Azure AKS

Prerequisites

An Azure subscription with permissions to create AKS, ACR, and networking resources.

A MongoDB Atlas subscription, or Azure Cosmos DB for MongoDB.

Two domain names: a regular one such as example.com, and a wildcard subdomain for proxy support such as *.proxy.example.com.

TLS certificates for those domains.

An identity provider, such as Okta, if you intend to use SAML.

An ingress controller, or a decision about which one to use. SecurSpaces cannot serve traffic without one, and only NetScaler CPX is deployed by the chart. See Ingress.

For sizing and supported versions, see System requirements.

Install the following tools:

Create an AKS cluster

Create a resource group. This is the logical container for the deployment, and its location determines where resources run when you do not specify one:

az group create --name $MY_RESOURCE_GROUP_NAME --location $REGION
<!--NeedCopy-->

Create the cluster. The following example creates a cluster with a system-assigned managed identity:

az aks create \
  --resource-group $MY_RESOURCE_GROUP_NAME \
  --name $MY_AKS_CLUSTER_NAME \
  --node-count 1 \
  --generate-ssh-keys
<!--NeedCopy-->

The example creates a single node. Size the cluster for your expected load: the reference sizing for around 500 developers is two Standard_D8as_v6 service nodes (8 vCPU, 32 GiB) and an autoscaling workspace pool of Standard_D16as_v6 (16 vCPU, 64 GiB). See Sizing.

Download the credentials and point kubectl at the cluster:

az aks get-credentials --resource-group $MY_RESOURCE_GROUP_NAME --name $MY_AKS_CLUSTER_NAME
<!--NeedCopy-->

Verify the connection:

kubectl get nodes
<!--NeedCopy-->

Create an Azure Container Registry

SecurSpaces pulls its service images and your workspace images from a registry you control. The installer pushes them there in the next stage.

Create the registry. The name must be unique within Azure and contain 5 to 50 lowercase alphanumeric characters:

az acr create --resource-group myResourceGroup --name mycontainerregistry --sku Basic
<!--NeedCopy-->

Create a service principal with the AcrOwner role. The command returns the appId, displayName, password, and tenant:

acr_resource_id=$(az acr show --name <acr-name> --query id --output tsv)
az ad sp create-for-rbac --name <service-principal-name> --role AcrOwner --scopes ${acr_resource_id} --sdk-auth
<!--NeedCopy-->

Verify the service principal by signing in to the registry:

docker login <acr-name>.azurecr.io --username <service-principal-id>
<!--NeedCopy-->

Attach the registry to the cluster, so AKS can pull from ACR without further credentials:

az aks update --name myAKSCluster --resource-group myResourceGroup --attach-acr <acr-name>
<!--NeedCopy-->

Create a MongoDB database

SecurSpaces stores its platform state in MongoDB. For what it holds and how large to expect it to grow, see The SecurSpaces database.

In MongoDB Atlas, open the database page and select Create.

Creating a MongoDB Service

Configure the deployment and select Create Deployment:

Select Azure as the cloud provider.
Choose the same region as the AKS cluster.
Select the M10 tier with autoscaling.

Creating a MongoDB Service

On the Database Access page, add a user.

Creating a MongoDB Service

On the Network Access page, allow your AKS cluster to reach the database. Add the cluster’s outbound IP ranges, or use private endpoints, which is the more secure option.

Creating a MongoDB Service

You can also run MongoDB inside the cluster instead of using a hosted service. See Configure an external database.

Prerequisites

Create an AKS cluster

Create an Azure Container Registry

Create a MongoDB database

Next step

In this article

Azure AKS

Prerequisites

Create an AKS cluster

Create an Azure Container Registry

Create a MongoDB database

Next step

Related information

In this article