Upgrade to Pro — share decks privately, control downloads, hide ads and more …

20230328 ARO Technical Workshop

20230328 ARO Technical Workshop

#aro #microsoft

Phil Huang

March 28, 2023

More Decks by Phil Huang

Other Decks in Technology


  1. Azure Red Hat OpenShift 網路參數 CIDR Design 預設子網段 子網段可改? 預設遮罩

    (Netmask) 備註 Master Node CIDR 跟隨初始設定 Yes 最小 /27 Worker Node CIDR 跟隨初始設定 Yes 最小 /27 Service CIDR Yes 預設 /16,最小 /18 Pod CIDR Yes 預設 /14,最小 /18 每一個 Node 預設分配 /23 網段, 不可修改 Ref: https://docs.microsoft.com/zh-tw/azure/openshift/concepts-networking Netmask Usable Hosts /27 30 /24 254 /23 510 /18 16382 /16 65534 /14 262142
  2. 請愛用 az aro Ref: https://learn.microsoft.com/en-us/cli/azure/aro?view=azure-cli-latest#az-aro-create az aro create --master-subnet --name

    --resource-group --worker-subnet [--apiserver-visibility {Private, Public}] [--client-id] [--client-secret] [--cluster-resource-group] [--disk-encryption-set] [--domain] [--fips {false, true}] [--ingress-visibility {Private, Public}] [--location] [--master-enc-host {false, true}] [--master-vm-size] [--no-wait] [--pod-cidr] [--pull-secret] [--service-cidr] [--tags] [--version] [--vnet] [--vnet-resource-group] [--worker-count] [--worker-enc-host {false, true}] [--worker-vm-disk-size-gb] [--worker-vm-size]
  3. Azure Red Hat OpenShift Landing Zone Accelerator Azure Red Hat

    OpenShift Reference Architecture Ref: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/app-platform/azure-red-hat-openshift/landing-zone-accelerator • 網路拓樸和連線能力 • 身分識別 • 安全性 • 平台自動化 • 維運管理
  4. Private DNS zone privatelink.database.windows.net Azure-provided DNS azsql1.database.windows.net VPN /

    ExpressRoute snet-consumer Client VM Private Link endpoint DNS forwarder Azure recursive resolvers 3 4 5 6 Virtual network link VNet-hub-001 On-premises network 2 7 DNS traffic Private connection Internal DNS 1 8 9 Conditional forwarder IP address DNS vmdns Forward Lookup Zones Reverse Lookup Zones Trust Points Conditional Forwarders database.windows.net Microsoft Azure Use DNS Forwarder VM
  5. On-premises server Windows desktops APP 2 APP 3 APP 1

    Outbound endpoint Inbound endpoint DNS Query Spoke 1 Spoke 2 Peering (optional) abc.privatelink.blob.core.windows.net – abc.privatelink.azure-api.net - Azure Private DNS Azure DNS VM 1 VM 2 Virtual network link App1.onprem.company.com - App2.onprem.company.com - blob.core.windows.net – (via forwarder) azure-api.net – (via forwarder) On-premises 1 3 4 5 5 Azure ExpressRoute 2 Site-to-site or Azure ExpressRoute gateway Azure Microsoft Azure Azure DNS Private Resolver Traffic flow for on-premise DNS Query https://learn.microsoft.com/en-us/azure/architecture/example-scenario/networking/azure-dns-private-resolver
  6. Machine API Operator for Azure 基於 Kubernetes Cluster API 的

    API Adopters Ref: https://capz.sigs.k8s.io/ https://github.com/openshift/machine-api-provider-azure CRD API Group Default? 目的 Node v1 Yes 以 Kubernetes 角度描述,包含 CPU / Mem. / 可用 Pod 數量等 Machines machine.openshift.io Yes 描述 VM Instances 角度描述,如 SKU / osDisk / Zone / Images 名稱等 MachineSets machine.openshift.io Yes 負責維護 Machine 數量 MachineHealthChecks machine.openshift.io Yes 確認 Machine 健康與否 MachineAutoscalers autoscaling.openshift.io No 以單一叢集角度設定 資源限制 / ScaleDown 的條件等 MachineConfigs machieconfiguration.ope nshift.io Yes 定義每個機器的設定,包含 Kernel 參數 / OS 相關設定 / SSH Key 等