ManagedCluster
Provides a ManagedCluster from the ContainerService group
Examples
Create/Update Managed Cluster
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS1_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
scaleDownMode: "Deallocate",
availabilityZones: ["1", "2", "3"],
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"balance-similar-node-groups": "true",
expander: "priority",
"max-node-provision-time": "15m",
"new-pod-scale-up-delay": "1m",
"scale-down-delay-after-add": "15m",
"scan-interval": "20s",
"skip-nodes-with-system-pods": "false",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
identity: {
type: "UserAssigned",
userAssignedIdentities: {
"/subscriptions/subid1/resourceGroups/rgName1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity1":
{},
},
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create/Update AAD Managed Cluster with EnableAzureRBAC
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS1_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
availabilityZones: ["1", "2", "3"],
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
aadProfile: { managed: true, enableAzureRBAC: true },
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with PPG
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
proximityPlacementGroupID:
"/subscriptions/subid1/resourcegroups/rg1/providers//Microsoft.Compute/proximityPlacementGroups/ppg1",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with OSSKU
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
osSKU: "CBLMariner",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
httpProxyConfig: {
httpProxy: "http://myproxy.server.com:8080",
httpsProxy: "https://myproxy.server.com:8080",
noProxy: ["localhost", "127.0.0.1"],
trustedCa: "Q29uZ3JhdHMhIFlvdSBoYXZlIGZvdW5kIGEgaGlkZGVuIG1lc3NhZ2U=",
},
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with GPUMIG
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_ND96asr_v4",
osType: "Linux",
gpuInstanceProfile: "MIG3g",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
httpProxyConfig: {
httpProxy: "http://myproxy.server.com:8080",
httpsProxy: "https://myproxy.server.com:8080",
noProxy: ["localhost", "127.0.0.1"],
trustedCa: "Q29uZ3JhdHMhIFlvdSBoYXZlIGZvdW5kIGEgaGlkZGVuIG1lc3NhZ2U=",
},
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create/Update Managed Cluster with EnableAHUB
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS1_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
availabilityZones: ["1", "2", "3"],
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
licenseType: "Windows_Server",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
identity: {
type: "UserAssigned",
userAssignedIdentities: {
"/subscriptions/subid1/resourceGroups/rgName1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity1":
{},
},
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with EncryptionAtHost enabled
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
enableEncryptionAtHost: true,
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with UltraSSD enabled
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
enableUltraSSD: true,
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with PodIdentity enabled
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
podIdentityProfile: { enabled: true, allowNetworkPluginKubenet: true },
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Private Cluster with fqdn subdomain specified
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
fqdnSubdomain: "domain1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
enableEncryptionAtHost: true,
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
apiServerAccessProfile: {
enablePrivateCluster: true,
privateDNSZone:
"/subscriptions/subid1/resourcegroups/rg1/providers/Microsoft.Network/privateDnsZones/privatelink.location1.azmk8s.io",
},
addonProfiles: {},
enableRBAC: true,
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Private Cluster with Public FQDN specified
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
enableEncryptionAtHost: true,
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
apiServerAccessProfile: {
enablePrivateCluster: true,
enablePrivateClusterPublicFQDN: true,
},
addonProfiles: {},
enableRBAC: true,
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with RunCommand disabled
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
enableEncryptionAtHost: true,
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
apiServerAccessProfile: { disableRunCommand: true },
addonProfiles: {},
enableRBAC: true,
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with Node Public IP Prefix
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
nodePublicIPPrefixID:
"/subscriptions/subid1/resourcegroups/rg1/providers/Microsoft.Network/publicIPPrefixes/public-ip-prefix",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with FIPS enabled OS
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
enableFIPS: true,
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: false,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with HTTP proxy configured
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
httpProxyConfig: {
httpProxy: "http://myproxy.server.com:8080",
httpsProxy: "https://myproxy.server.com:8080",
noProxy: ["localhost", "127.0.0.1"],
trustedCa: "Q29uZ3JhdHMhIFlvdSBoYXZlIGZvdW5kIGEgaGlkZGVuIG1lc3NhZ2U=",
},
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with Security Profile configured
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
securityProfile: {
defender: {
logAnalyticsWorkspaceResourceId:
"/subscriptions/SUB_ID/resourcegroups/RG_NAME/providers/microsoft.operationalinsights/workspaces/WORKSPACE_NAME",
securityMonitoring: { enabled: true },
},
},
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with AKS-managed NAT gateway as outbound type
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: false,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "managedNATGateway",
natGatewayProfile: { managedOutboundIPProfile: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with user-assigned NAT gateway as outbound type
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: false,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "userAssignedNATGateway",
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster using an agent pool snapshot
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
mode: "System",
enableFIPS: true,
creationData: {
sourceResourceId:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.ContainerService/snapshots/snapshot1",
},
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: false,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create/Update Managed Cluster with Windows gMSA enabled
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS1_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
availabilityZones: ["1", "2", "3"],
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
gmsaProfile: { enabled: true },
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
identity: {
type: "UserAssigned",
userAssignedIdentities: {
"/subscriptions/subid1/resourceGroups/rgName1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity1":
{},
},
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create/Update Managed Cluster with dual-stack networking
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS1_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
scaleDownMode: "Deallocate",
availabilityZones: ["1", "2", "3"],
enableNodePublicIP: true,
mode: "System",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
ipFamilies: ["IPv4", "IPv6"],
},
autoScalerProfile: {
"balance-similar-node-groups": "true",
expander: "priority",
"max-node-provision-time": "15m",
"new-pod-scale-up-delay": "1m",
"scale-down-delay-after-add": "15m",
"scan-interval": "20s",
"skip-nodes-with-system-pods": "false",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: true,
},
identity: {
type: "UserAssigned",
userAssignedIdentities: {
"/subscriptions/subid1/resourceGroups/rgName1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity1":
{},
},
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Create Managed Cluster with Dedicated Host Group
exports.createResources = () => [
{
type: "ManagedCluster",
group: "ContainerService",
name: "myManagedCluster",
properties: () => ({
location: "location1",
tags: { tier: "production", archv2: "" },
sku: { name: "Basic", tier: "Free" },
properties: {
kubernetesVersion: "",
dnsPrefix: "dnsprefix1",
agentPoolProfiles: [
{
name: "nodepool1",
count: 3,
vmSize: "Standard_DS2_v2",
osType: "Linux",
type: "VirtualMachineScaleSets",
enableNodePublicIP: true,
hostGroupID:
"/subscriptions/subid1/resourcegroups/rg/providers/Microsoft.Compute/hostGroups/hostgroup1",
},
],
linuxProfile: {
adminUsername: "azureuser",
ssh: { publicKeys: [{ keyData: "keydata" }] },
},
networkProfile: {
loadBalancerSku: "standard",
outboundType: "loadBalancer",
loadBalancerProfile: { managedOutboundIPs: { count: 2 } },
},
autoScalerProfile: {
"scan-interval": "20s",
"scale-down-delay-after-add": "15m",
},
windowsProfile: {
adminUsername: "azureuser",
adminPassword: "replacePassword1234$",
},
servicePrincipalProfile: { clientId: "clientid", secret: "secret" },
addonProfiles: {},
enableRBAC: true,
diskEncryptionSetID:
"/subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des",
enablePodSecurityPolicy: false,
},
}),
dependencies: ({}) => ({
resourceGroup: "myResourceGroup",
managedIdentities: ["myUserAssignedIdentity"],
diskEncryptionSet: "myDiskEncryptionSet",
routes: ["myRoute"],
}),
},
];
Dependencies
Swagger Schema
{
type: 'object',
properties: {
sku: {
description: 'The managed cluster SKU.',
type: 'object',
properties: {
name: {
type: 'string',
description: 'The name of a managed cluster SKU.',
enum: [ 'Basic' ],
'x-ms-enum': { name: 'ManagedClusterSKUName', modelAsString: true }
},
tier: {
type: 'string',
title: 'The tier of a managed cluster SKU.',
description: "If not specified, the default is 'Free'. See [uptime SLA](https://docs.microsoft.com/azure/aks/uptime-sla) for more details.",
enum: [ 'Paid', 'Free' ],
'x-ms-enum': {
name: 'ManagedClusterSKUTier',
modelAsString: true,
values: [
{
value: 'Paid',
description: "Guarantees 99.95% availability of the Kubernetes API server endpoint for clusters that use Availability Zones and 99.9% of availability for clusters that don't use Availability Zones."
},
{
value: 'Free',
description: 'No guaranteed SLA, no additional charges. Free tier clusters have an SLO of 99.5%.'
}
]
}
}
}
},
extendedLocation: {
description: 'The extended location of the Virtual Machine.',
type: 'object',
properties: {
name: {
type: 'string',
description: 'The name of the extended location.'
},
type: {
description: 'The type of the extended location.',
type: 'string',
enum: [ 'EdgeZone' ],
'x-ms-enum': { name: 'ExtendedLocationTypes', modelAsString: true }
}
}
},
identity: {
description: 'The identity of the managed cluster, if configured.',
type: 'object',
properties: {
principalId: {
readOnly: true,
type: 'string',
description: 'The principal id of the system assigned identity which is used by master components.'
},
tenantId: {
readOnly: true,
type: 'string',
description: 'The tenant id of the system assigned identity which is used by master components.'
},
type: {
type: 'string',
title: 'The type of identity used for the managed cluster.',
description: 'For more information see [use managed identities in AKS](https://docs.microsoft.com/azure/aks/use-managed-identity).',
enum: [ 'SystemAssigned', 'UserAssigned', 'None' ],
'x-ms-enum': {
name: 'ResourceIdentityType',
modelAsString: false,
values: [
{
value: 'SystemAssigned',
description: 'Use an implicitly created system assigned managed identity to manage cluster resources. Master components in the control plane such as kube-controller-manager will use the system assigned managed identity to manipulate Azure resources.'
},
{
value: 'UserAssigned',
description: 'Use a user-specified identity to manage cluster resources. Master components in the control plane such as kube-controller-manager will use the specified user assigned managed identity to manipulate Azure resources.'
},
{
value: 'None',
description: 'Do not use a managed identity for the Managed Cluster, service principal will be used instead.'
}
]
}
},
userAssignedIdentities: {
type: 'object',
additionalProperties: {
type: 'object',
'x-ms-client-name': 'ManagedServiceIdentityUserAssignedIdentitiesValue',
properties: {
principalId: {
readOnly: true,
type: 'string',
description: 'The principal id of user assigned identity.'
},
clientId: {
readOnly: true,
type: 'string',
description: 'The client id of user assigned identity.'
}
}
},
title: 'The user identity associated with the managed cluster. This identity will be used in control plane. Only one user assigned identity is allowed.',
description: "The keys must be ARM resource IDs in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'."
}
}
},
properties: {
description: 'Properties of a managed cluster.',
'x-ms-client-flatten': true,
type: 'object',
properties: {
provisioningState: {
readOnly: true,
type: 'string',
description: 'The current provisioning state.'
},
powerState: {
description: 'The Power State of the cluster.',
readOnly: true,
type: 'object',
properties: {
code: {
type: 'string',
description: 'Tells whether the cluster is Running or Stopped',
enum: [ 'Running', 'Stopped' ],
'x-ms-enum': {
name: 'code',
modelAsString: true,
values: [
{
value: 'Running',
description: 'The cluster is running.'
},
{
value: 'Stopped',
description: 'The cluster is stopped.'
}
]
}
}
}
},
maxAgentPools: {
readOnly: true,
type: 'integer',
format: 'int32',
description: 'The max number of agent pools for the managed cluster.'
},
kubernetesVersion: {
type: 'string',
title: 'The version of Kubernetes specified by the user.',
description: 'Both patch version <major.minor.patch> (e.g. 1.20.13) and <major.minor> (e.g. 1.20) are supported. When <major.minor> is specified, the latest supported GA patch version is chosen automatically. Updating the cluster with the same <major.minor> once it has been created (e.g. 1.14.x -> 1.14) will not trigger an upgrade, even if a newer patch version is available. When you upgrade a supported AKS cluster, Kubernetes minor versions cannot be skipped. All upgrades must be performed sequentially by major version number. For example, upgrades between 1.14.x -> 1.15.x or 1.15.x -> 1.16.x are allowed, however 1.14.x -> 1.16.x is not allowed. See [upgrading an AKS cluster](https://docs.microsoft.com/azure/aks/upgrade-cluster) for more details.'
},
currentKubernetesVersion: {
readOnly: true,
type: 'string',
title: 'The version of Kubernetes the Managed Cluster is running.',
description: 'If kubernetesVersion was a fully specified version <major.minor.patch>, this field will be exactly equal to it. If kubernetesVersion was <major.minor>, this field will contain the full <major.minor.patch> version being used.'
},
dnsPrefix: {
type: 'string',
title: 'The DNS prefix of the Managed Cluster.',
description: 'This cannot be updated once the Managed Cluster has been created.'
},
fqdnSubdomain: {
type: 'string',
title: 'The FQDN subdomain of the private cluster with custom private dns zone.',
description: 'This cannot be updated once the Managed Cluster has been created.'
},
fqdn: {
readOnly: true,
type: 'string',
description: 'The FQDN of the master pool.'
},
privateFQDN: {
readOnly: true,
type: 'string',
description: 'The FQDN of private cluster.'
},
azurePortalFQDN: {
readOnly: true,
type: 'string',
title: 'The special FQDN used by the Azure Portal to access the Managed Cluster. This FQDN is for use only by the Azure Portal and should not be used by other clients.',
description: "The Azure Portal requires certain Cross-Origin Resource Sharing (CORS) headers to be sent in some responses, which Kubernetes APIServer doesn't handle by default. This special FQDN supports CORS, allowing the Azure Portal to function properly."
},
agentPoolProfiles: {
type: 'array',
items: {
type: 'object',
allOf: [
{
type: 'object',
properties: {
count: {
type: 'integer',
format: 'int32',
description: 'Number of agents (VMs) to host docker containers. Allowed values must be in the range of 0 to 1000 (inclusive) for user pools and in the range of 1 to 1000 (inclusive) for system pools. The default value is 1.'
},
vmSize: {
type: 'string',
title: 'The size of the agent pool VMs.',
description: 'VM size availability varies by region. If a node contains insufficient compute resources (memory, cpu, etc) pods might fail to run correctly. For more details on restricted VM sizes, see: https://docs.microsoft.com/azure/aks/quotas-skus-regions'
},
osDiskSizeGB: {
type: 'integer',
format: 'int32',
maximum: 2048,
minimum: 0,
description: 'OS Disk Size in GB to be used to specify the disk size for every machine in the master/agent pool. If you specify 0, it will apply the default osDisk size according to the vmSize specified.'
},
osDiskType: {
type: 'string',
enum: [ 'Managed', 'Ephemeral' ],
'x-ms-enum': {
name: 'OSDiskType',
modelAsString: true,
values: [
{
value: 'Managed',
description: "Azure replicates the operating system disk for a virtual machine to Azure storage to avoid data loss should the VM need to be relocated to another host. Since containers aren't designed to have local state persisted, this behavior offers limited value while providing some drawbacks, including slower node provisioning and higher read/write latency."
},
{
value: 'Ephemeral',
description: 'Ephemeral OS disks are stored only on the host machine, just like a temporary disk. This provides lower read/write latency, along with faster node scaling and cluster upgrades.'
}
]
},
title: 'The OS disk type to be used for machines in the agent pool.',
description: "The default is 'Ephemeral' if the VM supports it and has a cache disk larger than the requested OSDiskSizeGB. Otherwise, defaults to 'Managed'. May not be changed after creation. For more information see [Ephemeral OS](https://docs.microsoft.com/azure/aks/cluster-configuration#ephemeral-os)."
},
kubeletDiskType: {
type: 'string',
enum: [ 'OS', 'Temporary' ],
'x-ms-enum': {
name: 'KubeletDiskType',
modelAsString: true,
values: [
{
value: 'OS',
description: 'Kubelet will use the OS disk for its data.'
},
{
value: 'Temporary',
description: 'Kubelet will use the temporary disk for its data.'
}
]
},
description: 'Determines the placement of emptyDir volumes, container runtime data root, and Kubelet ephemeral storage.'
},
workloadRuntime: {
type: 'string',
enum: [ 'OCIContainer', 'WasmWasi' ],
'x-ms-enum': {
name: 'WorkloadRuntime',
modelAsString: true,
values: [
{
value: 'OCIContainer',
description: 'Nodes will use Kubelet to run standard OCI container workloads.'
},
{
value: 'WasmWasi',
description: 'Nodes will use Krustlet to run WASM workloads using the WASI provider (Preview).'
}
]
},
description: 'Determines the type of workload a node can run.'
},
vnetSubnetID: {
type: 'string',
format: 'arm-id',
'x-ms-arm-id-details': {
allowedResources: [
{
type: 'Microsoft.Network/virtualNetworks/subnets'
}
]
},
title: 'The ID of the subnet which agent pool nodes and optionally pods will join on startup.',
description: 'If this is not specified, a VNET and subnet will be generated and used. If no podSubnetID is specified, this applies to nodes and pods, otherwise it applies to just nodes. This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkName}/subnets/{subnetName}'
},
podSubnetID: {
type: 'string',
format: 'arm-id',
'x-ms-arm-id-details': {
allowedResources: [
{
type: 'Microsoft.Network/virtualNetworks/subnets'
}
]
},
title: 'The ID of the subnet which pods will join when launched.',
description: 'If omitted, pod IPs are statically assigned on the node subnet (see vnetSubnetID for more details). This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkName}/subnets/{subnetName}'
},
maxPods: {
type: 'integer',
format: 'int32',
description: 'The maximum number of pods that can run on a node.'
},
osType: {
type: 'string',
default: 'Linux',
enum: [ 'Linux', 'Windows' ],
'x-ms-enum': {
name: 'OSType',
modelAsString: true,
values: [
{ value: 'Linux', description: 'Use Linux.' },
{
value: 'Windows',
description: 'Use Windows.'
}
]
},
description: 'The operating system type. The default is Linux.'
},
osSKU: {
type: 'string',
enum: [ 'Ubuntu', 'CBLMariner' ],
'x-ms-enum': { name: 'OSSKU', modelAsString: true },
description: 'Specifies an OS SKU. This value must not be specified if OSType is Windows.'
},
maxCount: {
type: 'integer',
format: 'int32',
description: 'The maximum number of nodes for auto-scaling'
},
minCount: {
type: 'integer',
format: 'int32',
description: 'The minimum number of nodes for auto-scaling'
},
enableAutoScaling: {
type: 'boolean',
description: 'Whether to enable auto-scaler'
},
scaleDownMode: {
title: 'The scale down mode to use when scaling the Agent Pool.',
description: 'This also effects the cluster autoscaler behavior. If not specified, it defaults to Delete.',
type: 'string',
enum: [ 'Delete', 'Deallocate' ],
'x-ms-enum': {
name: 'ScaleDownMode',
modelAsString: true,
values: [
{
value: 'Delete',
description: 'Create new instances during scale up and remove instances during scale down.'
},
{
value: 'Deallocate',
description: 'Attempt to start deallocated instances (if they exist) during scale up and deallocate instances during scale down.'
}
]
}
},
type: {
type: 'string',
enum: [ 'VirtualMachineScaleSets', 'AvailabilitySet' ],
'x-ms-enum': {
name: 'AgentPoolType',
modelAsString: true,
values: [
{
value: 'VirtualMachineScaleSets',
description: 'Create an Agent Pool backed by a Virtual Machine Scale Set.'
},
{
value: 'AvailabilitySet',
description: 'Use of this is strongly discouraged.'
}
]
},
description: 'The type of Agent Pool.'
},
mode: {
type: 'string',
enum: [ 'System', 'User' ],
'x-ms-enum': {
name: 'AgentPoolMode',
modelAsString: true,
values: [
{
value: 'System',
description: 'System agent pools are primarily for hosting critical system pods such as CoreDNS and metrics-server. System agent pools osType must be Linux. System agent pools VM SKU must have at least 2vCPUs and 4GB of memory.'
},
{
value: 'User',
description: 'User agent pools are primarily for hosting your application pods.'
}
]
},
title: 'The mode of an agent pool.',
description: "A cluster must have at least one 'System' Agent Pool at all times. For additional information on agent pool restrictions and best practices, see: https://docs.microsoft.com/azure/aks/use-system-pools"
},
orchestratorVersion: {
type: 'string',
title: 'The version of Kubernetes specified by the user.',
description: 'Both patch version <major.minor.patch> (e.g. 1.20.13) and <major.minor> (e.g. 1.20) are supported. When <major.minor> is specified, the latest supported GA patch version is chosen automatically. Updating the cluster with the same <major.minor> once it has been created (e.g. 1.14.x -> 1.14) will not trigger an upgrade, even if a newer patch version is available. As a best practice, you should upgrade all node pools in an AKS cluster to the same Kubernetes version. The node pool version must have the same major version as the control plane. The node pool minor version must be within two minor versions of the control plane version. The node pool version cannot be greater than the control plane version. For more information see [upgrading a node pool](https://docs.microsoft.com/azure/aks/use-multiple-node-pools#upgrade-a-node-pool).'
},
currentOrchestratorVersion: {
readOnly: true,
type: 'string',
title: 'The version of Kubernetes the Agent Pool is running.',
description: 'If orchestratorVersion is a fully specified version <major.minor.patch>, this field will be exactly equal to it. If orchestratorVersion is <major.minor>, this field will contain the full <major.minor.patch> version being used.'
},
nodeImageVersion: {
readOnly: true,
type: 'string',
description: 'The version of node image'
},
upgradeSettings: {
description: 'Settings for upgrading the agentpool',
type: 'object',
properties: {
maxSurge: {
type: 'string',
title: 'The maximum number or percentage of nodes that are surged during upgrade.',
description: "This can either be set to an integer (e.g. '5') or a percentage (e.g. '50%'). If a percentage is specified, it is the percentage of the total agent pool size at the time of the upgrade. For percentages, fractional nodes are rounded up. If not specified, the default is 1. For more information, including best practices, see: https://docs.microsoft.com/azure/aks/upgrade-cluster#customize-node-surge-upgrade"
}
}
},
provisioningState: {
readOnly: true,
type: 'string',
description: 'The current deployment or provisioning state.'
},
powerState: {
title: 'Whether the Agent Pool is running or stopped.',
description: 'When an Agent Pool is first created it is initially Running. The Agent Pool can be stopped by setting this field to Stopped. A stopped Agent Pool stops all of its VMs and does not accrue billing charges. An Agent Pool can only be stopped if it is Running and provisioning state is Succeeded',
type: 'object',
properties: {
code: {
type: 'string',
description: 'Tells whether the cluster is Running or Stopped',
enum: [ 'Running', 'Stopped' ],
'x-ms-enum': {
name: 'code',
modelAsString: true,
values: [
{
value: 'Running',
description: 'The cluster is running.'
},
{
value: 'Stopped',
description: 'The cluster is stopped.'
}
]
}
}
}
},
availabilityZones: {
type: 'array',
items: { type: 'string' },
description: "The list of Availability zones to use for nodes. This can only be specified if the AgentPoolType property is 'VirtualMachineScaleSets'."
},
enableNodePublicIP: {
type: 'boolean',
title: 'Whether each node is allocated its own public IP.',
description: 'Some scenarios may require nodes in a node pool to receive their own dedicated public IP addresses. A common scenario is for gaming workloads, where a console needs to make a direct connection to a cloud virtual machine to minimize hops. For more information see [assigning a public IP per node](https://docs.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools). The default is false.'
},
nodePublicIPPrefixID: {
type: 'string',
format: 'arm-id',
'x-ms-arm-id-details': {
allowedResources: [
{ type: 'Microsoft.Network/publicIPPrefixes' }
]
},
title: 'The public IP prefix ID which VM nodes should use IPs from.',
description: 'This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/publicIPPrefixes/{publicIPPrefixName}'
},
scaleSetPriority: {
description: "The Virtual Machine Scale Set priority. If not specified, the default is 'Regular'.",
type: 'string',
default: 'Regular',
enum: [ 'Spot', 'Regular' ],
'x-ms-enum': {
name: 'ScaleSetPriority',
modelAsString: true,
values: [
{
value: 'Spot',
description: 'Spot priority VMs will be used. There is no SLA for spot nodes. See [spot on AKS](https://docs.microsoft.com/azure/aks/spot-node-pool) for more information.'
},
{
value: 'Regular',
description: 'Regular VMs will be used.'
}
]
}
},
scaleSetEvictionPolicy: {
title: 'The Virtual Machine Scale Set eviction policy to use.',
description: "This cannot be specified unless the scaleSetPriority is 'Spot'. If not specified, the default is 'Delete'.",
type: 'string',
default: 'Delete',
enum: [ 'Delete', 'Deallocate' ],
'x-ms-enum': {
name: 'ScaleSetEvictionPolicy',
modelAsString: true,
values: [
{
value: 'Delete',
description: "Nodes in the underlying Scale Set of the node pool are deleted when they're evicted."
},
{
value: 'Deallocate',
description: 'Nodes in the underlying Scale Set of the node pool are set to the stopped-deallocated state upon eviction. Nodes in the stopped-deallocated state count against your compute quota and can cause issues with cluster scaling or upgrading.'
}
]
}
},
spotMaxPrice: {
title: 'The max price (in US Dollars) you are willing to pay for spot instances. Possible values are any decimal value greater than zero or -1 which indicates default price to be up-to on-demand.',
description: 'Possible values are any decimal value greater than zero or -1 which indicates the willingness to pay any on-demand price. For more details on spot pricing, see [spot VMs pricing](https://docs.microsoft.com/azure/virtual-machines/spot-vms#pricing)',
type: 'number',
default: -1
},
tags: {
type: 'object',
additionalProperties: { type: 'string' },
description: 'The tags to be persisted on the agent pool virtual machine scale set.'
},
nodeLabels: {
type: 'object',
additionalProperties: { type: 'string' },
description: 'The node labels to be persisted across all nodes in agent pool.'
},
nodeTaints: {
type: 'array',
items: { type: 'string' },
description: 'The taints added to new nodes during node pool create and scale. For example, key=value:NoSchedule.'
},
proximityPlacementGroupID: {
description: 'The ID for Proximity Placement Group.',
type: 'string',
format: 'arm-id',
'x-ms-arm-id-details': {
allowedResources: [
{
type: 'Microsoft.Compute/proximityPlacementGroups'
}
]
}
},
kubeletConfig: {
description: 'The Kubelet configuration on the agent pool nodes.',
title: 'Kubelet configurations of agent nodes.',
type: 'object',
properties: {
cpuManagerPolicy: {
type: 'string',
title: 'The CPU Manager policy to use.',
description: "The default is 'none'. See [Kubernetes CPU management policies](https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#cpu-management-policies) for more information. Allowed values are 'none' and 'static'."
},
cpuCfsQuota: {
type: 'boolean',
title: 'If CPU CFS quota enforcement is enabled for containers that specify CPU limits.',
description: 'The default is true.'
},
cpuCfsQuotaPeriod: {
type: 'string',
title: 'The CPU CFS quota period value.',
description: "The default is '100ms.' Valid values are a sequence of decimal numbers with an optional fraction and a unit suffix. For example: '300ms', '2h45m'. Supported units are 'ns', 'us', 'ms', 's', 'm', and 'h'."
},
imageGcHighThreshold: {
type: 'integer',
format: 'int32',
title: 'The percent of disk usage after which image garbage collection is always run.',
description: 'To disable image garbage collection, set to 100. The default is 85%'
},
imageGcLowThreshold: {
type: 'integer',
format: 'int32',
title: 'The percent of disk usage before which image garbage collection is never run.',
description: 'This cannot be set higher than imageGcHighThreshold. The default is 80%'
},
topologyManagerPolicy: {
type: 'string',
title: 'The Topology Manager policy to use.',
description: "For more information see [Kubernetes Topology Manager](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager). The default is 'none'. Allowed values are 'none', 'best-effort', 'restricted', and 'single-numa-node'."
},
allowedUnsafeSysctls: {
type: 'array',
items: { type: 'string' },
description: 'Allowed list of unsafe sysctls or unsafe sysctl patterns (ending in `*`).'
},
failSwapOn: {
type: 'boolean',
description: 'If set to true it will make the Kubelet fail to start if swap is enabled on the node.'
},
containerLogMaxSizeMB: {
type: 'integer',
format: 'int32',
description: 'The maximum size (e.g. 10Mi) of container log file before it is rotated.'
},
containerLogMaxFiles: {
type: 'integer',
format: 'int32',
description: 'The maximum number of container log files that can be present for a container. The number must be ≥ 2.',
minimum: 2
},
podMaxPids: {
type: 'integer',
format: 'int32',
description: 'The maximum number of processes per pod.'
}
}
},
linuxOSConfig: {
description: 'The OS configuration of Linux agent nodes.',
title: 'OS configurations of Linux agent nodes.',
type: 'object',
properties: {
sysctls: {
description: 'Sysctl settings for Linux agent nodes.',
type: 'object',
properties: {
netCoreSomaxconn: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.core.somaxconn.'
},
netCoreNetdevMaxBacklog: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.core.netdev_max_backlog.'
},
netCoreRmemDefault: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.core.rmem_default.'
},
netCoreRmemMax: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.core.rmem_max.'
},
netCoreWmemDefault: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.core.wmem_default.'
},
netCoreWmemMax: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.core.wmem_max.'
},
netCoreOptmemMax: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.core.optmem_max.'
},
netIpv4TcpMaxSynBacklog: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.tcp_max_syn_backlog.'
},
netIpv4TcpMaxTwBuckets: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.tcp_max_tw_buckets.'
},
netIpv4TcpFinTimeout: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.tcp_fin_timeout.'
},
netIpv4TcpKeepaliveTime: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.tcp_keepalive_time.'
},
netIpv4TcpKeepaliveProbes: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.tcp_keepalive_probes.'
},
netIpv4TcpkeepaliveIntvl: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.tcp_keepalive_intvl.'
},
netIpv4TcpTwReuse: {
type: 'boolean',
description: 'Sysctl setting net.ipv4.tcp_tw_reuse.'
},
netIpv4IpLocalPortRange: {
type: 'string',
description: 'Sysctl setting net.ipv4.ip_local_port_range.'
},
netIpv4NeighDefaultGcThresh1: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.neigh.default.gc_thresh1.'
},
netIpv4NeighDefaultGcThresh2: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.neigh.default.gc_thresh2.'
},
netIpv4NeighDefaultGcThresh3: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.ipv4.neigh.default.gc_thresh3.'
},
netNetfilterNfConntrackMax: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.netfilter.nf_conntrack_max.'
},
netNetfilterNfConntrackBuckets: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting net.netfilter.nf_conntrack_buckets.'
},
fsInotifyMaxUserWatches: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting fs.inotify.max_user_watches.'
},
fsFileMax: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting fs.file-max.'
},
fsAioMaxNr: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting fs.aio-max-nr.'
},
fsNrOpen: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting fs.nr_open.'
},
kernelThreadsMax: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting kernel.threads-max.'
},
vmMaxMapCount: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting vm.max_map_count.'
},
vmSwappiness: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting vm.swappiness.'
},
vmVfsCachePressure: {
type: 'integer',
format: 'int32',
description: 'Sysctl setting vm.vfs_cache_pressure.'
}
}
},
transparentHugePageEnabled: {
type: 'string',
title: 'Whether transparent hugepages are enabled.',
description: "Valid values are 'always', 'madvise', and 'never'. The default is 'always'. For more information see [Transparent Hugepages](https://www.kernel.org/doc/html/latest/admin-guide/mm/transhuge.html#admin-guide-transhuge)."
},
transparentHugePageDefrag: {
type: 'string',
title: 'Whether the kernel should make aggressive use of memory compaction to make more hugepages available.',
description: "Valid values are 'always', 'defer', 'defer+madvise', 'madvise' and 'never'. The default is 'madvise'. For more information see [Transparent Hugepages](https://www.kernel.org/doc/html/latest/admin-guide/mm/transhuge.html#admin-guide-transhuge)."
},
swapFileSizeMB: {
type: 'integer',
format: 'int32',
description: 'The size in MB of a swap file that will be created on each node.'
}
}
},
enableEncryptionAtHost: {
type: 'boolean',
title: 'Whether to enable host based OS and data drive encryption.',
description: 'This is only supported on certain VM sizes and in certain Azure regions. For more information, see: https://docs.microsoft.com/azure/aks/enable-host-encryption'
},
enableUltraSSD: {
type: 'boolean',
description: 'Whether to enable UltraSSD'
},
enableFIPS: {
type: 'boolean',
title: 'Whether to use a FIPS-enabled OS.',
description: 'See [Add a FIPS-enabled node pool](https://docs.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool-preview) for more details.'
},
gpuInstanceProfile: {
description: 'GPUInstanceProfile to be used to specify GPU MIG instance profile for supported GPU VM SKU.',
type: 'string',
enum: [ 'MIG1g', 'MIG2g', 'MIG3g', 'MIG4g', 'MIG7g' ],
'x-ms-enum': {
name: 'GPUInstanceProfile ',
modelAsString: true
}
},
creationData: {
description: 'CreationData to be used to specify the source Snapshot ID if the node pool will be created/upgraded using a snapshot.',
type: 'object',
properties: {
sourceResourceId: {
type: 'string',
format: 'arm-id',
description: 'This is the ARM ID of the source object to be used to create the target object.'
}
}
},
hostGroupID: {
type: 'string',
format: 'arm-id',
'x-ms-arm-id-details': {
allowedResources: [ { type: 'Microsoft.Compute/hostGroups' } ]
},
title: 'The fully qualified resource ID of the Dedicated Host Group to provision virtual machines from, used only in creation scenario and not allowed to changed once set.',
description: 'This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/hostGroups/{hostGroupName}. For more information see [Azure dedicated hosts](https://docs.microsoft.com/azure/virtual-machines/dedicated-hosts).'
}
},
description: 'Properties for the container service agent pool profile.'
}
],
properties: {
name: {
type: 'string',
title: 'Unique name of the agent pool profile in the context of the subscription and resource group.',
description: 'Windows agent pool names must be 6 characters or less.',
pattern: '^[a-z][a-z0-9]{0,11}$'
}
},
required: [ 'name' ],
description: 'Profile for the container service agent pool.'
},
'x-ms-identifiers': [],
description: 'The agent pool properties.'
},
linuxProfile: {
description: 'The profile for Linux VMs in the Managed Cluster.',
type: 'object',
properties: {
adminUsername: {
type: 'string',
description: 'The administrator username to use for Linux VMs.',
pattern: '^[A-Za-z][-A-Za-z0-9_]*$'
},
ssh: {
description: 'The SSH configuration for Linux-based VMs running on Azure.',
type: 'object',
properties: {
publicKeys: {
type: 'array',
items: {
type: 'object',
properties: {
keyData: {
type: 'string',
description: 'Certificate public key used to authenticate with VMs through SSH. The certificate must be in PEM format with or without headers.'
}
},
required: [ 'keyData' ],
description: 'Contains information about SSH certificate public key data.'
},
'x-ms-identifiers': [],
description: 'The list of SSH public keys used to authenticate with Linux-based VMs. A maximum of 1 key may be specified.'
}
},
required: [ 'publicKeys' ]
}
},
required: [ 'adminUsername', 'ssh' ]
},
windowsProfile: {
description: 'The profile for Windows VMs in the Managed Cluster.',
type: 'object',
properties: {
adminUsername: {
type: 'string',
description: 'Specifies the name of the administrator account. <br><br> **Restriction:** Cannot end in "." <br><br> **Disallowed values:** "administrator", "admin", "user", "user1", "test", "user2", "test1", "user3", "admin1", "1", "123", "a", "actuser", "adm", "admin2", "aspnet", "backup", "console", "david", "guest", "john", "owner", "root", "server", "sql", "support", "support_388945a0", "sys", "test2", "test3", "user4", "user5". <br><br> **Minimum-length:** 1 character <br><br> **Max-length:** 20 characters'
},
adminPassword: {
type: 'string',
description: 'Specifies the password of the administrator account. <br><br> **Minimum-length:** 8 characters <br><br> **Max-length:** 123 characters <br><br> **Complexity requirements:** 3 out of 4 conditions below need to be fulfilled <br> Has lower characters <br>Has upper characters <br> Has a digit <br> Has a special character (Regex match [\\W_]) <br><br> **Disallowed values:** "abc@123", "P@$$w0rd", "P@ssw0rd", "P@ssword123", "Pa$$word", "pass@word1", "Password!", "Password1", "Password22", "iloveyou!"'
},
licenseType: {
type: 'string',
enum: [ 'None', 'Windows_Server' ],
'x-ms-enum': {
name: 'licenseType',
modelAsString: true,
values: [
{
value: 'None',
description: 'No additional licensing is applied.'
},
{
value: 'Windows_Server',
description: 'Enables Azure Hybrid User Benefits for Windows VMs.'
}
]
},
description: 'The license type to use for Windows VMs. See [Azure Hybrid User Benefits](https://azure.microsoft.com/pricing/hybrid-benefit/faq/) for more details.'
},
enableCSIProxy: {
type: 'boolean',
title: 'Whether to enable CSI proxy.',
description: 'For more details on CSI proxy, see the [CSI proxy GitHub repo](https://github.com/kubernetes-csi/csi-proxy).'
},
gmsaProfile: {
description: 'The Windows gMSA Profile in the Managed Cluster.',
type: 'object',
properties: {
enabled: {
type: 'boolean',
title: 'Whether to enable Windows gMSA.',
description: 'Specifies whether to enable Windows gMSA in the managed cluster.'
},
dnsServer: {
type: 'string',
description: 'Specifies the DNS server for Windows gMSA. <br><br> Set it to empty if you have configured the DNS server in the vnet which is used to create the managed cluster.'
},
rootDomainName: {
type: 'string',
description: 'Specifies the root domain name for Windows gMSA. <br><br> Set it to empty if you have configured the DNS server in the vnet which is used to create the managed cluster.'
}
}
}
},
required: [ 'adminUsername' ]
},
servicePrincipalProfile: {
description: 'Information about a service principal identity for the cluster to use for manipulating Azure APIs.',
type: 'object',
properties: {
clientId: {
type: 'string',
description: 'The ID for the service principal.'
},
secret: {
type