:03:28.97+00:00
Hi @RamNad
You are correct that you need to create a service account, secret, and token in your Kubernetes cluster to grant cluster-admin access and use this to sign-in from Azure Arc Kubernetes cluster.
1. Create Service account:

You need to set up a service account in your cluster that Azure Arc can use to connect to.

kubectl create serviceaccount azure-arc

2. Set Permission of the Service Account:

Azure Arc needs permission to access things like namespaces, pods, and deployments. You can give these permissions by creating a ClusterRole and ClusterRoleBinding.

create a ClusterRole with the necessary permissions (this can be done with a file called azure-arc-role.yaml):

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

rules:

- apiGroups: [""]

    resources: ["pods", "services", "configmaps", "secrets", "nodes"]

    verbs: ["get", "list", "watch"]

- apiGroups: ["apps"]

    resources: ["deployments", "replicasets", "statefulsets"]

    verbs: ["get", "list", "watch"]

Apply the role:

kubectl apply -f azure-arc-role.yaml

Now, bind the service account to the role using a ClusterRoleBinding (in a file called azure-arc-binding.yaml):

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

name: azure-arc-binding

subjects:

kind: ServiceAccount

name: azure-arc

namespace: default (its respective namespace has to be change)

roleRef:

kind: ClusterRole

name: azure-arc-role

apiGroup: rbac.authorization.k8s.io

Apply the binding:

kubectl apply -f azure-arc-binding.yaml

3. Generate a Token for the Service Account:

Next, you need to create a token for the service account. This token will help Azure Arc verify and connect to the account.

kubectl create token azure-arc -n default

4. Configure Azure Arc with the Token:

   Head over to the Azure Portal.

    Navigate to your Azure Arc-connected Kubernetes cluster.

    In the Settings or Configuration section, you’ll find an option to enter the service account token.Paste the token you generated in Step 3.

5. Check if the Connection is Working:

After updating Azure Arc with the token, go back to the Azure Portal and check if the namespace and workload are now visible.

Once you have completed this step, Azure Arc should be able to run and display the resources in your cluster.
I suggested you go with this link for more details:- https://stackoverflow.com/questions/73564096/aks-not-showing-the-list-of-namespaces-and-workloads
https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/overview
Rahul Podila 1,070 Reputation points Microsoft Vendor

2024-10-17T04:39:18.0966667+00:00

Hi @RamNad
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Rahul Podila 1,070 Reputation points Microsoft Vendor

2024-10-18T01:44:49.3633333+00:00

Hi @RamNad
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!

1 answer

Jeff Pigott 160 Reputation points Microsoft Employee

2024-12-19T16:48:25.5366667+00:00

I have experienced the same as it seems the API may be busy. I am using the RBAC option vs. token and service principal was not needed here. If you haven't tried the RBAC option give it a try as well although that doesn't fix the error your receiving when the API is busy but seems to be a much better user experience. https://jpigott.com/2023/11/azure-arc-kubernetes-access-by-rbac-roles-for-a-user-or-groups/
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

On-boarding K8S cluster to AzureArc

1 answer

Your answer