Azure 去年在国区开启了 AKS 预览版，不过并不能直接创建。最近 AKS 发布了公共预览版，在此之前国区可以通过 ACS 创建 Kubernetes，但是 ACS 提供的集群能力有限，并且即将停止维护，建议大家创建集群环境使用 AKS 服务。
因为目前为 AKS 目前为公共预览版，并不提供通过 Portal 门户界面创建 AKS 服务。所以本文就公共预览版本环境，记录如何使用 Azure CLI 创建 AKS服务以及创建过程中可能会出现的相关问题。
Azure CLI 准备环境
MAC 环境下安装 Azure CLI
brew update && brew install azure-cli其他如 Windows 环境请参照文档 安装 Azure CLI
登录到 Azure
首先需要设置 Azure Cloud Location
az cloud set --name AzureChinaCloud使用 login 命令登录，但是笔者登录过程中提示本地回调端口失败，遂使用 Device code 进行登录，两种登录方式体验无差，请自行选择。
$az login
Port '8400' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8401' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8402' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8403' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8404' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8405' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8406' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8407' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8408' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8409' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8410' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8411' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8412' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8413' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8414' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8415' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8416' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8417' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8418' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8419' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8420' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one
Port '8421' is taken with error '[Errno 8] nodename nor servname provided, or not known'. Trying with the next one使用 Device code 登录，并打开认证网页进行认证 microsoft.com/devicelogin… 注意：此时不要关闭控制台。
az login --use-device-code网页验证代码成功后，控制台打印如下输出即代表登录成功。
$ az login --use-device-code
To sign in, use a web browser to open the page https://microsoft.com/deviceloginchina and enter the code xxxx to authenticate.
[
{
"cloudName": "AzureChinaCloud",
"id": "xxx-xx-xxx-xx-xxx",
"isDefault": true,
"name": "xxx",
"state": "Enabled",
"tenantId": "xxxx-xxx-xxx-xxx-xxx",
"user": {
"name": "123@123.partner.onmschina.cn",
"type": "user"
}
}
]创建 Kubernetes
创建 Kubernetes 资源组
选择一个合适的可用区创建资源组，上海2区和北京2区在 2018 年投入使用，主要提供如机器学习和 Kubernetes 相关服务。需要注意的是 chinaeast / chinanorth 并不支持创建 AKS 服务。这里笔者选择了 chinaeast2 也就是上海2区。
$az account list-locations
[
{
"displayName": "China North",
"id": "/subscriptions/xxx/locations/chinanorth",
"latitude": "39.9788",
"longitude": "116.4959",
"name": "chinanorth",
"subscriptionId": null
},
{
"displayName": "China East",
"id": "/subscriptions/xxxx/locations/chinaeast",
"latitude": "31.3209",
"longitude": "121.5891",
"name": "chinaeast",
"subscriptionId": null
},
{
"displayName": "China North 2",
"id": "/subscriptions/a33b1ee6-b1a3-49ba-b49c-c54fd47eb758/locations/chinanorth2",
"latitude": "39.9788",
"longitude": "116.4959",
"name": "chinanorth2",
"subscriptionId": null
},
{
"displayName": "China East 2",
"id": "/subscriptions/xxxx/locations/chinaeast2",
"latitude": "31.3209",
"longitude": "121.5891",
"name": "chinaeast2",
"subscriptionId": null
}
]创建名为 kubernetes 资源组，目标地区为 chinaeast2，执行完成后请前往 Protal 检查相对应的资源组是否创建成功，这里具体打印就不展示了。
az group create --name kubernetes --location chinaeast2创建集群
为了方便，这里我们把 monitoring 插件安装上便于控制台查看集群状态。
az aks create \
--resource-group kubernetes \
--name k8s \
--node-count 3 \
--enable-addons monitoring \
--generate-ssh-keys注意：如遇到 SSH KEY 相关问题，请手动生成秘钥，如下
$ ssh-keygen -o
$ az aks create \
--resource-group kubernetes \
--name k8s \
--node-count 3 \
--enable-addons monitoring \
--ssh-key-value k8s.pub执行创建命令需要较长时间，请耐心等待，笔者大约等待 5 - 8 分钟输出创建结果，此时登录 portal 已经可以看到 AKS 服务。
注意
请注意保存控制台输出的结果，其中包含 SSH 用户名、机器配置、Kubernetes 版本等，如果需要自定义 Kubernetes 版本以及机器配置等信息，请使用 help 命令，或者前往下方链接查看。
后续内容
如何访问 Kubernetes Dahsboard
创建 RABC 权限
kubectl create clusterrolebinding kubernetes-dashboard --clusterrole=cluster-admin --serviceaccount=kube-system:kubernetes-dashboard$ az aks browse --name k8s --resource-group kubernetes
Proxy running on http://127.0.0.1:8001/
Press CTRL+C to close the tunnel...访问 http://127.0.0.1:8001/ 即可查看 Dahsboard
联系我
inf2inf2@outlook.com
