Azure AKS en production : bonnes pratiques pour Kubernetes managé

AKS (Azure Kubernetes Service) est le Kubernetes managé de Microsoft. Intégré nativement avec Azure AD, ACR et Azure Monitor, il est naturellement adapté aux organisations déjà dans l’écosystème Azure.

Créer un cluster AKS avec Terraform

resource "azurerm_kubernetes_cluster" "main" {
  name                = "myapp-production"
  location            = var.location
  resource_group_name = azurerm_resource_group.main.name
  dns_prefix          = "myapp-prod"
  kubernetes_version  = "1.29"

  default_node_pool {
    name                = "system"
    node_count          = 3
    vm_size             = "Standard_D2s_v5"
    vnet_subnet_id      = azurerm_subnet.aks.id
    enable_auto_scaling = true
    min_count           = 2
    max_count           = 5
    only_critical_addons_enabled = true  # réservé aux pods système
  }

  identity {
    type = "SystemAssigned"
  }

  network_profile {
    network_plugin    = "azure"
    network_policy    = "calico"
    service_cidr      = "10.100.0.0/16"
    dns_service_ip    = "10.100.0.10"
  }

  azure_active_directory_role_based_access_control {
    managed                = true
    azure_rbac_enabled     = true
    admin_group_object_ids = [var.aks_admins_group_id]
  }

  oms_agent {
    log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id
  }

  key_vault_secrets_provider {
    secret_rotation_enabled = true
  }
}

# Node pool séparé pour les workloads applicatifs
resource "azurerm_kubernetes_cluster_node_pool" "apps" {
  name                  = "apps"
  kubernetes_cluster_id = azurerm_kubernetes_cluster.main.id
  vm_size               = "Standard_D4s_v5"
  enable_auto_scaling   = true
  min_count             = 1
  max_count             = 20
  vnet_subnet_id        = azurerm_subnet.aks.id

  node_labels = {
    "role" = "application"
  }
}

Accès avec Azure AD RBAC

# Récupérer les credentials
az aks get-credentials --resource-group myapp-prod-rg --name myapp-production

# Assigner le rôle "Azure Kubernetes Service Cluster User" à un groupe AD
az role assignment create   --assignee <groupe-ad-id>   --role "Azure Kubernetes Service Cluster User Role"   --scope $(az aks show -g myapp-prod-rg -n myapp-production --query id -o tsv)

# ClusterRoleBinding pour les développeurs
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: aks-developers
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: <azure-ad-group-object-id>

Intégration avec Azure Container Registry

# Autoriser AKS à puller depuis ACR
az aks update --name myapp-production   --resource-group myapp-prod-rg   --attach-acr myappregistry

Azure Key Vault + Secrets Store CSI Driver

# Monter des secrets Key Vault comme fichiers dans les pods
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: myapp-secrets
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    userAssignedIdentityID: ""
    keyvaultName: "myapp-keyvault"
    objects: |
      array:
        - |
          objectName: db-password
          objectType: secret
    tenantId: "<tenant-id>"
---
spec:
  volumes:
    - name: secrets
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: myapp-secrets
  containers:
    - volumeMounts:
        - name: secrets
          mountPath: /mnt/secrets
          readOnly: true

Notre formation Azure couvre AKS avec des ateliers Terraform complets sur des souscriptions Azure réelles.