Cluster Creation & Configuration

# Step 1: Create a resource group
az group create --name rg-aks-dev --location eastus

# Step 2: Create a minimal dev cluster
az aks create \
  --resource-group rg-aks-dev \
  --name dev-cluster \
  --node-count 2 \
  --node-vm-size Standard_B2s \
  --kubernetes-version 1.29.2 \
  --network-plugin kubenet \
  --enable-managed-identity \
  --generate-ssh-keys \
  --enable-addons monitoring \
  --tier free \
  --tags Environment=dev Team=engineering

# This takes ~5-8 minutes. Output includes the cluster's full JSON configuration.

# Production cluster with all the bells and whistles
az aks create \
  --resource-group rg-aks-prod \
  --name prod-cluster \
  --node-count 3 \
  --node-vm-size Standard_D4s_v5 \
  --kubernetes-version 1.28.5 \
  --network-plugin azure \
  --vnet-subnet-id "/subscriptions/{sub}/resourceGroups/rg-network/providers/Microsoft.Network/virtualNetworks/prod-vnet/subnets/aks-subnet" \
  --enable-managed-identity \
  --enable-addons monitoring,azure-policy \
  --zones 1 2 3 \
  --tier standard \
  --max-pods 110 \
  --enable-cluster-autoscaler \
  --min-count 3 \
  --max-count 10 \
  --auto-upgrade-channel node-image \
  --tags Environment=production Team=platform CostCenter=CC-1234

# Key differences from dev:
# - Azure CNI with BYO VNet (--network-plugin azure + --vnet-subnet-id)
# - Availability zones (--zones 1 2 3)
# - Standard SLA tier (--tier standard)  
# - Cluster autoscaler enabled
# - Auto-upgrade for node images
# - Azure Policy add-on for governance

# Download credentials and set kubectl context
az aks get-credentials --resource-group rg-aks-dev --name dev-cluster

# Verify the connection
kubectl cluster-info

# Example output:
# Kubernetes control plane is running at https://dev-cluster-rg-aks-dev-abc123.hcp.eastus.azmk8s.io:443
# CoreDNS is running at https://...

# Check nodes are ready
kubectl get nodes -o wide

# Check your current context (which cluster kubectl is talking to)
kubectl config current-context
# Output: dev-cluster

# List all contexts (if you have multiple clusters)
kubectl config get-contexts

# Switch between clusters
kubectl config use-context prod-cluster

# Check available upgrades for your cluster
az aks get-upgrades --resource-group rg-aks-dev --name dev-cluster -o table

# Example output:
# Name     ResourceGroup    MasterVersion    Upgrades
# -------  ---------------  ---------------  --------
# default  rg-aks-dev       1.29.2           1.30.0

# Upgrade the cluster (control plane + all node pools)
az aks upgrade \
  --resource-group rg-aks-dev \
  --name dev-cluster \
  --kubernetes-version 1.30.0

# Upgrade only the control plane (node pools stay on old version)
az aks upgrade \
  --resource-group rg-aks-dev \
  --name dev-cluster \
  --kubernetes-version 1.30.0 \
  --control-plane-only

# Upgrade a specific node pool
az aks nodepool upgrade \
  --resource-group rg-aks-dev \
  --cluster-name dev-cluster \
  --name agentpool \
  --kubernetes-version 1.30.0

# Check upgrade status
az aks show --resource-group rg-aks-dev --name dev-cluster \
  --query "{version:kubernetesVersion, provisioningState:provisioningState}"

# Stop a dev cluster at end of day — stops all billing for node VMs
az aks stop --resource-group rg-aks-dev --name dev-cluster

# Check the cluster state
az aks show --resource-group rg-aks-dev --name dev-cluster --query powerState
# Output: { "code": "Stopped" }

# Start the cluster next morning
az aks start --resource-group rg-aks-dev --name dev-cluster

# Verify nodes are back
kubectl get nodes
# Nodes may take 1-3 minutes to become Ready after start

# Pro tip: Automate with Azure Automation
# Create a runbook that runs "az aks stop" at 7 PM and "az aks start" at 8 AM
# Saves ~60% on dev cluster compute costs (13 hours stopped per weekday)

# View the full cluster configuration
az aks show --resource-group rg-aks-dev --name dev-cluster -o json | jq '{
  name: .name,
  version: .kubernetesVersion,
  tier: .sku.tier,
  nodeCount: .agentPoolProfiles[0].count,
  vmSize: .agentPoolProfiles[0].vmSize,
  networkPlugin: .networkProfile.networkPlugin,
  autoUpgrade: .autoUpgradeProfile.upgradeChannel,
  addons: [.addonProfiles | to_entries[] | select(.value.enabled) | .key]
}'

# Check what add-ons are enabled
az aks addon list --resource-group rg-aks-dev --name dev-cluster -o table

# View cluster auto-upgrade settings
az aks show --resource-group rg-aks-dev --name dev-cluster \
  --query autoUpgradeProfile -o json

# Check maintenance window configuration
az aks maintenanceconfiguration list \
  --resource-group rg-aks-dev --cluster-name dev-cluster -o table

# Common errors and fixes:

# ERROR: "The VM size 'Standard_D4s_v5' is not available in location 'westus'"
# Fix: Check available VM sizes in your region
az vm list-sizes --location eastus -o table | grep D4s

# ERROR: "Operation could not be completed as it results in exceeding approved Total Regional Cores quota"
# Fix: Check your quota and request an increase
az vm list-usage --location eastus -o table | grep -i "total regional"
# Go to Azure Portal → Subscriptions → Usage + Quotas → Request increase

# ERROR: "SubnetIsFull" or "InsufficientSubnetSize"
# Fix: Your subnet doesn't have enough IPs for nodes + pods (Azure CNI)
# Azure CNI needs: (max_pods_per_node + 1) × node_count IPs
# For 3 nodes with 110 max pods: (110 + 1) × 3 = 333 IPs → /23 subnet minimum
# Resize subnet or use a larger one

# ERROR: "LinkedAuthorizationFailed"
# Fix: Your managed identity doesn't have permissions on the VNet/subnet
# Grant "Network Contributor" role on the subnet:
az role assignment create \
  --assignee $(az aks show -g rg-aks-prod -n prod-cluster --query identity.principalId -o tsv) \
  --role "Network Contributor" \
  --scope "/subscriptions/{sub}/resourceGroups/rg-network/providers/Microsoft.Network/virtualNetworks/prod-vnet/subnets/aks-subnet"

# Step 1: Make sure you fetched credentials for the right cluster
az aks get-credentials --resource-group rg-aks-dev --name dev-cluster --overwrite-existing

# Step 2: Check the kubeconfig is valid
kubectl config view --minify --raw

# Step 3: If using Azure AD auth and getting "Interactive login required"
# You need to use the Azure AD credential flow:
az aks get-credentials --resource-group rg-aks-dev --name dev-cluster --format exec
# Then run any kubectl command — it will open a browser for Azure AD login

# Step 4: If using authorized IP ranges
MY_IP=$(curl -s https://ifconfig.me)
echo "My IP: $MY_IP"
az aks show -g rg-aks-dev -n dev-cluster --query apiServerAccessProfile.authorizedIpRanges
# If your IP isn't listed:
az aks update -g rg-aks-dev -n dev-cluster --api-server-authorized-ip-ranges "$MY_IP/32"

# Step 5: Check if the cluster is stopped
az aks show -g rg-aks-dev -n dev-cluster --query powerState.code -o tsv
# If "Stopped": az aks start -g rg-aks-dev -n dev-cluster

# Step 1: Check the cluster provisioning state
az aks show -g rg-aks-dev -n dev-cluster --query provisioningState -o tsv
# Possible states: Succeeded, Upgrading, Failed, Canceled

# Step 2: If "Upgrading" for too long, check node pool upgrade status
az aks nodepool show -g rg-aks-dev --cluster-name dev-cluster -n agentpool \
  --query "{provisioningState:provisioningState, currentOrchestratorVersion:currentOrchestratorVersion}"

# Step 3: Check for PDB (PodDisruptionBudget) blocking the drain
kubectl get pdb -A
# If a PDB prevents eviction, the node drain hangs, blocking the upgrade
# Temporarily relax the PDB or fix the app to handle disruptions

# Step 4: Check for pods without controllers (bare pods can't be evicted)
kubectl get pods -A --field-selector metadata.ownerReferences= 

# Step 5: If the upgrade failed, check the activity log
az monitor activity-log list --resource-group rg-aks-dev --status Failed --offset 2h -o table

# Step 6: For a failed upgrade, retry or force
az aks upgrade -g rg-aks-dev -n dev-cluster --kubernetes-version 1.30.0 --yes