Connect Crossplane to Microsoft Azure to create and manage cloud resources from Kubernetes with the Azure Official Provider.
This guide walks you through the steps required to get started with the Azure Official Provider. This includes installing Upbound Universal Crossplane, configuring the provider to authenticate to Azure and creating a Managed Resource in Azure directly from your Kubernetes cluster.
curl -sL "https://cli.upbound.io"| sh
sudo mv up /usr/local/bin/
Install Upbound Universal Crossplane
Upbound Universal Crossplane (UXP) consists of upstream Crossplane and Upbound-specific enhancements and patches. It’s open source and maintained by Upbound.
Install UXP with the Up command-line up uxp install command.
kubectl get pods -n upbound-system
NAME READY STATUS RESTARTS AGE
crossplane-7fdfbd897c-pmrml 1/1 Running 0 68m
crossplane-rbac-manager-7d6867bc4d-v7wpb 1/1 Running 0 68m
For more details about UXP pods, read the UXP section.
Installing UXP and Crossplane creates new Kubernetes API end-points. Take a look at the new API end-points with kubectl api-resources | grep crossplane. In a later step you use the Provider
resource install the Official Provider.
kubectl get providers
NAME INSTALLED HEALTHY PACKAGE AGE
upbound-provider-azure True True xpkg.upbound.io/upbound/provider-azure:v0.16.0 3m3s
A provider installs their own Kubernetes Custom Resource Definitions (CRDs). These CRDs allow you to create Azure resources directly inside Kubernetes.
You can view the new CRDs with kubectl get crds. Every CRD maps to a unique Azure service Crossplane can provision and manage.
Save your Azure JSON output as azure-credentials.json.
The Configuration section of the Provider documentation describes other authentication methods.
Create a Kubernetes secret with the Azure credentials
A Kubernetes generic secret has a name and contents. Use kubectl create secret
to generate the secret object named azure-secret
in the upbound-system
namespace.
Use the --from-file=
argument to set the value to the contents of the azure-credentials.json
file.
This attaches the Azure credentials, saved as a Kubernetes secret, as a secretRef
.
The spec.credentials.secretRef.name
value is the name of the Kubernetes secret containing the Azure credentials in the spec.credentials.secretRef.namespace
.
Create a managed resource
A managed resource is anything Crossplane creates and manages outside of the Kubernetes cluster. This creates an Azure Resource group with Crossplane. The Resource group is a managed resource.
A resource group is one of the fastest Azure resources to provision.
kubectl describe ResourceGroup
Name: example-rg
Namespace:
Labels: <none>
Annotations: crossplane.io/external-name: example-rg
API Version: azure.upbound.io/v1beta1
Kind: ResourceGroup
# Output trimmed for brevitySpec:
Deletion Policy: Delete
For Provider:
Location: East US
Provider Config Ref:
Name: default
Status:
At Provider:
Conditions:
Last Transition Time: 2022-10-12T02:17:40Z
Message: observe failed: cannot run refresh: refresh failed: building account: getting authenticated object ID: listing Service Principals: ServicePrincipalsClient.BaseClient.Get(): clientCredentialsToken: received HTTP status 401 with response: {"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '76af2645-91b4-4087-aff3-e05bf1f1b88c'.\r\nTrace ID: 26369fb5-ab9c-4ba2-bb74-179818cc2e00\r\nCorrelation ID: 0fefd33e-dc03-4450-b70f-4b9a9c23143a\r\nTimestamp: 2022-10-12 02:17:40Z","error_codes":[7000215],"timestamp":"2022-10-12 02:17:40Z","trace_id":"26369fb5-ab9c-4ba2-bb74-179818cc2e00","correlation_id":"0fefd33e-dc03-4450-b70f-4b9a9c23143a","error_uri":"https://login.microsoftonline.com/error?code=7000215"}:
Reason: ReconcileError
Status: False
Type: Synced
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning CannotObserveExternalResource 24s managed/azure.upbound.io/v1beta1, kind=resourcegroup cannot run refresh: refresh failed: building account: getting authenticated object ID: listing Service Principals: ServicePrincipalsClient.BaseClient.Get(): clientCredentialsToken: received HTTP status 401 with response: {"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '76af2645-91b4-4087-aff3-e05bf1f1b88c'.\r\nTrace ID: 54dd6c59-972b-4194-8d5c-81ccc9df2700\r\nCorrelation ID: 9d5df199-426b-45d4-bbd4-4d46703dff85\r\nTimestamp: 2022-10-12 02:17:17Z","error_codes":[7000215],"timestamp":"2022-10-12 02:17:17Z","trace_id":"54dd6c59-972b-4194-8d5c-81ccc9df2700","correlation_id":"9d5df199-426b-45d4-bbd4-4d46703dff85","error_uri":"https://login.microsoftonline.com/error?code=7000215"}:
The error message in the Condition indicates the problem.
Invalid client secret provided.
To fix the problem:
Update your Azure credentials in the azure-credentials.json text file.
